Malware Analysis Report

2024-11-16 13:08

Sample ID 241111-hwgv9avfmm
Target b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
SHA256 b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721
Tags
redline sectoprat cheat discovery execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721

Threat Level: Known bad

The file b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat discovery execution infostealer rat trojan

Redline family

SectopRAT

Sectoprat family

RedLine

RedLine payload

SectopRAT payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 07:05

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-11 07:05

Reported

2024-11-11 07:07

Platform

win10v2004-20241007-en

Max time kernel

102s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Sectoprat family

sectoprat

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4808 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4808 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 4808 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 4808 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 4808 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

"C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC2F2.tmp"

C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

"C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
NL 45.137.22.248:55615 tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
NL 45.137.22.248:55615 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 45.137.22.248:55615 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
NL 45.137.22.248:55615 tcp

Files

memory/4808-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/4808-1-0x0000000000110000-0x000000000019C000-memory.dmp

memory/4808-2-0x0000000004F90000-0x0000000005534000-memory.dmp

memory/4808-3-0x0000000004A80000-0x0000000004B12000-memory.dmp

memory/4808-4-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4808-5-0x0000000004A50000-0x0000000004A5A000-memory.dmp

memory/4808-6-0x0000000004D50000-0x0000000004DEC000-memory.dmp

memory/4808-7-0x0000000004F10000-0x0000000004F2C000-memory.dmp

memory/4808-8-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/4808-9-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4808-10-0x00000000022B0000-0x0000000002310000-memory.dmp

memory/2624-15-0x0000000002750000-0x0000000002786000-memory.dmp

memory/2624-17-0x00000000053D0000-0x00000000059F8000-memory.dmp

memory/2624-16-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/2624-18-0x00000000748A0000-0x0000000075050000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC2F2.tmp

MD5 374740293b951eaff7d27def4d21c072
SHA1 e4f6cce0cf1a049f3f0a189e3fc4cc0d94ce0e64
SHA256 0e1a497184bbc33f3830fc88a953ad7bd9f5cc4098354a0efc6c1aecfd3141ea
SHA512 551d11d4d89606495e39c73da588ddbfd73f45bedeeca66568de3cf480e2a67a1d812675817856c1da5e79d83f9190659fe6e678fc3f015c2edd0058716580e9

memory/4552-20-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/2624-22-0x0000000005350000-0x00000000053B6000-memory.dmp

memory/2624-23-0x0000000005A00000-0x0000000005A66000-memory.dmp

memory/2624-25-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/2624-21-0x00000000051B0000-0x00000000051D2000-memory.dmp

memory/4552-27-0x00000000748A0000-0x0000000075050000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1xa5rem.h0v.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4808-47-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/2624-45-0x0000000005A70000-0x0000000005DC4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/1632-24-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1632-50-0x00000000057A0000-0x00000000057B2000-memory.dmp

memory/1632-51-0x0000000005850000-0x000000000588C000-memory.dmp

memory/1632-49-0x0000000005DF0000-0x0000000006408000-memory.dmp

memory/1632-52-0x0000000005890000-0x00000000058DC000-memory.dmp

memory/4552-53-0x0000000005C30000-0x0000000005C4E000-memory.dmp

memory/1632-54-0x0000000005AF0000-0x0000000005BFA000-memory.dmp

memory/4552-57-0x0000000075130000-0x000000007517C000-memory.dmp

memory/2624-56-0x0000000075130000-0x000000007517C000-memory.dmp

memory/2624-55-0x0000000007180000-0x00000000071B2000-memory.dmp

memory/2624-76-0x00000000071C0000-0x00000000071DE000-memory.dmp

memory/2624-77-0x00000000071F0000-0x0000000007293000-memory.dmp

memory/2624-79-0x0000000007330000-0x000000000734A000-memory.dmp

memory/2624-78-0x0000000007970000-0x0000000007FEA000-memory.dmp

memory/4552-80-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

memory/2624-81-0x0000000007630000-0x00000000076C6000-memory.dmp

memory/2624-82-0x00000000075B0000-0x00000000075C1000-memory.dmp

memory/2624-83-0x00000000075E0000-0x00000000075EE000-memory.dmp

memory/2624-84-0x00000000075F0000-0x0000000007604000-memory.dmp

memory/2624-85-0x00000000076F0000-0x000000000770A000-memory.dmp

memory/2624-86-0x00000000076D0000-0x00000000076D8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d3966657b776969de21f59526364ff89
SHA1 2100eaa7a1cbe5c7f3ffc015712a9370243eb096
SHA256 9e644a5bd726617629afdf3b3b2ac0a028aa17ed454d7f7bfc4584a3e05bceda
SHA512 41f0c3c5f8c6c29b2d9264628dd9a0e52d75b3f22d4b66cf0d2a641bc3f85e92bd056ef4543efef614331f3dee83866953624f6a6ec5f7b4e55e24504e83b699

memory/2624-92-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4552-93-0x00000000748A0000-0x0000000075050000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 07:05

Reported

2024-11-11 07:07

Platform

win7-20240903-en

Max time kernel

100s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sectoprat family

sectoprat

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2272 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Windows\SysWOW64\schtasks.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe
PID 2272 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

"C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF20C.tmp"

C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe

"C:\Users\Admin\AppData\Local\Temp\b4283dbd6c0414501d44222fff439edc15f88955179337f2ba8ae5ad70330721.exe"

Network

Country Destination Domain Proto
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp

Files

memory/2272-0-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2272-1-0x0000000000D60000-0x0000000000DEC000-memory.dmp

memory/2272-2-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2272-3-0x00000000005B0000-0x00000000005CC000-memory.dmp

memory/2272-4-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2272-5-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2272-6-0x0000000000600000-0x0000000000660000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF20C.tmp

MD5 6ed3b6f2a93bc16988bf7b2969225602
SHA1 81865ce40cf9aaaefe9d4f2fe0030cd981eaeafd
SHA256 65aee9c20ee0a75b4a7d113d595368edd41a5e527cf268cf479460fa072d9187
SHA512 808392c8d39559ec3ca04c445dd592beb77344c6d72e6d4d7fe4b4e2c752d509dfb904de1f6c25a9917206746e85dfee45a56db165a4bcae4acdb9863b9fc5c3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3UL4ER1ITE08V0TPIC4M.temp

MD5 f71247036e7c902e70f30e42ce69890f
SHA1 ec34c808f7f4f3c1cbc1cbbe9b66a6379e887621
SHA256 b59c5d7873fffb996fa3af7fde55c368ac6437aa1167285ee8b2f1cbfc1d8621
SHA512 6f7e38ed11e2ac16cedf3fc9d2d56ea732f476c91b9a10d49d66a7135ebb4c004f6ffcfaa20f56c9edab9a4a9cfb1a8a6da7c02aab381a404cc11d3613319e46

memory/2628-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2628-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2628-25-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2628-23-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2628-21-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2628-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2628-30-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2628-29-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2272-31-0x0000000074080000-0x000000007476E000-memory.dmp