Malware Analysis Report

2024-12-07 14:07

Sample ID 241112-bfnwastqhl
Target 8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
SHA256 8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520
Tags
nanocore discovery evasion keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520

Threat Level: Known bad

The file 8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe was found to be: Known bad.

Malicious Activity Summary

nanocore discovery evasion keylogger persistence spyware stealer trojan

NanoCore

Nanocore family

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 01:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 01:05

Reported

2024-11-12 01:07

Platform

win7-20240903-en

Max time kernel

149s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\INTELLIGENSERELEVATORVOGNSAST = "wscript \"C:\\Users\\Admin\\banbatrawlingsundersgelsesa\\inulintentersbournssteepnesses.vbs\"" C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
File created C:\Program Files (x86)\UDP Service\udpsv.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2096 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 2096 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 2096 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 2096 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 1696 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1696 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1696 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1696 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 2528 wrote to memory of 1844 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 2528 wrote to memory of 1844 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 2528 wrote to memory of 1844 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 2528 wrote to memory of 1844 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1844 wrote to memory of 2152 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2152 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2152 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2152 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2508 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2508 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2508 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1844 wrote to memory of 2508 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe

"C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe"

C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe

"C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe"

C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

"C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com"

C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

"C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB0F7.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpB185.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp
N/A 127.0.0.1:4070 tcp

Files

memory/2096-4-0x0000000077601000-0x0000000077702000-memory.dmp

memory/2096-5-0x0000000077600000-0x00000000777A9000-memory.dmp

C:\Windows\win.ini

MD5 487dec5afe511f0efc16e6ec6b0b7f2b
SHA1 855c52edcd1166149e8fa146bb184e88a23feeee
SHA256 18009dddef6d177fc7bd9bbd51ec586cf6f50fa1538bf55d195824515a60cc6d
SHA512 caea952c4fffd9b12613cfd5145ef902fac88bda8805a9093f2e0f2de141b0875050377857f9a34d2595c83db9df8f99020e58dcc3b9db1999978c1845bfc32f

memory/2096-12-0x00000000777F0000-0x00000000778C6000-memory.dmp

memory/1696-11-0x0000000077600000-0x00000000777A9000-memory.dmp

\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

MD5 0fd258899fb1afe14d8bd10503263901
SHA1 a74e78231d749099ed97a3990fa956b8ccbcbcfd
SHA256 8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520
SHA512 0d263abf7a29554b570633f17b7172531e343448c2b5969a00d81b04fd758250ba9398427c59d6e2270db6c19563e4eb6e648f946e6eb131ea43b6fb89349916

memory/1844-35-0x0000000000400000-0x0000000000602000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpB0F7.tmp

MD5 6673745d174e2b56990535bfe6e19329
SHA1 d6037df3923e9814843001feebde143e2a545588
SHA256 83b0432e6315318c1ee79845b037ee0c423d714f8df3efc44d82f8fcd1937c40
SHA512 e1b7c5163aa0c4bf14bfbe80f2957ba5cb1919590a4773098815c1051fb7d67455a8c46777ec90b9d7a4a8f9460580edbdb4b4c81118c9df98e5927beacb6edc

C:\Users\Admin\AppData\Local\Temp\tmpB185.tmp

MD5 0a24db62cb5b84309c4803346caaa25d
SHA1 67660778f61bb44168c33ed3fe56ed86cf9583e8
SHA256 38d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512 d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 01:05

Reported

2024-11-12 01:07

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe"

Signatures

NanoCore

keylogger trojan stealer spyware nanocore

Nanocore family

nanocore

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\INTELLIGENSERELEVATORVOGNSAST = "wscript \"C:\\Users\\Admin\\banbatrawlingsundersgelsesa\\inulintentersbournssteepnesses.vbs\"" C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGP Service = "C:\\Program Files (x86)\\AGP Service\\agpsv.exe" C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\AGP Service\agpsv.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
File opened for modification C:\Program Files (x86)\AGP Service\agpsv.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2364 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 2364 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 2364 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe
PID 1116 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1116 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1116 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 788 wrote to memory of 1056 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 788 wrote to memory of 1056 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 788 wrote to memory of 1056 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com
PID 1056 wrote to memory of 1848 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1056 wrote to memory of 1848 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1056 wrote to memory of 1848 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1056 wrote to memory of 3656 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1056 wrote to memory of 3656 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe
PID 1056 wrote to memory of 3656 N/A C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe

"C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe"

C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe

"C:\Users\Admin\AppData\Local\Temp\8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520.exe"

C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

"C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com"

C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

"C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "AGP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpABD0.tmp"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /create /f /tn "AGP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpAC2F.tmp"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 25.69.169.192.in-addr.arpa udp
US 8.8.8.8:53 pacotdc20.duckdns.org udp
US 192.169.69.25:4070 pacotdc20.duckdns.org tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 28.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/2364-4-0x0000000077771000-0x0000000077891000-memory.dmp

memory/2364-5-0x0000000077771000-0x0000000077891000-memory.dmp

C:\Windows\win.ini

MD5 c29eaf8ada8aff11e10ccca9012d1b0f
SHA1 dfb41f39db4283051eed8ae9fef9c7e569834545
SHA256 167ff918a918ba513b9e575cebd04762a698c2ce04c2b4bf66c2eb2258571bac
SHA512 5cc2b92b841a1cab6082dd495ddbf72b6add75bc6a1ab9ce35d65ea0307451739a04facb002c40e2d1296484332a64bd77b36f6ea5c972edfd484df2b2b82b5b

C:\Users\Admin\banbatrawlingsundersgelsesa\inulintentersbournssteepnesses.com

MD5 0fd258899fb1afe14d8bd10503263901
SHA1 a74e78231d749099ed97a3990fa956b8ccbcbcfd
SHA256 8c276db9d256a4ec6df10a663fa13ad291832b41fdf915aec25bc4fb31174520
SHA512 0d263abf7a29554b570633f17b7172531e343448c2b5969a00d81b04fd758250ba9398427c59d6e2270db6c19563e4eb6e648f946e6eb131ea43b6fb89349916

memory/1056-28-0x0000000000400000-0x0000000000602000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpABD0.tmp

MD5 6673745d174e2b56990535bfe6e19329
SHA1 d6037df3923e9814843001feebde143e2a545588
SHA256 83b0432e6315318c1ee79845b037ee0c423d714f8df3efc44d82f8fcd1937c40
SHA512 e1b7c5163aa0c4bf14bfbe80f2957ba5cb1919590a4773098815c1051fb7d67455a8c46777ec90b9d7a4a8f9460580edbdb4b4c81118c9df98e5927beacb6edc

C:\Users\Admin\AppData\Local\Temp\tmpAC2F.tmp

MD5 7a81ae69c04c8d95261eb5f490b7f869
SHA1 9f4f484d306fea15b2e7f9f16db660833bb1f8ce
SHA256 ce3933e772f663a834335cc2071e5e7b2d49a065b51d84a259054b8ef663e785
SHA512 8260ab83106752a488e164bbed63ef334d34399bc9a5c09a0cfceba6aef48eafe5c64e4dfbd353ac3edfff2523b16c2b0287d34833a293c4436e068fae656de8