Malware Analysis Report

2024-11-16 13:08

Sample ID 241112-gg93tawfkg
Target 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
SHA256 278b095c0694af6600aea03963b86d9b19c2811651ca792508de36c7ec55a250
Tags
redline sectoprat cheat discovery execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

278b095c0694af6600aea03963b86d9b19c2811651ca792508de36c7ec55a250

Threat Level: Known bad

The file 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat discovery execution infostealer rat trojan

Redline family

SectopRAT payload

Sectoprat family

SectopRAT

RedLine

RedLine payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 05:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 05:47

Reported

2024-11-12 05:49

Platform

win7-20240903-en

Max time kernel

101s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sectoprat family

sectoprat

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1964 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1964 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1964 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1964 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1964 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 1964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 1964 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp"

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

Network

Country Destination Domain Proto
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp

Files

memory/1964-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

memory/1964-1-0x0000000000180000-0x000000000020C000-memory.dmp

memory/1964-2-0x0000000073F60000-0x000000007464E000-memory.dmp

memory/1964-3-0x00000000005C0000-0x00000000005DC000-memory.dmp

memory/1964-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

memory/1964-5-0x0000000073F60000-0x000000007464E000-memory.dmp

memory/1964-6-0x0000000001EF0000-0x0000000001F50000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2YD1DO4OPL1ARJR8BSIX.temp

MD5 d1ef371096ca6f26cff982ca0e613ee1
SHA1 8b0def53945ce8b04d13cc29ed3992a54ae7fdf0
SHA256 3a5dc731db8abaaf140e71fe4fc7b94ed96a1f870133eb0c838785f53d509e8a
SHA512 2f278bb9c74e506ddedb5e60b462199447b344549f8b110c180bc7324777adc788b23cf29307b20ae36fa09c2540592c1cc3a5aa80e8e7e402ae7dd9df9b5836

C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp

MD5 6ed3b6f2a93bc16988bf7b2969225602
SHA1 81865ce40cf9aaaefe9d4f2fe0030cd981eaeafd
SHA256 65aee9c20ee0a75b4a7d113d595368edd41a5e527cf268cf479460fa072d9187
SHA512 808392c8d39559ec3ca04c445dd592beb77344c6d72e6d4d7fe4b4e2c752d509dfb904de1f6c25a9917206746e85dfee45a56db165a4bcae4acdb9863b9fc5c3

memory/2684-19-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2684-25-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-23-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-21-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-30-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2684-29-0x0000000000400000-0x000000000041E000-memory.dmp

memory/1964-31-0x0000000073F60000-0x000000007464E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 05:47

Reported

2024-11-12 05:49

Platform

win10v2004-20241007-en

Max time kernel

103s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Sectoprat family

sectoprat

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2580 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2580 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2580 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2580 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2580 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2580 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2580 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Windows\SysWOW64\schtasks.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
PID 2580 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF40.tmp"

C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe

"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
NL 45.137.22.248:55615 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 45.137.22.248:55615 tcp
NL 45.137.22.248:55615 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 45.137.22.248:55615 tcp

Files

memory/2580-0-0x000000007450E000-0x000000007450F000-memory.dmp

memory/2580-1-0x0000000000950000-0x00000000009DC000-memory.dmp

memory/2580-2-0x0000000005A90000-0x0000000006034000-memory.dmp

memory/2580-3-0x00000000053E0000-0x0000000005472000-memory.dmp

memory/2580-4-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/2580-5-0x00000000053C0000-0x00000000053CA000-memory.dmp

memory/2580-6-0x00000000056B0000-0x000000000574C000-memory.dmp

memory/2580-7-0x0000000005A40000-0x0000000005A5C000-memory.dmp

memory/2580-8-0x000000007450E000-0x000000007450F000-memory.dmp

memory/2580-9-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/2580-10-0x0000000002C40000-0x0000000002CA0000-memory.dmp

memory/2372-15-0x00000000048E0000-0x0000000004916000-memory.dmp

memory/2372-17-0x0000000004F50000-0x0000000005578000-memory.dmp

memory/2372-18-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/2372-16-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/2372-19-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/2372-20-0x0000000004DA0000-0x0000000004DC2000-memory.dmp

memory/2372-23-0x00000000055F0000-0x0000000005656000-memory.dmp

memory/2372-22-0x0000000005580000-0x00000000055E6000-memory.dmp

memory/1924-21-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/1924-25-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/1924-24-0x0000000006290000-0x00000000065E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tg5r43fk.2gh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1924-44-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/3112-46-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2580-48-0x0000000074500000-0x0000000074CB0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

C:\Users\Admin\AppData\Local\Temp\tmpCF40.tmp

MD5 c1aff092b811d9caeaab0c4dcdfb7c89
SHA1 c44f29b4e07108e01825aa75033bd8154c0ebcc2
SHA256 c8c45c85b7105c86101281c836a25363db04aa1765d6f6b2ea41e8df38538e77
SHA512 7bffaee6cd9efbfa3eb0a577a68ff4d0d5fdd6e56cacd905c706be014e426b300f45cb3b97679cff33a08d0e17fd0a0f9046bc23659d4cd7fa04372c38d415d8

memory/3112-51-0x00000000051D0000-0x00000000051E2000-memory.dmp

memory/3112-52-0x0000000005230000-0x000000000526C000-memory.dmp

memory/3112-50-0x0000000005930000-0x0000000005F48000-memory.dmp

memory/3112-53-0x0000000005270000-0x00000000052BC000-memory.dmp

memory/1924-54-0x0000000006950000-0x000000000696E000-memory.dmp

memory/3112-55-0x00000000054E0000-0x00000000055EA000-memory.dmp

memory/1924-57-0x0000000074D90000-0x0000000074DDC000-memory.dmp

memory/1924-56-0x00000000078F0000-0x0000000007922000-memory.dmp

memory/1924-77-0x0000000006F00000-0x0000000006F1E000-memory.dmp

memory/2372-67-0x0000000074D90000-0x0000000074DDC000-memory.dmp

memory/1924-78-0x0000000007930000-0x00000000079D3000-memory.dmp

memory/2372-79-0x00000000077E0000-0x0000000007E5A000-memory.dmp

memory/1924-80-0x0000000007C80000-0x0000000007C9A000-memory.dmp

memory/2372-81-0x0000000007210000-0x000000000721A000-memory.dmp

memory/1924-82-0x0000000007F00000-0x0000000007F96000-memory.dmp

memory/1924-83-0x0000000007E80000-0x0000000007E91000-memory.dmp

memory/1924-84-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

memory/2372-85-0x00000000073E0000-0x00000000073F4000-memory.dmp

memory/2372-86-0x00000000074E0000-0x00000000074FA000-memory.dmp

memory/2372-87-0x00000000074C0000-0x00000000074C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7e05964aa2a861dafc57961a7dbab6e8
SHA1 38e91b9082086c97b960dd8f4fbc92f0f0d51569
SHA256 3989465492296f4ca4fbd60d29cd923633ea494744ea2cc6c09744b9dcc30c88
SHA512 be98bbed7753c95fa0a5105e681d06ac125f8410a92063d9564376dcc21d4d3a63b98806c3f210c018c82db44242f83e0041463958c25888a1fe41808acdaf64

memory/2372-93-0x0000000074500000-0x0000000074CB0000-memory.dmp

memory/1924-94-0x0000000074500000-0x0000000074CB0000-memory.dmp