Malware Analysis Report

2025-08-06 02:17

Sample ID 241112-q7gcvstgmc
Target ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
SHA256 ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0
Tags
discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0

Threat Level: Known bad

The file ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe was found to be: Known bad.

Malicious Activity Summary

discovery persistence

Modifies WinLogon for persistence

Loads dropped DLL

Executes dropped EXE

Deletes itself

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Checks processor information in registry

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 13:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 13:53

Reported

2024-11-12 13:56

Platform

win7-20240903-en

Max time kernel

119s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Service Application = "C:\\Users\\Admin\\AppData\\Local\\Temp\\service.exe" C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1852 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 2428 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2428 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2428 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2428 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe
PID 2748 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Users\Admin\AppData\Local\Temp\service.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe

"C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe"

C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe

"C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\remove13241.bat" "

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 lowbyte.bigmops.ru udp

Files

memory/2428-6-0x0000000000400000-0x000000000041A000-memory.dmp

memory/1852-9-0x0000000000400000-0x000000000044B000-memory.dmp

memory/2428-8-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2428-12-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2428-11-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2428-4-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2428-2-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2428-0-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Users\Admin\remove13241.bat

MD5 6c6503303985b1ff09b979223e9b682c
SHA1 1172ca8d6ced99fe023e0de563e8ac36608e197d
SHA256 85d657a903ab6a6b8d226e273ba311b0c58074a7d3b01a0d402dfbf5910c9a43
SHA512 1d9ffffe6ac051b85852190228e687351dd275d1f0e0478826735699992646ee2b6f7bb79c0712ea274e68fe3606c8af14dfd292421c9c2fbbc68b03398fdad3

C:\Users\Admin\AppData\Local\Temp\service.exe

MD5 86ca0bc25c34d43750812b3a12a762aa
SHA1 95bb483eeae9544cac093963d24412ef4883f26d
SHA256 448f60b053d0c1ff8975b95e09d9267a3a492a7ca514359069e3cb97f53f3dc6
SHA512 2a3794ae9890fd69374c3ff44291a2b6aa430ff9410a0762f619165a7281dc98ad4709aac65286fb9e90b25bdf60b8e688fb5693545cac5e20b0ee99652ea271

memory/2428-40-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2616-54-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2748-53-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shell32.dll

MD5 cac6c9c44b7ba77569037004849f4d6d
SHA1 6bdf754cf0bb144e17ffd703663e4c5801598317
SHA256 745528a15bf44f5504e5a1a27a5397e70dd6b1790093928f730a181e74776835
SHA512 a38711de27f0ca7a3f0673f3fdc16e1aa20e7828b7db16041d6307e7c68f3ef78ee3e007754f98a4ff113f99ec1b32ffece6e16a7dfdae3e1a287e009b9fa114

memory/2616-56-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2616-57-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2616-58-0x0000000000400000-0x000000000041A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 13:53

Reported

2024-11-12 13:56

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\service.exe" C:\Windows\service.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\service.exe N/A
N/A N/A C:\Windows\service.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Service Application = "C:\\Windows\\service.exe" C:\Windows\service.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\service.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
File opened for modification C:\Windows\service.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
File created C:\Windows\service.exe C:\Windows\service.exe N/A
File opened for modification C:\Windows\service.exe C:\Windows\service.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\service.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\service.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 4932 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe
PID 1884 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 1884 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 1884 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\SysWOW64\cmd.exe
PID 1884 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\service.exe
PID 1884 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\service.exe
PID 1884 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe
PID 3104 wrote to memory of 3732 N/A C:\Windows\service.exe C:\Windows\service.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe

"C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe"

C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe

"C:\Users\Admin\AppData\Local\Temp\ac6a274f5fde714dfd8bba9e46bb724861e4b406ea132d119e2e872d0b58abd0N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove30108.bat" "

C:\Windows\service.exe

"C:\Windows\service.exe"

C:\Windows\service.exe

"C:\Windows\service.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 lowbyte.bigmops.ru udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 100.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/1884-0-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4932-2-0x0000000000400000-0x000000000044B000-memory.dmp

memory/1884-3-0x0000000000400000-0x000000000041A000-memory.dmp

memory/1884-4-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Windows\service.exe

MD5 6e3a65fc1cde08d4b32b9a5ffb493c4d
SHA1 a984cc254aae4ab91f3156c2ce3a6654c9c8a715
SHA256 4422e3f6805d73d8d0460489f46a52c630ab9856f1693e79b0c0980d9b86e62e
SHA512 5b89506ae0c1eb2d683b9c5033ba6aff379e5a83dd4f695fc0490f9e7314dafa9c344a5b1ddec95588111c397a4aef3a52ba253aa928e9af556b612f7f14f8fc

C:\Users\Admin\AppData\Local\Temp\remove30108.bat

MD5 6c6503303985b1ff09b979223e9b682c
SHA1 1172ca8d6ced99fe023e0de563e8ac36608e197d
SHA256 85d657a903ab6a6b8d226e273ba311b0c58074a7d3b01a0d402dfbf5910c9a43
SHA512 1d9ffffe6ac051b85852190228e687351dd275d1f0e0478826735699992646ee2b6f7bb79c0712ea274e68fe3606c8af14dfd292421c9c2fbbc68b03398fdad3

memory/1884-48-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3104-53-0x0000000000400000-0x000000000044B000-memory.dmp

memory/3732-54-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3732-55-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shell32.dll

MD5 cac6c9c44b7ba77569037004849f4d6d
SHA1 6bdf754cf0bb144e17ffd703663e4c5801598317
SHA256 745528a15bf44f5504e5a1a27a5397e70dd6b1790093928f730a181e74776835
SHA512 a38711de27f0ca7a3f0673f3fdc16e1aa20e7828b7db16041d6307e7c68f3ef78ee3e007754f98a4ff113f99ec1b32ffece6e16a7dfdae3e1a287e009b9fa114

memory/3732-58-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3732-57-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3732-59-0x0000000000400000-0x000000000041A000-memory.dmp