Malware Analysis Report

2024-12-07 11:37

Sample ID 241113-va526sypbm
Target 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe
SHA256 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6d
Tags
discovery persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6d

Threat Level: Shows suspicious behavior

The file 59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence

Deletes itself

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Drops file in System32 directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 16:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 16:48

Reported

2024-11-13 16:50

Platform

win7-20241010-en

Max time kernel

14s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\mscaps.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe N/A
File opened for modification C:\Windows\SysWOW64\mscaps.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wtmps.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mscaps.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2280 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 2280 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 3044 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 3044 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 3044 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 3044 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 1612 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1536 wrote to memory of 1784 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 1784 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2196 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2632 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe

Processes

C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe

"C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 1612

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "

C:\Users\Admin\AppData\Local\Temp\wtmps.exe

"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"

C:\Windows\SysWOW64\mscaps.exe

"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 windowsupdate.microsoft.com udp

Files

memory/2280-0-0x0000000010000000-0x0000000010015000-memory.dmp

\Users\Admin\AppData\Roaming\Temp\mydll.dll

MD5 7ff15a4f092cd4a96055ba69f903e3e9
SHA1 a3d338a38c2b92f95129814973f59446668402a8
SHA256 1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627
SHA512 4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

MD5 15739313180b79c273804a34272c62e6
SHA1 7653fa6237c825e817c9f46db917207b5971824a
SHA256 5cf6b0b41da78b571f716caf1a6ade00622d5023b85cb8c9a400b7d71bd3e602
SHA512 824305999a0b3059d914d479f0701c083daf52027440f40595d7323450ccbaf3a195d45399363ff142f1a562a96e1fb1e834c67503307ca4638008d869487285

C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat

MD5 d1073c9b34d1bbd570928734aacff6a5
SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f

C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

MD5 fb6b21742affc21307818e4c3d1bcfec
SHA1 158898d3e999db397fa5d42e1967dfb287e13566
SHA256 2996c755a0970493cb10d72d2ba86fcf1fdcb925d4c660b869ca6289a4f7e95a
SHA512 18e6d76ef737e6ba7ca32eb589a3850a17a3d7445619ece06ad1dde34b47782a45bc3a70951f5df8c632061951f0418b0b56d7d3df1b39024088f347f437ae0a

C:\Users\Admin\AppData\Roaming\Temp\mydll.dll

MD5 684c111c78f8bf6fcb5575d400e7669c
SHA1 d587894c0beffdff00ae6d358a5463ef18bcb485
SHA256 080fb4cd0b92884c89efab9161685f3ba0666cd9dab8de6c752bfe35e4e45716
SHA512 bcf748d21be502d7346f56ffc9ef13f3394d46c679d7cf17289d007e91b4ead2ec4035b3ccd5626eb378958cbb6ac371edfde8319433db9b709694595ae53e4f

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

MD5 1d67419af666dd26092c3c480a7daf24
SHA1 d689bc74e7b732298e3803ea297d8917294a8dbe
SHA256 4b068dbd5d5f436889d211d7ab67feaec5c72cba721c34ffb71e557afceb264d
SHA512 d2bbdf3dd0c2eaae8b43d02effc2785f5e2ea2d0a676d5a27b9fdacefe13fd4131e51bcd305bc1c6bb04f27e598b6cf1ffae7e732f3bf60cdeca98c207bd50cf

C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

MD5 dd552a153d81fe8c472e9a937a51931a
SHA1 f70764fe4feeafe5825cf1a11ddf46a048165b4e
SHA256 6ebd392227673b24daf54fbfcb267d97a4c324b0a8f57a326315781a52a8225d
SHA512 8c7756da6559d86eec2b89b7c01c49abb14833925b32cee01d2bbcf2036840aa6659a4b98e76fc0688729527288aceb42d41b871ed0a88594524fa410776f467

\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe

MD5 daac1781c9d22f5743ade0cb41feaebf
SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160

memory/1784-266-0x0000000010000000-0x0000000010015000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat

MD5 3ca08f080a7a28416774d80552d4aa08
SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01

C:\Users\Admin\AppData\Local\Temp\wtmps.exe

MD5 75c1467042b38332d1ea0298f29fb592
SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0

C:\Windows\SysWOW64\mscaps.exe

MD5 78d3c8705f8baf7d34e6a6737d1cfa18
SHA1 9f09e248a29311dbeefae9d85937b13da042a010
SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609

C:\Users\Admin\AppData\Local\Temp\3A23.tmp

MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 16:48

Reported

2024-11-13 16:50

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\mscaps.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe N/A
File created C:\Windows\SysWOW64\mscaps.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wtmps.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4320 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 4320 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 4320 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 4320 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 4320 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 4320 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe C:\Windows\SysWOW64\cmd.exe
PID 4152 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 4152 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 4152 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
PID 1412 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe C:\Windows\SysWOW64\cmd.exe
PID 3736 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 3736 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 3736 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
PID 2108 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe C:\Windows\SysWOW64\cmd.exe
PID 3308 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 3308 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 3308 wrote to memory of 2840 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\wtmps.exe
PID 2840 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2840 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe
PID 2840 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\wtmps.exe C:\Windows\SysWOW64\mscaps.exe

Processes

C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe

"C:\Users\Admin\AppData\Local\Temp\59670e0da7ab843887efdd611306c7d6c05f061c4e08bb545ccb3836f7ce1c6dN.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 1412

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "

C:\Users\Admin\AppData\Local\Temp\wtmps.exe

"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"

C:\Windows\SysWOW64\mscaps.exe

"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 windowsupdate.microsoft.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4320-0-0x0000000010000000-0x0000000010015000-memory.dmp

C:\Users\Admin\AppData\Roaming\Temp\mydll.dll

MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

MD5 e2e93857f8ea5ff3130d5779e559bcb5
SHA1 aeeb643eb80aae49caa357f9cf4c4157a339a845
SHA256 f9b0f6d989db651bb433efc0ed90ab758d17c0d738a703a8218cf7e9d3847580
SHA512 d9aeec44b8f464cff0f0b48de58b65385f39cd53daa8b893241e2c3169033cbe75e03650df47f524007e0b61361e20745ced483b832e62248065066f0b4504bd

C:\Users\Admin\AppData\Roaming\Temp\mydll.dll

MD5 e1e47695a0b98432911311352b63eaed
SHA1 836142e550301e0fc13c1a047aae5a2f4481d7cd
SHA256 c67ed34d9254b31e611ee830125c3f2572a1e686f82deb69e1580fb9a4614cd0
SHA512 da49234ee2e1d8f9956ba59d4a49fe04d3ab154f5dd60cf7a6c72e9d42defe8a4b0aeb38845444fe3a8d9c80976467d2101f7c992a48f98f6a9317d0e61ca961

C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

MD5 fb6b21742affc21307818e4c3d1bcfec
SHA1 158898d3e999db397fa5d42e1967dfb287e13566
SHA256 2996c755a0970493cb10d72d2ba86fcf1fdcb925d4c660b869ca6289a4f7e95a
SHA512 18e6d76ef737e6ba7ca32eb589a3850a17a3d7445619ece06ad1dde34b47782a45bc3a70951f5df8c632061951f0418b0b56d7d3df1b39024088f347f437ae0a

C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat

MD5 d1073c9b34d1bbd570928734aacff6a5
SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f

C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe

MD5 3d165846ea6a86c9850c254e0cd012cd
SHA1 cafbf4f01e7a5ed2e1fa0efb4762ae84589cf85a
SHA256 b886c36c06e0712e1d3e72700d47ff43fafe89dd9d41274a9ddf1e0ec808e439
SHA512 63818d2fe265ef79c4f8ea21c786fb94f2879bf4f8ac2285009b3f80fa2290e0f7d24e61bb4a2eab4c775899a0de70b7b714ee62f347796a620cf3d0b2966ac2

C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat

MD5 b3263e14706f0a89ce18bb2cddd794e4
SHA1 794b3b74135923d476c00b42e5a3d0fb2931fca2
SHA256 dee0cfbd6e43cc4093e53c3eb8c0a9ab42e3eab1950622aa2d4eece34a364694
SHA512 d268489ecd1c8422ab3706dd2e8d428ebe79d764ef54c4752c76281de75be5c8c1ad746529ad66536f24a306c12bf57c67484b19151d87e5ffebac07ce136982

C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe

MD5 daac1781c9d22f5743ade0cb41feaebf
SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160

C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat

MD5 3ca08f080a7a28416774d80552d4aa08
SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01

C:\Users\Admin\AppData\Local\Temp\wtmps.exe

MD5 75c1467042b38332d1ea0298f29fb592
SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0

C:\Windows\SysWOW64\mscaps.exe

MD5 78d3c8705f8baf7d34e6a6737d1cfa18
SHA1 9f09e248a29311dbeefae9d85937b13da042a010
SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609

C:\Users\Admin\AppData\Local\Temp\8349.tmp

MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641