Malware Analysis Report

2025-01-03 06:23

Sample ID 241121-3rdm9azmgz
Target ElitecutSetup.exe
SHA256 38ed1513b169db909595c0f37d660ebbeeb87946ad9ada15d1ebb45f7ed4ee06
Tags
asyncrat stealerium stormkitty furry collection discovery persistence privilege_escalation rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38ed1513b169db909595c0f37d660ebbeeb87946ad9ada15d1ebb45f7ed4ee06

Threat Level: Known bad

The file ElitecutSetup.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat stealerium stormkitty furry collection discovery persistence privilege_escalation rat spyware stealer

Asyncrat family

AsyncRat

StormKitty

Stealerium family

Stormkitty family

StormKitty payload

Stealerium

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Looks up geolocation information via web service

Looks up external IP address via web service

Suspicious use of SetThreadContext

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

System Network Configuration Discovery: Wi-Fi Discovery

Browser Information Discovery

outlook_win_path

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-21 23:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-21 23:44

Reported

2024-11-22 00:03

Platform

win10ltsc2021-20241023-en

Max time kernel

678s

Max time network

423s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe"

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Stealerium

stealer stealerium

Stealerium family

stealerium

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A

Stormkitty family

stormkitty

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 916 set thread context of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 1132 set thread context of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 916 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 916 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe
PID 1556 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 1556 wrote to memory of 752 N/A C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe C:\Windows\SysWOW64\cmd.exe
PID 752 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 752 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 752 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3496 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3496 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3496 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 752 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 752 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 752 wrote to memory of 1132 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 1132 wrote to memory of 3844 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Users\Admin\AppData\Roaming\syskprvalor.exe
PID 3844 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Windows\SysWOW64\cmd.exe
PID 3844 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Windows\SysWOW64\cmd.exe
PID 3844 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 5160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2648 wrote to memory of 5160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2648 wrote to memory of 5160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2648 wrote to memory of 5184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2648 wrote to memory of 5184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2648 wrote to memory of 5184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2648 wrote to memory of 5200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2648 wrote to memory of 5200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2648 wrote to memory of 5200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3844 wrote to memory of 5268 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Windows\SysWOW64\cmd.exe
PID 3844 wrote to memory of 5268 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Windows\SysWOW64\cmd.exe
PID 3844 wrote to memory of 5268 N/A C:\Users\Admin\AppData\Roaming\syskprvalor.exe C:\Windows\SysWOW64\cmd.exe
PID 5268 wrote to memory of 5356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 5268 wrote to memory of 5356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 5268 wrote to memory of 5356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 5268 wrote to memory of 5376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5268 wrote to memory of 5376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 5268 wrote to memory of 5376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Roaming\syskprvalor.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe

"C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe"

C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe

"C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe"

C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe

"C:\Users\Admin\AppData\Local\Temp\ElitecutSetup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "syskprvalor" /tr '"C:\Users\Admin\AppData\Roaming\syskprvalor.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp179A.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "syskprvalor" /tr '"C:\Users\Admin\AppData\Roaming\syskprvalor.exe"'

C:\Users\Admin\AppData\Roaming\syskprvalor.exe

"C:\Users\Admin\AppData\Roaming\syskprvalor.exe"

C:\Users\Admin\AppData\Roaming\syskprvalor.exe

"C:\Users\Admin\AppData\Roaming\syskprvalor.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3844 -ip 3844

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 30768

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
DE 193.161.193.99:36700 tcp
US 8.8.8.8:53 83.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 99.193.161.193.in-addr.arpa udp
DE 193.161.193.99:36700 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 30.73.42.20.in-addr.arpa udp
DE 193.161.193.99:36700 tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.185.241:80 icanhazip.com tcp
US 8.8.8.8:53 241.185.16.104.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 api.mylnikov.org udp
US 172.67.196.114:443 api.mylnikov.org tcp
US 8.8.8.8:53 114.196.67.172.in-addr.arpa udp
DE 193.161.193.99:36700 tcp
DE 193.161.193.99:36700 tcp

Files

memory/916-0-0x000000007519E000-0x000000007519F000-memory.dmp

memory/916-1-0x0000000000A90000-0x00000000011CC000-memory.dmp

memory/916-2-0x00000000060C0000-0x0000000006666000-memory.dmp

memory/916-3-0x0000000005BF0000-0x0000000005C82000-memory.dmp

memory/916-4-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

memory/916-5-0x0000000075190000-0x0000000075941000-memory.dmp

memory/916-6-0x0000000005D10000-0x0000000005D86000-memory.dmp

memory/916-7-0x000000007519E000-0x000000007519F000-memory.dmp

memory/916-8-0x0000000075190000-0x0000000075941000-memory.dmp

memory/916-9-0x0000000008170000-0x0000000008878000-memory.dmp

memory/916-10-0x0000000005E40000-0x0000000005E5E000-memory.dmp

memory/1556-11-0x0000000000400000-0x0000000000448000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ElitecutSetup.exe.log

MD5 bd76295661516015cc654d284dc2c276
SHA1 66f835bf0b154292d8ad17212a0feabc5f4f1a18
SHA256 aeef561f6ece2de3d114091d2304534b65152dfee9e195c80876477344422f12
SHA512 0aa544e8684fe8b668623d5668a82abc590938c60fbbfd4959a8e8b1cb16d96858824d170a174b2084569b2756a97ce1b825d588a8a5b3cd4ed040182bcad5fc

memory/916-15-0x0000000075190000-0x0000000075941000-memory.dmp

memory/1556-14-0x0000000075190000-0x0000000075941000-memory.dmp

memory/1556-16-0x0000000075190000-0x0000000075941000-memory.dmp

memory/1556-17-0x0000000075190000-0x0000000075941000-memory.dmp

memory/1556-21-0x0000000075190000-0x0000000075941000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp179A.tmp.bat

MD5 c46823f7f059bb7df3903ffc8080169e
SHA1 230a0767f0ffffc436f6641f4e7a05bba264f240
SHA256 d5b5a72d6f1274c2e1b0a7dda75ca3ca8976ec2c12ef65e04bf242d5aad085bc
SHA512 cc1f6356f1cff9380a912a19a51b267a52318c790c40f98ea2786130d08f89b420dea6709ff8a49e2c4307bd7fd8bdbea0fbc43d7729bbac3eb3f5cd9463ef2e

C:\Users\Admin\AppData\Roaming\syskprvalor.exe

MD5 9b7d706bac6f21d08f43b62f993933a5
SHA1 b6794baa320f187d239d40e949f5aaf8aeff6c62
SHA256 38ed1513b169db909595c0f37d660ebbeeb87946ad9ada15d1ebb45f7ed4ee06
SHA512 f61ce99033e2e5af55d1aa425fcf69a4a4009220411d2320733430b717d2a60fd59f4df1205d4ff0b15e3f65302835a592559789bcdbbb6aaf933f28f8920bf8

memory/3844-30-0x0000000005D60000-0x0000000005DFC000-memory.dmp

memory/3844-31-0x0000000005E70000-0x0000000005ED6000-memory.dmp

memory/3844-32-0x0000000006D20000-0x0000000006D54000-memory.dmp

memory/3844-33-0x0000000000010000-0x0000000000198000-memory.dmp

memory/3844-38-0x0000000000220000-0x000000000022A000-memory.dmp

C:\Users\Admin\AppData\Local\3072856a832695e8e81b8e0465c8f07e\Admin@CCSIZKYM_en-US\System\Process.txt

MD5 c8e4daa5c43ff2d61232acde49cac3de
SHA1 c3d6a29b3fdea242360c0adb2f70cf0bb0de0d03
SHA256 f6e827e0189dd718f3c5c1693bf760cb88e861da08782bb59faf8a119a44d7f3
SHA512 c17ead7474dd9b4504b05a5ecd08b352a4755fed334ca1dd54ecfafaa3f8f10015ca1588bba1c7f9bb528f524b155ad5eb29ae08aa0f6a245fe2a81f9c43852c

C:\Users\Admin\AppData\Local\3072856a832695e8e81b8e0465c8f07e\Admin@CCSIZKYM_en-US\System\Process.txt

MD5 e28f34dc5011bbdc569cd1452fa10027
SHA1 a394042c5adde259248f57b6b7edc1429b2bfdd8
SHA256 5893d5031fbeb19fb9fe8745bb1a08c359226740af74d2325d5cb28932cbaa8a
SHA512 1d19cb5d9049446330c8732c3b475c45209c8a680d868713f12c959498c6cfcae4b11756f6ac4046852768d7290d0750bde1b79ccd251abdce8fe6c7ae2f4301

memory/3844-157-0x0000000000310000-0x000000000038A000-memory.dmp

C:\Users\Admin\AppData\Local\3072856a832695e8e81b8e0465c8f07e\Admin@CCSIZKYM_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

memory/3844-192-0x0000000006980000-0x00000000069A4000-memory.dmp

memory/3844-193-0x00000000060A0000-0x00000000061C2000-memory.dmp

memory/3844-194-0x00000000069A0000-0x00000000069C2000-memory.dmp

memory/3844-195-0x00000000081F0000-0x0000000008547000-memory.dmp

memory/3844-196-0x0000000006B70000-0x0000000006BBC000-memory.dmp