Malware Analysis Report

2025-04-03 09:54

Sample ID 250212-jfydqsslhs
Target 20b11d44b4ee8320455e755b40f263aa548750ed7c02e1a6f03337f61e25b2a8
SHA256 20b11d44b4ee8320455e755b40f263aa548750ed7c02e1a6f03337f61e25b2a8
Tags
netwire botnet discovery persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

20b11d44b4ee8320455e755b40f263aa548750ed7c02e1a6f03337f61e25b2a8

Threat Level: Known bad

The file 20b11d44b4ee8320455e755b40f263aa548750ed7c02e1a6f03337f61e25b2a8 was found to be: Known bad.

Malicious Activity Summary

netwire botnet discovery persistence rat stealer

NetWire RAT payload

Netwire

Netwire family

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

System Network Configuration Discovery: Internet Connection Discovery

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-12 07:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-12 07:37

Reported

2025-02-12 07:40

Platform

win7-20241010-en

Max time kernel

149s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "0\\58611747\\xpubvb.pif 0\\58611747\\kloujxqped.qbu" C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1072 set thread context of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 2772 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 2772 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 2772 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 1072 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"

C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif

"C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif" kloujxqped.qbu

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
ZA 154.16.93.177:3365 tcp
ZA 154.16.93.177:3368 tcp

Files

\Users\Admin\AppData\Roaming\58611747\xpubvb.pif

MD5 503fbeaa015418e1a57880f8a0306d43
SHA1 bd05b27424688e8d8aad7f99ea0d6aa1efbbe8a0
SHA256 ad6a04f8a27507d42f7aa6a668d4892352142be6701ea83b2e0d49d222b586f9
SHA512 17367cdcf5db8d9ca23d8b20a02bcc9e4880a2d62cf1be13eed2b7ccb8848acd50c194f2b864e655dde9ff1e9e9e14412b04d40ce4749bd2e68fdaba9bd29900

C:\Users\Admin\AppData\Roaming\58611747\gdxsrokugw.dat

MD5 230c2d288a744d390651d58f1529aeb4
SHA1 84f313ca96b69d48830addde6c418c920afe37ae
SHA256 0dcdefb5b57b6ba3f131a098fe10a399def1572b89814057ee02fda388d31a63
SHA512 7da63281a064421236841431c2884b23831bcf22eb025ce3aad1798476a04b3c957badb242f007b7f625272923fb66e527164db98522c8c3fa1c71ed4fd58ac5

\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215

memory/2660-79-0x0000000000350000-0x0000000000A54000-memory.dmp

memory/2660-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2660-84-0x0000000000350000-0x0000000000A54000-memory.dmp

memory/2660-82-0x0000000000350000-0x0000000000A54000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-12 07:37

Reported

2025-02-12 07:39

Platform

win10v2004-20250211-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "0\\58611747\\xpubvb.pif 0\\58611747\\kloujxqped.qbu" C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "0\\58611747\\xpubvb.pif 0\\58611747\\kloujxqped.qbu" C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4016 set thread context of 4068 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3908 set thread context of 4056 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1396 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 1396 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 1396 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 4016 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 4016 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 4016 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 4016 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 4016 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 4016 wrote to memory of 724 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Windows\SysWOW64\WScript.exe
PID 4016 wrote to memory of 724 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Windows\SysWOW64\WScript.exe
PID 4016 wrote to memory of 724 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Windows\SysWOW64\WScript.exe
PID 724 wrote to memory of 3908 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 724 wrote to memory of 3908 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 724 wrote to memory of 3908 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif
PID 3908 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3908 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3908 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3908 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3908 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"

C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif

"C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif" kloujxqped.qbu

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4068 -ip 4068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 352

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\58611747\run.vbs"

C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif

"C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif" kloujxqped.qbu

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTM3NEY5NEEtMERGMS00RDQ3LThCMzctMDUyNzM1MUYwQzZDfSIgdXNlcmlkPSJ7QjNENjNBNTgtMDE3MC00NUUwLUE5NUYtQ0E1NTIzQkQ1RjE1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzVBMjY3QUItRDc5MC00MkI0LTkzMTMtNDMwNDU2ODM4OUVFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTA4OTc5MjcwIi8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
ZA 154.16.93.177:3365 tcp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 4.155.164.36:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
ZA 154.16.93.177:3368 tcp

Files

C:\Users\Admin\AppData\Roaming\58611747\xpubvb.pif

MD5 503fbeaa015418e1a57880f8a0306d43
SHA1 bd05b27424688e8d8aad7f99ea0d6aa1efbbe8a0
SHA256 ad6a04f8a27507d42f7aa6a668d4892352142be6701ea83b2e0d49d222b586f9
SHA512 17367cdcf5db8d9ca23d8b20a02bcc9e4880a2d62cf1be13eed2b7ccb8848acd50c194f2b864e655dde9ff1e9e9e14412b04d40ce4749bd2e68fdaba9bd29900

C:\Users\Admin\AppData\Roaming\58611747\gdxsrokugw.dat

MD5 230c2d288a744d390651d58f1529aeb4
SHA1 84f313ca96b69d48830addde6c418c920afe37ae
SHA256 0dcdefb5b57b6ba3f131a098fe10a399def1572b89814057ee02fda388d31a63
SHA512 7da63281a064421236841431c2884b23831bcf22eb025ce3aad1798476a04b3c957badb242f007b7f625272923fb66e527164db98522c8c3fa1c71ed4fd58ac5

memory/4068-68-0x0000000000500000-0x0000000000B5F000-memory.dmp

memory/4068-73-0x0000000000500000-0x0000000000B5F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

memory/4068-74-0x0000000000500000-0x0000000000B5F000-memory.dmp

C:\Users\Admin\AppData\Roaming\58611747\run.vbs

MD5 17b24378d4f465c4f0a391d271f07e37
SHA1 bf0ea823c6706ca157c4ad7f1085df582d45bdc4
SHA256 bc68be606e8fcfc982130fdc680e5e08a82ce39ad320994d1ee0c6fdada3e101
SHA512 7b7231c6fa5eaba42301397303e9b6a280e5de46bec011cfd60056a5d163e0af6d1128428899471386b3ff9e9e92b1af0e5591e285a4325981c04bb0481f31fc

memory/4056-82-0x0000000000700000-0x0000000000D16000-memory.dmp

memory/4056-84-0x0000000000700000-0x0000000000D16000-memory.dmp