Malware Analysis Report

2025-04-03 09:54

Sample ID 250212-nvm9jazlhx
Target 873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
SHA256 873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9
Tags
rat netwire warzonerat botnet discovery infostealer stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9

Threat Level: Known bad

The file 873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe was found to be: Known bad.

Malicious Activity Summary

rat netwire warzonerat botnet discovery infostealer stealer

NetWire RAT payload

Netwire family

Warzonerat family

WarzoneRat, AveMaria

Netwire

Warzone RAT payload

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Suspicious use of SetThreadContext

AutoIT Executable

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-12 11:43

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Netwire family

netwire

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-12 11:43

Reported

2025-02-12 11:45

Platform

win7-20240903-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzonerat family

warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Blasthost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2684 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2684 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2684 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2804 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2804 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2804 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2804 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2684 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2684 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2684 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2684 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2684 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2684 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 1012 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 1012 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 1012 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 1012 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 2684 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 2684 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 2684 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 1012 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 1012 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 1612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1148 wrote to memory of 1612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1148 wrote to memory of 1612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1148 wrote to memory of 1612 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1612 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1612 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1612 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1612 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1612 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 1612 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 1612 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 1612 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 2072 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 2072 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 2072 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 2072 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 2072 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 2072 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 1284 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1148 wrote to memory of 1284 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1148 wrote to memory of 1284 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1148 wrote to memory of 1284 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1284 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1284 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1284 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1284 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 1284 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1284 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1284 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1284 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1284 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1284 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 1364 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 1364 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe

"C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe"

C:\Users\Admin\AppData\Roaming\Blasthost.exe

"C:\Users\Admin\AppData\Roaming\Blasthost.exe"

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"

C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe

"C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F

C:\Windows\system32\taskeng.exe

taskeng.exe {F5ED48FA-4439-4F50-8B82-118436836EAF} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\Blasthost.exe

"C:\Users\Admin\AppData\Roaming\Blasthost.exe"

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\Blasthost.exe

"C:\Users\Admin\AppData\Roaming\Blasthost.exe"

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp

Files

memory/2684-0-0x0000000000850000-0x00000000009BB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Blasthost.exe

MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

memory/2804-24-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2684-26-0x0000000000370000-0x0000000000371000-memory.dmp

memory/2684-27-0x0000000003480000-0x00000000035EB000-memory.dmp

memory/1012-28-0x0000000000080000-0x000000000009D000-memory.dmp

memory/1012-30-0x0000000000080000-0x000000000009D000-memory.dmp

memory/1012-37-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1012-40-0x0000000000080000-0x000000000009D000-memory.dmp

memory/2684-42-0x0000000000850000-0x00000000009BB000-memory.dmp

memory/2592-43-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2592-45-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2736-48-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

MD5 fb65da031dcc638909ed82e993b72d12
SHA1 40a299f409c4da7cee54efc577d2d9c4c018fd2b
SHA256 2d782fe2e5e5ae1742dfbe2a2fd8603b882d7b9a14486cd6ead1510f4d8e57fc
SHA512 12123ad22319239de943623facebb0bf85f3de479c697a346c5f11fa1b245331b054868c1fb8dbdc59d735f74b7a69782f4878c838e9eb2362e48a41cee09c30

memory/1612-54-0x0000000001060000-0x00000000011CB000-memory.dmp

memory/2072-79-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1612-83-0x0000000001060000-0x00000000011CB000-memory.dmp

memory/3068-86-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2816-91-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2736-92-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1284-118-0x0000000001060000-0x00000000011CB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-12 11:43

Reported

2025-02-12 11:45

Platform

win10v2004-20250211-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzonerat family

warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Blasthost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2384 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2384 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2384 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2500 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2500 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2500 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Roaming\Blasthost.exe C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
PID 2384 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2384 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2384 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2384 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 2384 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe
PID 4632 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 4632 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 4632 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 2384 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 2384 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 2384 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\schtasks.exe
PID 4632 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 4632 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe C:\Windows\SysWOW64\cmd.exe
PID 2004 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2004 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2004 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 2004 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 2004 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 2004 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 2004 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 2004 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 5064 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 5064 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 5064 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 2004 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 2004 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 2004 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 5064 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 5064 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 672 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 672 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 672 wrote to memory of 3260 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\Blasthost.exe
PID 672 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 672 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 672 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 672 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 672 wrote to memory of 312 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
PID 312 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 672 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 672 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 672 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\schtasks.exe
PID 312 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe

"C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe"

C:\Users\Admin\AppData\Roaming\Blasthost.exe

"C:\Users\Admin\AppData\Roaming\Blasthost.exe"

C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe

"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"

C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe

"C:\Users\Admin\AppData\Local\Temp\873f42162bb9bcf9f4737cdde0f6237f79e2dd37dcf0440344b735481c3b54c9.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\Blasthost.exe

"C:\Users\Admin\AppData\Roaming\Blasthost.exe"

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEMxNzA4MTctQzEyNy00NzE2LThCREMtRkQwQzc3NUM4MjdFfSIgdXNlcmlkPSJ7REZBOEI2OUYtOTc1QS00Rjg1LTgxRUUtMDExNUMzNUM1NkM4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MkE3MzlENzUtNzBEQS00MTk0LTlBMkMtQ0I4QTY5QzUzRUFFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzQyNTIxMzc5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

C:\Users\Admin\AppData\Roaming\Blasthost.exe

"C:\Users\Admin\AppData\Roaming\Blasthost.exe"

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 172.169.87.222:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
IT 91.80.49.85:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 wealthyme.ddns.net udp
US 8.8.8.8:53 wealth.warzonedns.com udp
US 8.8.8.8:53 Wealthy2019.com.strangled.net udp

Files

memory/2384-0-0x00000000002E0000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Blasthost.exe

MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

memory/2500-12-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2384-14-0x0000000003C00000-0x0000000003C01000-memory.dmp

memory/4632-15-0x0000000000F70000-0x0000000000F8D000-memory.dmp

memory/4632-23-0x0000000000F70000-0x0000000000F8D000-memory.dmp

memory/2384-25-0x00000000002E0000-0x000000000044B000-memory.dmp

memory/4544-26-0x0000000000F10000-0x0000000000F11000-memory.dmp

memory/1780-28-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1780-29-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

MD5 402d2d72bc873817bf2be6370c37d06a
SHA1 277324b30f63ac2944aa76ded79168546e64690c
SHA256 85275a70e964c7eabebaf8982e36d7de86ca1ddf885554d195b755120facda5b
SHA512 c4cef434a5ceeb47c52ff81319e8c2dd0efbd841f4d3f444811063299ece2437bbe50f581abe41c5c317c08e4e19238497d3ef88d04a99f4daa893b1db4cda3c

memory/2004-33-0x0000000000440000-0x00000000005AB000-memory.dmp

memory/5064-42-0x0000000000400000-0x000000000041D000-memory.dmp

memory/5064-50-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2004-51-0x0000000000440000-0x00000000005AB000-memory.dmp

memory/1944-52-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

memory/4644-57-0x0000000000400000-0x000000000042C000-memory.dmp

memory/4644-63-0x0000000000400000-0x000000000042C000-memory.dmp

memory/672-78-0x0000000000440000-0x00000000005AB000-memory.dmp

memory/3244-80-0x00000000009B0000-0x00000000009B1000-memory.dmp

memory/3260-84-0x0000000000400000-0x000000000042C000-memory.dmp

memory/3260-87-0x0000000000400000-0x000000000042C000-memory.dmp