Malware Analysis Report

2025-04-03 09:31

Sample ID 250304-2k73vatjz2
Target quarantine.7z
SHA256 bfe4b4df28361cf5ef899f834fefed90d282995621018ac8215c04ca2cfe571f
Tags
svcstealer downloader persistence stealer discovery spyware defense_evasion systembc trojan xworm rat amadey redline vidar 092155 a4d2cd ir7am testproliv infostealer pyinstaller stealc trump credential_access
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bfe4b4df28361cf5ef899f834fefed90d282995621018ac8215c04ca2cfe571f

Threat Level: Known bad

The file quarantine.7z was found to be: Known bad.

Malicious Activity Summary

svcstealer downloader persistence stealer discovery spyware defense_evasion systembc trojan xworm rat amadey redline vidar 092155 a4d2cd ir7am testproliv infostealer pyinstaller stealc trump credential_access

Redline family

Detect Vidar Stealer

Systembc family

SystemBC

RedLine

Vidar

Xworm family

Amadey family

Xworm

Vidar family

Amadey

RedLine payload

Svcstealer family

Stealc family

SvcStealer, Diamotrix

Detect Xworm Payload

Detects SvcStealer Payload

Stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Uses browser remote debugging

Drops startup file

Unsecured Credentials: Credentials In Files

Checks computer location settings

Reads data files stored by FTP clients

Checks BIOS information in registry

Identifies Wine through registry keys

.NET Reactor proctector

Reads user/profile data of local email clients

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Detects Pyinstaller

Program crash

Browser Information Discovery

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious behavior: MapViewOfSection

Scheduled Task/Job: Scheduled Task

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-04 22:39

Signatures

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A

Svcstealer family

svcstealer

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

136s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SvcStealer, Diamotrix

stealer downloader svcstealer

Svcstealer family

svcstealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ddcedbbabcc = "\"C:\\ProgramData\\ddcedbbabcc.exe\"" C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3932 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
GB 2.18.66.43:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/3932-0-0x00007FF6FB960000-0x00007FF6FB9FF000-memory.dmp

memory/3420-1-0x0000000002810000-0x00000000028B5000-memory.dmp

memory/3420-5-0x0000000002810000-0x00000000028B5000-memory.dmp

memory/3932-6-0x00007FF6FB960000-0x00007FF6FB9FF000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drunkeflavorz.pw udp
US 8.8.8.8:53 explorebieology.run udp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 104.21.31.208:443 explorebieology.run tcp

Files

memory/3148-1-0x00000000015F0000-0x00000000016F0000-memory.dmp

memory/3148-2-0x0000000003160000-0x00000000031C5000-memory.dmp

memory/3148-7-0x00000000015F0000-0x00000000016F0000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20250207-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Browser Information Discovery

discovery

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\random_2.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\random_2.exe

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 1196

Network

Country Destination Domain Proto
US 8.8.8.8:53 circujitstorm.bet udp
US 172.67.170.109:443 circujitstorm.bet tcp

Files

memory/1468-0-0x0000000001240000-0x0000000001552000-memory.dmp

memory/1468-1-0x0000000077A10000-0x0000000077A12000-memory.dmp

memory/1468-2-0x0000000001241000-0x00000000012A1000-memory.dmp

memory/1468-3-0x0000000001240000-0x0000000001552000-memory.dmp

memory/1468-4-0x0000000001240000-0x0000000001552000-memory.dmp

memory/1468-5-0x0000000001240000-0x0000000001552000-memory.dmp

memory/1468-8-0x0000000001241000-0x00000000012A1000-memory.dmp

memory/1468-7-0x0000000001240000-0x0000000001552000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240729-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\eitb\xlxog.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\eitb\xlxog.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\eitb\xlxog.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\eitb\xlxog.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\ProgramData\eitb\xlxog.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\eitb\xlxog.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\eitb\xlxog.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\eitb\xlxog.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2576 wrote to memory of 2544 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eitb\xlxog.exe
PID 2576 wrote to memory of 2544 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eitb\xlxog.exe
PID 2576 wrote to memory of 2544 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eitb\xlxog.exe
PID 2576 wrote to memory of 2544 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\eitb\xlxog.exe

Processes

C:\Users\Admin\AppData\Local\Temp\reloadrive.exe

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {164066C5-2D62-49C0-B4ED-F61FBB5A6E6D} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]

C:\ProgramData\eitb\xlxog.exe

C:\ProgramData\eitb\xlxog.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4652 towerbingobongoboom.com tcp

Files

memory/2636-0-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-1-0x0000000077200000-0x0000000077202000-memory.dmp

memory/2636-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/2636-4-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-6-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-7-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-8-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-9-0x0000000000400000-0x0000000000823000-memory.dmp

C:\ProgramData\eitb\xlxog.exe

MD5 8c767708c9a9554c0afb504629e75ffd
SHA1 c65394806c0f77af880c7ff8a021bd4222ca3f11
SHA256 dcb373f73cc5e29881b6c97f753da1db91becee01b5eade03b0fd217d10b4e7d
SHA512 f9531159b45f92db319f351ebf4dadf9ba3c413e87da401a0af81d25a446084ed30dee670462292b989e1c9b0074a3c2ae76bb8a1d992e4407f72360303b4e16

memory/2544-12-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-13-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 390df1e87abbed5a4c71643f44496a7b
SHA1 a8c5c3c09d2a255458128aced73eb0d717bd77ea
SHA256 98525b60d4111ab47a1366af0b0ee808fcaa8df5d45c60ac68cab3e9809bf6cd
SHA512 0ae2981875314322d9ed7487c8f519c699e78a2ebf1be75c97dc0211c8484a75502f19e15ce12e52dc2f83501f7b5abc0c893049cbe0368f9e9ea63fb48cbe52

memory/2544-15-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-16-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-17-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-18-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-19-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-20-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-21-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-22-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-23-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-24-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-25-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-26-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-27-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2636-28-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-29-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-31-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-32-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-33-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-34-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-35-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-36-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-37-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-38-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2544-39-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral22

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

78s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2428 set thread context of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

Browser Information Discovery

discovery

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2428 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

Processes

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2428 -ip 2428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 808

Network

Country Destination Domain Proto
US 8.8.8.8:53 earthsymphzony.today udp
US 104.21.80.1:443 earthsymphzony.today tcp
US 104.21.80.1:443 earthsymphzony.today tcp
US 104.21.80.1:443 earthsymphzony.today tcp
US 104.21.80.1:443 earthsymphzony.today tcp
US 104.21.80.1:443 earthsymphzony.today tcp
US 104.21.80.1:443 earthsymphzony.today tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/2428-0-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

memory/2428-1-0x0000000000C20000-0x0000000000C90000-memory.dmp

memory/2428-2-0x0000000005B80000-0x0000000006124000-memory.dmp

memory/2472-4-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2472-6-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2428-7-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/2472-8-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2472-9-0x0000000000400000-0x0000000000465000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240729-en

Max time kernel

117s

Max time network

118s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SvcStealer, Diamotrix

stealer downloader svcstealer

Svcstealer family

svcstealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcccbdfcfcbdedc = "\"C:\\ProgramData\\bcccbdfcfcbdedc.exe\"" C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1892 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\4klgwMz.exe"

Network

N/A

Files

memory/1892-0-0x000000013FC80000-0x000000013FD1F000-memory.dmp

memory/1252-1-0x0000000005610000-0x00000000056B5000-memory.dmp

memory/1252-7-0x0000000005610000-0x00000000056B5000-memory.dmp

memory/1892-6-0x000000013FC80000-0x000000013FD1F000-memory.dmp

memory/1252-2-0x0000000005610000-0x00000000056B5000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240903-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\8jQumY5.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 856

Network

Country Destination Domain Proto
US 8.8.8.8:53 drunkeflavorz.pw udp
US 8.8.8.8:53 explorebieology.run udp
US 104.21.31.208:443 explorebieology.run tcp

Files

memory/1776-1-0x00000000002A0000-0x0000000000305000-memory.dmp

memory/1776-6-0x0000000000550000-0x0000000000650000-memory.dmp

memory/1776-7-0x0000000000550000-0x0000000000650000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:49185 tcp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d = "C:\\Users\\Admin\\AppData\\Roaming\\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe" C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3176 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 4028 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 4028 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 4028 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 636 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 5116 wrote to memory of 3176 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 3608 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3176 -ip 3176

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 812

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d" /tr "C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 636 -ip 636

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 800

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5116 -ip 5116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 732

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3608 -ip 3608

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 780

Network

Country Destination Domain Proto
US 8.8.8.8:53 appengine.google.com udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp

Files

memory/3176-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

memory/3176-1-0x0000000000CA0000-0x0000000000CEE000-memory.dmp

memory/3176-2-0x0000000005C70000-0x0000000006214000-memory.dmp

memory/3176-3-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/3176-4-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/4028-6-0x0000000000400000-0x0000000000436000-memory.dmp

memory/3176-7-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/4028-9-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/4028-8-0x0000000005900000-0x000000000599C000-memory.dmp

memory/4028-10-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/4028-14-0x0000000074D70000-0x0000000075520000-memory.dmp

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

MD5 d1458dc39b290683cefbb01cc5b0991a
SHA1 e9749971be9d943cb2a62e2be5eb442161876ec6
SHA256 dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d
SHA512 f90bc037576ee1205fa260d5b6b05c95f930025bc40f541b92f39b845b8e9a90a59ec18ef0be1ab5cf7bb74ed6a6222fc1a882df894ba8e1e722d671aef37e35

memory/636-17-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/636-18-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/636-19-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/636-21-0x0000000074D70000-0x0000000075520000-memory.dmp

memory/636-24-0x0000000074D70000-0x0000000075520000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe.log

MD5 5e94b238b014b2475a606db72c39b60f
SHA1 a6a2b64884f1a2bb82c0ee7fe0682f9c2c619ed9
SHA256 15f497aea89068cc4068fc495ecc93a4e5b6325423d6bf576cb73cae7ff86e48
SHA512 f57b4921101ee4c473af007d9eaf502c38681b3249bd8765156a741788b3b672687c0f06b31029aa09e6a8f3159666de6ed5e221fa5188ca7d5ca1c05e992896

Analysis: behavioral18

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects SvcStealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Redline family

redline

SvcStealer, Diamotrix

stealer downloader svcstealer

Svcstealer family

svcstealer

SystemBC

trojan systembc

Systembc family

systembc

Vidar

stealer vidar

Vidar family

vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\cwsrddn\jarlgwi.exe N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\cwsrddn\jarlgwi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\cwsrddn\jarlgwi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10087020101\OEHBOHk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe N/A
N/A N/A C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe N/A
N/A N/A C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\ProgramData\cwsrddn\jarlgwi.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\ProgramData\cwsrddn\jarlgwi.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbddfcedddebbbaec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\10089420101\\4klgwMz.exe\"" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbddfcedddebbbaec = "\"C:\\ProgramData\\bbddfcedddebbbaec.exe\"" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbddfcedddebbbaec = "\"C:\\ProgramData\\bbddfcedddebbbaec.exe\"" C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\cwsrddn\jarlgwi.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe N/A
N/A N/A C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1388 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe
PID 1388 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe
PID 1388 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\random_2.exe C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe
PID 2400 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2400 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2400 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 3216 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10087020101\OEHBOHk.exe
PID 3216 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10087020101\OEHBOHk.exe
PID 3216 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe
PID 3216 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe
PID 4600 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe C:\Windows\Explorer.EXE
PID 3216 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
PID 3216 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
PID 3216 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
PID 3216 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 3216 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 3216 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 1292 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe
PID 3216 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
PID 3216 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
PID 3216 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
PID 1800 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1800 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1800 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 3760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 3760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 3760 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 3216 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
PID 3216 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
PID 3216 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
PID 3216 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe
PID 3216 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe
PID 3216 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe
PID 3216 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe
PID 3216 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe
PID 4848 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe
PID 4848 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe
PID 4848 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe
PID 5116 wrote to memory of 4280 N/A C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe
PID 5116 wrote to memory of 4280 N/A C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe
PID 5116 wrote to memory of 4280 N/A C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe
PID 4280 wrote to memory of 1096 N/A C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
PID 4280 wrote to memory of 1096 N/A C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
PID 4280 wrote to memory of 1096 N/A C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe
PID 1096 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 1096 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 3216 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe
PID 3216 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe
PID 3216 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe
PID 1096 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe C:\Windows\SysWOW64\cmd.exe
PID 3216 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe
PID 3216 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe
PID 3216 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe
PID 3216 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe
PID 3216 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\random_2.exe

"C:\Users\Admin\AppData\Local\Temp\random_2.exe"

C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe

"C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Users\Admin\AppData\Local\Temp\10087020101\OEHBOHk.exe

"C:\Users\Admin\AppData\Local\Temp\10087020101\OEHBOHk.exe"

C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe

"C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe"

C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe"

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1292 -ip 1292

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 788

C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

"C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe"

C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe"

C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe

"C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe"

C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe

"C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe"

C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe

"C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728

C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe

C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5116 -ip 5116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 744

C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe

C:\Users\Admin\AppData\Roaming\streamfirefox\WiseTurbo.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5116 -ip 5116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 652

C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe

"C:\Users\Admin\AppData\Local\Temp\10095340101\8jQumY5.exe"

C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe

"C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe"

C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1360 -ip 1360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 788

C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe

"C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe"

C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe

C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\ProgramData\cwsrddn\jarlgwi.exe

C:\ProgramData\cwsrddn\jarlgwi.exe

C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe

C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe

C:\Users\Admin\AppData\Local\Temp\temp_19551.exe

"C:\Users\Admin\AppData\Local\Temp\temp_19551.exe"

C:\Users\Admin\AppData\Local\Temp\temp_19551.exe

"C:\Users\Admin\AppData\Local\Temp\temp_19551.exe"

C:\Users\Admin\AppData\Local\Temp\temp_19604.exe

"C:\Users\Admin\AppData\Local\Temp\temp_19604.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 circujitstorm.bet udp
US 104.21.28.84:443 circujitstorm.bet tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 104.21.28.84:443 circujitstorm.bet tcp
US 104.21.28.84:443 circujitstorm.bet tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 104.21.28.84:443 circujitstorm.bet tcp
US 104.21.28.84:443 circujitstorm.bet tcp
US 104.21.28.84:443 circujitstorm.bet tcp
US 104.21.28.84:443 circujitstorm.bet tcp
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.6:80 176.113.115.6 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:60341 tcp
US 8.8.8.8:53 earthsymphzony.today udp
US 104.21.32.1:443 earthsymphzony.today tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
US 8.8.8.8:53 drunkeflavorz.pw udp
US 8.8.8.8:53 explorebieology.run udp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
FI 135.181.76.95:80 135.181.76.95 tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
US 104.21.32.1:443 earthsymphzony.today tcp
RU 176.113.115.7:80 176.113.115.7 tcp
DE 5.75.210.149:443 tcp
US 8.8.8.8:53 drunkeflavorz.pw udp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
US 104.21.31.208:443 explorebieology.run tcp
RU 185.81.68.156:80 185.81.68.156 tcp
FR 45.155.103.183:1488 tcp
US 8.8.8.8:53 joyfulhezart.tech udp
US 8.8.8.8:53 hardswarehub.today udp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 hardrwarehaven.run udp
US 8.8.8.8:53 techmindzs.live udp
US 8.8.8.8:53 codxefusion.top udp
US 172.67.212.102:443 codxefusion.top tcp
US 104.21.31.208:443 explorebieology.run tcp
RU 185.81.68.156:80 185.81.68.156 tcp
US 172.67.212.102:443 codxefusion.top tcp
US 172.67.212.102:443 codxefusion.top tcp
US 104.21.31.208:443 explorebieology.run tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 su.t.goldenloafuae.com udp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 104.86.110.232:80 e5.o.lencr.org tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp

Files

memory/1388-0-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-1-0x0000000077354000-0x0000000077356000-memory.dmp

memory/1388-2-0x0000000000A71000-0x0000000000AD1000-memory.dmp

memory/1388-3-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-4-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-5-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-6-0x0000000000A71000-0x0000000000AD1000-memory.dmp

memory/1388-7-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-9-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-8-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-10-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-11-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-12-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/1388-13-0x0000000000A70000-0x0000000000D82000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ADKX9KSZ9Z3406FCROM3NT8FV.exe

MD5 a02d35ec85cbb4c53c1e3ce513edf3e3
SHA1 42a357048694c44f1dec312f1866effabb515ea3
SHA256 6f6dad758b64241539cc5b87abe7dbc4df651900f6bfc618527fa76596985b78
SHA512 d1664b37136453257e36c7fee9b5b336f1c0c7b04c196b09482e43b9814e3d2598e9217b814b8035ef8e72204c9179d4481ee647998201aa480f40b26945abc4

memory/1388-17-0x0000000000A70000-0x0000000000D82000-memory.dmp

memory/2400-19-0x0000000000550000-0x0000000000A10000-memory.dmp

memory/2400-21-0x0000000000551000-0x000000000057F000-memory.dmp

memory/2400-22-0x0000000000550000-0x0000000000A10000-memory.dmp

memory/2400-24-0x0000000000550000-0x0000000000A10000-memory.dmp

memory/3216-37-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/2400-36-0x0000000000550000-0x0000000000A10000-memory.dmp

memory/3216-38-0x00000000005F1000-0x000000000061F000-memory.dmp

memory/3216-39-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3216-40-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3216-41-0x00000000005F0000-0x0000000000AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10087020101\OEHBOHk.exe

MD5 3babce4f85902c7bcfde22e222508c4e
SHA1 4898ae5c075322b47ab2f512b5463ee6116d98f7
SHA256 06b678b55cb81e6999b25903def2ac02336dc6c9ff3cd6afdaafffd55e2e5302
SHA512 f8687729c8931579f8120f6451f669726f115123c10a7c5ce6d9a24746940153efcf7e33b719e8f543f9b4316db485633272943f462bf948b4044f234795d629

memory/3216-59-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3216-60-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3216-61-0x00000000005F0000-0x0000000000AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe

MD5 19668940080169c70b830bed8c390783
SHA1 5e6b72e52abc7d221d512111e39cbdd3f2ad40c1
SHA256 cdbc641b8c23b5699f899b408394ecfc946af9ac7a38c5d44c78a4a938e7b02c
SHA512 c322eba01ff4544b8077ec400f15ecffd3b66f89e0e0e26946224771c1ffb9c687ff4adc2e0a5e6b119766b3c8300971cfc2c990ff48346d9d3d514ab5d4bed2

memory/4600-76-0x00007FF633FD0000-0x00007FF63406F000-memory.dmp

memory/3444-78-0x0000000002700000-0x00000000027A5000-memory.dmp

memory/4600-81-0x00007FF633FD0000-0x00007FF63406F000-memory.dmp

memory/3444-77-0x0000000002700000-0x00000000027A5000-memory.dmp

memory/3216-82-0x00000000005F0000-0x0000000000AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe

MD5 e82c4c3f7a2994eeecc1f81a5e4a4180
SHA1 660820f778073332dcd5ec446d2fcf00de887abd
SHA256 11eec5d71c7fadae9d7176448d8fff3de44ec8d3b4df86f0eca59e06adf202d3
SHA512 4d3e42e68b9fa6330edfee677ad55ae24964c33d6fd2d25ba6c2876d80f8d9cbc999c6e27192ce58a45559d00b3c0bc71ddbee1ad8d6fd7083b705ef5cf84d76

C:\Users\Admin\AppData\Local\Temp\10089790101\wBalaPT.exe

MD5 3f84f670f0e10ad43bcb6df7c25cdc1a
SHA1 0e04beff1beec91fa9408c0b1e28da8283c9c70e
SHA256 787490502d51da937007d81c84ae8929ab20e5516f0fa36dec97b30b5f154351
SHA512 4cbcc517ec10f0e40f88da1e43cd2d776bc4bc493d355b6186e03f07343319386496e57d56bcfa775fc9b8ce0586260dfb0a900c47b3c77d9202909a71835d40

memory/1292-117-0x0000000000D20000-0x0000000000D90000-memory.dmp

memory/1292-118-0x0000000005AF0000-0x0000000006094000-memory.dmp

memory/2016-121-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2436-124-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/2016-123-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2436-126-0x00000000005F0000-0x0000000000AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe

MD5 a308ca3417da9a5fd27823d205e2944a
SHA1 a623c58df6d2f75b3ffda3268cc6ed7ef48ce070
SHA256 973bb90580ab417bea0568823bb7852eeed34f6d83461f3de275fcda727c73ee
SHA512 4a9e58b99bf736a20f4b7f7a740546c2e2a4c46ab9bfd44b15a76b75f14a90a0ba4eca0302a4b0006086e035b4e739bec9da98d9ff416880dcc4f44aa8e3f7f2

memory/1800-141-0x0000000000A00000-0x0000000000ECA000-memory.dmp

memory/3216-140-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3760-156-0x0000000000730000-0x0000000000BFA000-memory.dmp

memory/1800-153-0x0000000000A00000-0x0000000000ECA000-memory.dmp

memory/4376-158-0x0000000002C40000-0x0000000002CA5000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

MD5 c6a399eb155322a8cbf1390c118553cb
SHA1 c59b0aa34638e8991358520e29625bb7fb4e3b6b
SHA256 a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221
SHA512 6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe

MD5 dab2bc3868e73dd0aab2a5b4853d9583
SHA1 3dadfc676570fc26fc2406d948f7a6d4834a6e2c
SHA256 388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb
SHA512 3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

memory/2088-190-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3432-194-0x0000000000FD0000-0x00000000016BE000-memory.dmp

memory/3216-195-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3760-198-0x0000000000730000-0x0000000000BFA000-memory.dmp

memory/3760-199-0x0000000000730000-0x0000000000BFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095320101\bPDDW9F.exe

MD5 cde0f4bf8c4605529175bbb5e86c6bad
SHA1 8194071706458c456a021e8e17b0a63ba3b54b44
SHA256 989ab0b506d60a468a8ab919dd973cae0f00072d60615d9b0243825e4b4a4e7e
SHA512 265a84c26b56abdd0548503eea7b1ce76b6661ce874e7ef0235dad6d424b568ac104adf5324ee164924b67d4865222e5bc4567ea4ce67b39f08215ad301697ea

memory/2088-215-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3432-217-0x0000000000FD0000-0x00000000016BE000-memory.dmp

memory/2088-216-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3216-218-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3760-219-0x0000000000730000-0x0000000000BFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095330101\z3SJkC5.exe

MD5 001d7acad697c62d8a2bd742c4955c26
SHA1 840216756261f1369511b1fd112576b3543508f7
SHA256 de53f6f359af6ccc361faf2aa74690c9575b987a01f1250a6eb042cf9d4ea4af
SHA512 f06039d1d7ad28a04877e4eabb6fb7a5137a0040b8c316bee502bce6c68058bfe62db9480674bb69c9aeabae34304adeeff86dc3a8427929d00a842d2f2e80eb

C:\Windows\TEMP\{77AFC1C7-4A33-4102-A0BF-8550DD39AE5F}\.cr\z3SJkC5.exe

MD5 eff9e9d84badf4b9d4c73155d743b756
SHA1 fd0ad0c927617a3f7b7e1df2f5726259034586af
SHA256 d61ef1bfa73bd5b013066d86f1c41e33bb396fc547cf5ab7191f56cc7b463aad
SHA512 0006273c86e8130e06e705a2be46c3433c0d1b34463123354c1857ebf88503d6e7e90602dc40960351baa03155074f8c5834b251be9da90fd95b10e498a98a19

C:\Windows\Temp\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\Quadrisyllable.dll

MD5 a1e561bc201a14277dfc3bf20d1a6cd7
SHA1 1895fd97fb75ad6b59fc6d2222cf36b7dc608b29
SHA256 7ae39cb5cd14a875af3e43df4a309d6a7a44c0339c413bf21b0300c84e35b66c
SHA512 aaa4e7350094dc7574e5f18ce619f48a45062674353f0f2a340a1fea0055c7961a9b257455d8ea877d739635e3444df08f049484f48fa9729d8fb1667374cf3c

C:\Windows\Temp\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\WiseTurbo.exe

MD5 1f166f5c76eb155d44dd1bf160f37a6a
SHA1 cd6f7aa931d3193023f2e23a1f2716516ca3708c
SHA256 2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588
SHA512 38ad8f1308fe1aae3ddf7dbc3b1c5442663571137390b3e31e2527b8fec70e7266b06df295df0c411fcc500424022f274fd467d36040def2e1a4feff88c749b7

C:\Windows\Temp\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\sqlite3.dll

MD5 1e24135c3930e1c81f3a0cd287fb0f26
SHA1 9d13bfe63ddb15743f7770387b21e15652f96267
SHA256 1ce645aa8d3e5ef2a57a0297121e54b31cc29b44b59a49b1330e3d0880ce5012
SHA512 04e3ffa4d71b2324fafcb856b9e686ffd3f7a24e1cb6531b3715aa3b0abd52709a9dcb79643384315ebc16cf8899bd9b218ca5c6d47dc97df278126d0836201f

C:\Windows\TEMP\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\blast.tar.gz

MD5 219fe0e290712a35fd4c648f681e2d25
SHA1 83658f481a6aeeea45da571cf5e406078f8993cb
SHA256 51964920f5d4ddc699d5e6259df554798a305b87dd1a38afd4ed56a5f7713571
SHA512 5e75a5b5c80f3ec76b78e3993f694d6d2fc747a3f04363ff1de36e25669dfc68bbbdd8a0559ad3754ae956faab4cd53d73fb32044d7d82aee0b2ca012f969fe8

C:\Windows\Temp\{FB6AA94B-999D-4C88-9FF3-181F2B01A2BF}\.ba\phyllopod.html

MD5 7acd5f1bb75aef6681027e02232f3b7d
SHA1 caef0696cf3a2c86078fe068cf37a2a58ea495c5
SHA256 7501366637ca181f4f0c310d4020ace9d58cbf872f47abf82dd42ed98d2d6bef
SHA512 0887ba61cefb6e5010d276a4c9596e126dd782f672928e32d2126935fba487ea2ff729c8ab840f7db8babc31c00db981957f5d90249da0972082ce9d7062f533

memory/4280-257-0x00000000727D0000-0x000000007294B000-memory.dmp

memory/4280-258-0x00007FFBD4150000-0x00007FFBD4345000-memory.dmp

memory/4608-265-0x00007FF619E70000-0x00007FF619FC0000-memory.dmp

memory/4280-268-0x0000000000400000-0x0000000000D48000-memory.dmp

memory/1096-272-0x00000000727D0000-0x000000007294B000-memory.dmp

memory/1096-273-0x00007FFBD4150000-0x00007FFBD4345000-memory.dmp

memory/2088-296-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3216-297-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/1096-298-0x00000000727D0000-0x000000007294B000-memory.dmp

memory/1096-301-0x0000000000400000-0x0000000000D48000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cb1e3570

MD5 51dc3a87caf755c551b983b90fb3259a
SHA1 f287bf7f5568ef3938c0fa8030fc56baf52aeb5a
SHA256 c0812c4a360a9e623d1a69dee7f805fddacf6daf74e957a70531b8020bf9a967
SHA512 d6f0c52a56cd684d567cd3fd433fa162b83c77350685482a7c658a4087796d0bd0eeaa73c32bafb4b3abfc4341770503741bc75108f280ae9e04103b536409e7

memory/3760-302-0x0000000000730000-0x0000000000BFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095350101\BXxKvLN.exe

MD5 971c0e70de5bb3de0c9911cf96d11743
SHA1 43badfc19a7e07671817cf05b39bc28a6c22e122
SHA256 67c9bb968cd0de2bfb2c24b00cfb2b98ac7403135ea47d98961652518584e45d
SHA512 a46523d8c71c0df25a043e2250ee1b6792e147314ec2097870a7972c892fd1a2022994f10823dadf54f161d11e808251b85a18efb9db9450d97af4b2f173f3c2

memory/4256-319-0x00007FFBD4150000-0x00007FFBD4345000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095360101\mAtJWNv.exe

MD5 b60779fb424958088a559fdfd6f535c2
SHA1 bcea427b20d2f55c6372772668c1d6818c7328c9
SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
SHA512 c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

memory/2088-334-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1360-338-0x0000000000AF0000-0x0000000000B50000-memory.dmp

memory/4672-342-0x0000000000400000-0x0000000000429000-memory.dmp

memory/4672-340-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3216-343-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/5080-345-0x0000000000B60000-0x0000000000BC5000-memory.dmp

memory/3760-349-0x0000000000730000-0x0000000000BFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10095370101\zY9sqWs.exe

MD5 2bb133c52b30e2b6b3608fdc5e7d7a22
SHA1 fcb19512b31d9ece1bbe637fe18f8caf257f0a00
SHA256 b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630
SHA512 73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

memory/396-362-0x0000022DEAC90000-0x0000022DEACE2000-memory.dmp

memory/3444-366-0x0000000002700000-0x00000000027A5000-memory.dmp

memory/3444-367-0x0000000002700000-0x00000000027A5000-memory.dmp

memory/3444-371-0x0000000002700000-0x00000000027A5000-memory.dmp

memory/3444-365-0x0000000002700000-0x00000000027A5000-memory.dmp

memory/396-372-0x0000022DED4C0000-0x0000022DED5CA000-memory.dmp

memory/396-374-0x0000022DED3B0000-0x0000022DED3EC000-memory.dmp

memory/396-373-0x0000022DEADE0000-0x0000022DEADF2000-memory.dmp

memory/396-378-0x00007FF602D00000-0x00007FF602EAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B0C8.tmp.exe

MD5 a8d5951e44a77f82627bd0a98fde78d9
SHA1 423fd487ab2a50e1160a08bde17ae790dd556c16
SHA256 d278cc9dafdafb263a646c041f37118cdf835d397ec0a7c0c4d0cd0babfb5234
SHA512 0e71bf2dff31eae4d5870d3544536a6f2c9b09b547dfae62d0f1371184e82e731830a4a210e34af6a0bee06537a55e10b688059c474e364ca5c0e0d1d3647c68

C:\Users\Admin\AppData\Local\Temp\History

MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

memory/2088-421-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3216-423-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/3760-424-0x0000000000730000-0x0000000000BFA000-memory.dmp

memory/2004-427-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/2004-429-0x00000000005F0000-0x0000000000AB0000-memory.dmp

memory/340-432-0x0000000000730000-0x0000000000BFA000-memory.dmp

memory/4736-438-0x0000000000400000-0x0000000000823000-memory.dmp

memory/340-440-0x0000000000730000-0x0000000000BFA000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 af1447935808f7f9b1ad76dd997966fa
SHA1 b27d251f70dce482f90693fe4266c9c21d2d4c8b
SHA256 75ead20cf6a147666324aa9d28453ec1a310a1a82cf6a5ece7ace84a015568f4
SHA512 31f22380b919274449340aacdb1806fdcfbeb2c5d8e0129bff8c418d45187c074c3326b1a9f7fe6705a983bdbd34d8e393de9f7d83819cb8480acbda73197af2

C:\Users\Admin\AppData\Local\Temp\WatcherUpdate_test.exe

MD5 967f4470627f823f4d7981e511c9824f
SHA1 416501b096df80ddc49f4144c3832cf2cadb9cb2
SHA256 b22bf1210b5fd173a210ebfa9092390aa0513c41e1914cbe161eb547f049ef91
SHA512 8883ead428c9d4b415046de9f8398aa1f65ae81fe7945a840c822620e18f6f9930cce2e10acff3b5da8b9c817ade3dabc1de576cbd255087267f77341900a41c

memory/4736-461-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\temp_19551.exe

MD5 5f0b24ae3c62d53654aefb8ce7b3df42
SHA1 808074206c7d8253fe747648748241564f763443
SHA256 f6bb2348bfefb8f96e47f2195e42c3b49bbab0ebded99a1d030eb7ed1ed8c738
SHA512 e47b8d995cf2fea1ad930c40f75835fdcaa170f12bba95ab30cc59d53949878f86debd4a792ed6dba815faae63d5f6aa28dd6f85cfdc60de8cf2cfd46f8159dd

C:\Users\Admin\AppData\Local\Temp\temp_19551.exe

MD5 da901815806145f7433e2034ae90940e
SHA1 2cead2e05d12283db595a7b9ca1c5d3d568e73b1
SHA256 03ca444fd4a88b4585e1ebeb93c698881b986be7cf10fc4fb10bd796bea1fc4a
SHA512 0bcb3cdbe1a85657806d29eeaa91442e2286fc2fe2d4ce0bbe031518d6247da6b6c730c12f7876b7f33ff63b27f4c990faac380373eea1df3f91eb371e3bfc22

C:\Users\Admin\AppData\Local\Temp\_MEI7642\ucrtbase.dll

MD5 4e326feeb3ebf1e3eb21eeb224345727
SHA1 f156a272dbc6695cc170b6091ef8cd41db7ba040
SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
SHA512 be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

C:\Users\Admin\AppData\Local\Temp\temp_19604.exe

MD5 ce977569ace61fe7a3feca3ff6353754
SHA1 c31b8eddb5fef01f18589c92aebd56d9b1691384
SHA256 f4adcfcc3677778d9fa9e4e313f2fe60d08f1d5e69d1f4391c4f309ce6c6bf06
SHA512 4277ccff02f15acbcbd43efb4fbf7db7c21c53cb582f70cf885e29b42c47ddd367cbb6e49b78023b86dbe1e60258ae6907188a1b7f8384dce64c6eb51460805f

Analysis: behavioral20

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

Signatures

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\cipoaxj\teaut.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\cipoaxj\teaut.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\cipoaxj\teaut.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\cipoaxj\teaut.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\ProgramData\cipoaxj\teaut.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\cipoaxj\teaut.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\cipoaxj\teaut.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\reloadrive.exe N/A
N/A N/A C:\ProgramData\cipoaxj\teaut.exe N/A
N/A N/A C:\ProgramData\cipoaxj\teaut.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\reloadrive.exe

"C:\Users\Admin\AppData\Local\Temp\reloadrive.exe"

C:\ProgramData\cipoaxj\teaut.exe

C:\ProgramData\cipoaxj\teaut.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4655 towerbingobongoboom.com tcp

Files

memory/4684-0-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-1-0x00000000779C4000-0x00000000779C6000-memory.dmp

memory/4684-2-0x0000000000401000-0x0000000000403000-memory.dmp

memory/4684-3-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-6-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-7-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-8-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-9-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-10-0x0000000000400000-0x0000000000823000-memory.dmp

C:\ProgramData\cipoaxj\teaut.exe

MD5 8c767708c9a9554c0afb504629e75ffd
SHA1 c65394806c0f77af880c7ff8a021bd4222ca3f11
SHA256 dcb373f73cc5e29881b6c97f753da1db91becee01b5eade03b0fd217d10b4e7d
SHA512 f9531159b45f92db319f351ebf4dadf9ba3c413e87da401a0af81d25a446084ed30dee670462292b989e1c9b0074a3c2ae76bb8a1d992e4407f72360303b4e16

memory/3664-13-0x0000000000400000-0x0000000000823000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 189fdd2efa0b207a0c99abdb120a6f57
SHA1 ed2e0ead806e72f6cb8abc2562002d53a9f75159
SHA256 55706c8ca9cae62114fa37eab5da618d7a436bd4f5d237544df54769bfbf21b9
SHA512 f5741bf9eb5ccc69fc11cb92c6d17b24901819adf6812b0bb0536e174147e21709ce2b0eff9f3443a6d01cb7e8b578283746fd013e32c57b6588971f4ab96b3e

memory/3664-15-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-16-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-17-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-18-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-19-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-20-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-21-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-22-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-23-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-24-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-25-0x0000000000400000-0x0000000000823000-memory.dmp

memory/4684-26-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-28-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-29-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-30-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-31-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-32-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-33-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-34-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-35-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3664-36-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral21

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2828 set thread context of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe
PID 2828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 2828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 2828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 2828 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe
PID 1324 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe

"C:\Users\Admin\AppData\Local\Temp\wBalaPT.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 1072

Network

Country Destination Domain Proto
US 8.8.8.8:53 earthsymphzony.today udp
US 104.21.64.1:443 earthsymphzony.today tcp

Files

memory/2828-0-0x00000000740DE000-0x00000000740DF000-memory.dmp

memory/2828-1-0x0000000000030000-0x00000000000A0000-memory.dmp

memory/1324-14-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1324-13-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1324-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1324-9-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1324-8-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1324-7-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1324-5-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1324-3-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2828-15-0x00000000740D0000-0x00000000747BE000-memory.dmp

memory/1324-16-0x0000000000400000-0x0000000000465000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\Tar8EBF.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

memory/1324-54-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2828-55-0x00000000740DE000-0x00000000740DF000-memory.dmp

memory/2828-56-0x00000000740D0000-0x00000000747BE000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20241010-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 144

Network

N/A

Files

memory/1720-1-0x0000000000A08000-0x0000000000A09000-memory.dmp

memory/1720-0-0x0000000000360000-0x0000000000A4E000-memory.dmp

memory/1720-2-0x0000000000360000-0x0000000000A4E000-memory.dmp

memory/1720-3-0x0000000000A08000-0x0000000000A09000-memory.dmp

memory/1720-4-0x0000000000360000-0x0000000000A4E000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\xelk\gfgim.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\xelk\gfgim.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\xelk\gfgim.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\ProgramData\xelk\gfgim.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\xelk\gfgim.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

"C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\ProgramData\xelk\gfgim.exe

C:\ProgramData\xelk\gfgim.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

Network

Country Destination Domain Proto
GB 2.18.66.89:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4654 towerbingobongoboom.com tcp

Files

memory/548-0-0x0000000000B30000-0x0000000000FFA000-memory.dmp

memory/548-1-0x0000000077634000-0x0000000077636000-memory.dmp

memory/548-2-0x0000000000B31000-0x0000000000B5F000-memory.dmp

memory/548-3-0x0000000000B30000-0x0000000000FFA000-memory.dmp

memory/548-4-0x0000000000B30000-0x0000000000FFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 a308ca3417da9a5fd27823d205e2944a
SHA1 a623c58df6d2f75b3ffda3268cc6ed7ef48ce070
SHA256 973bb90580ab417bea0568823bb7852eeed34f6d83461f3de275fcda727c73ee
SHA512 4a9e58b99bf736a20f4b7f7a740546c2e2a4c46ab9bfd44b15a76b75f14a90a0ba4eca0302a4b0006086e035b4e739bec9da98d9ff416880dcc4f44aa8e3f7f2

memory/1800-16-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/548-18-0x0000000000B30000-0x0000000000FFA000-memory.dmp

memory/1800-19-0x0000000000EE1000-0x0000000000F0F000-memory.dmp

memory/1800-20-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/1800-21-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/1800-22-0x0000000000EE0000-0x00000000013AA000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

MD5 c6a399eb155322a8cbf1390c118553cb
SHA1 c59b0aa34638e8991358520e29625bb7fb4e3b6b
SHA256 a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221
SHA512 6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

memory/1800-36-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3596-37-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-38-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/1800-39-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/5056-41-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-43-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3596-42-0x0000000000400000-0x0000000000823000-memory.dmp

memory/5056-44-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3596-45-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-47-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-48-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3596-49-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-51-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-52-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3596-53-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-55-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-56-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3596-57-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-59-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-60-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3596-61-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-63-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-64-0x0000000000400000-0x0000000000823000-memory.dmp

memory/3596-65-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-69-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3240-71-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3240-72-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-73-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-74-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-75-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-76-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-77-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-78-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-79-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-80-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-81-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-82-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-83-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-84-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/1072-87-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-88-0x0000000000400000-0x0000000000823000-memory.dmp

memory/1800-89-0x0000000000EE0000-0x00000000013AA000-memory.dmp

memory/3572-90-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20241010-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d = "C:\\Users\\Admin\\AppData\\Roaming\\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe" C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2316 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2316 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2316 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2316 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2612 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2612 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2612 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2612 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\schtasks.exe
PID 2472 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2872 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2872 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2872 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2872 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2472 wrote to memory of 1604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 1604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 1604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 1604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 1604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Windows\SysWOW64\WerFault.exe
PID 2472 wrote to memory of 1528 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 1528 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 1528 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 2472 wrote to memory of 1528 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe
PID 1528 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Local\Temp\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 512

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d" /tr "C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {CA6624DE-BF64-41A5-A865-4761F115E786} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 508

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 508

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

"C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 512

Network

Country Destination Domain Proto
US 8.8.8.8:53 appengine.google.com udp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp
HU 178.250.188.144:22635 tcp

Files

memory/2316-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

memory/2316-1-0x0000000001360000-0x00000000013AE000-memory.dmp

memory/2316-2-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2612-10-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2612-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2612-5-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2612-4-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2612-7-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2612-6-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2316-17-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2612-16-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2316-15-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2612-14-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2612-12-0x0000000000400000-0x0000000000436000-memory.dmp

memory/2612-18-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2316-22-0x00000000748CE000-0x00000000748CF000-memory.dmp

memory/2316-23-0x00000000748C0000-0x0000000074FAE000-memory.dmp

memory/2612-24-0x00000000748C0000-0x0000000074FAE000-memory.dmp

C:\Users\Admin\AppData\Roaming\dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d.exe

MD5 d1458dc39b290683cefbb01cc5b0991a
SHA1 e9749971be9d943cb2a62e2be5eb442161876ec6
SHA256 dc7d690adb8ea5ab1a9b1f65fc3a62b35d9ae4c57a7806ccb226b825f1465f2d
SHA512 f90bc037576ee1205fa260d5b6b05c95f930025bc40f541b92f39b845b8e9a90a59ec18ef0be1ab5cf7bb74ed6a6222fc1a882df894ba8e1e722d671aef37e35

memory/2872-27-0x0000000000910000-0x000000000095E000-memory.dmp

memory/2696-37-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1604-48-0x0000000000FA0000-0x0000000000FEE000-memory.dmp

memory/2484-58-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2180-78-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Signatures

Stealc

stealer stealc

Stealc family

stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\random.exe

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Network

Country Destination Domain Proto
RU 45.93.20.28:80 45.93.20.28 tcp

Files

memory/3020-0-0x0000000000A50000-0x00000000010E0000-memory.dmp

memory/3020-1-0x0000000077700000-0x0000000077702000-memory.dmp

memory/3020-2-0x0000000000A51000-0x0000000000A68000-memory.dmp

memory/3020-3-0x0000000000A50000-0x00000000010E0000-memory.dmp

memory/3020-5-0x0000000000A50000-0x00000000010E0000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

78s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Signatures

Stealc

stealer stealc

Stealc family

stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\random.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\random.exe

"C:\Users\Admin\AppData\Local\Temp\random.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
RU 45.93.20.28:80 45.93.20.28 tcp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/1316-0-0x0000000000A50000-0x00000000010E0000-memory.dmp

memory/1316-1-0x0000000077814000-0x0000000077816000-memory.dmp

memory/1316-2-0x0000000000A51000-0x0000000000A68000-memory.dmp

memory/1316-3-0x0000000000A50000-0x00000000010E0000-memory.dmp

memory/1316-4-0x0000000000A50000-0x00000000010E0000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win7-20241010-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

SystemBC

trojan systembc

Systembc family

systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\mwipw\gdehwx.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\mwipw\gdehwx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\mwipw\gdehwx.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine C:\ProgramData\mwipw\gdehwx.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
N/A N/A C:\ProgramData\mwipw\gdehwx.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\mwipw\gdehwx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2200 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2200 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2200 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2200 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 2940 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe
PID 1672 wrote to memory of 944 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mwipw\gdehwx.exe
PID 1672 wrote to memory of 944 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mwipw\gdehwx.exe
PID 1672 wrote to memory of 944 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mwipw\gdehwx.exe
PID 1672 wrote to memory of 944 N/A C:\Windows\system32\taskeng.exe C:\ProgramData\mwipw\gdehwx.exe

Processes

C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe

"C:\Users\Admin\AppData\Local\Temp\W6ySCZP.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

"C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {F2365213-1413-4A59-8C4A-970B56E69418} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]

C:\ProgramData\mwipw\gdehwx.exe

C:\ProgramData\mwipw\gdehwx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4656 towerbingobongoboom.com tcp

Files

memory/2200-0-0x0000000000CF0000-0x00000000011BA000-memory.dmp

memory/2200-1-0x0000000077DD0000-0x0000000077DD2000-memory.dmp

memory/2200-2-0x0000000000CF1000-0x0000000000D1F000-memory.dmp

memory/2200-3-0x0000000000CF0000-0x00000000011BA000-memory.dmp

memory/2200-4-0x0000000000CF0000-0x00000000011BA000-memory.dmp

memory/2200-5-0x0000000000CF0000-0x00000000011BA000-memory.dmp

memory/2200-19-0x0000000000CF0000-0x00000000011BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

MD5 a308ca3417da9a5fd27823d205e2944a
SHA1 a623c58df6d2f75b3ffda3268cc6ed7ef48ce070
SHA256 973bb90580ab417bea0568823bb7852eeed34f6d83461f3de275fcda727c73ee
SHA512 4a9e58b99bf736a20f4b7f7a740546c2e2a4c46ab9bfd44b15a76b75f14a90a0ba4eca0302a4b0006086e035b4e739bec9da98d9ff416880dcc4f44aa8e3f7f2

memory/2940-20-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-21-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-22-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-25-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-23-0x0000000000CE0000-0x00000000011AA000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000640100\coredrive.exe

MD5 c6a399eb155322a8cbf1390c118553cb
SHA1 c59b0aa34638e8991358520e29625bb7fb4e3b6b
SHA256 a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221
SHA512 6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

memory/2940-42-0x0000000006220000-0x0000000006643000-memory.dmp

memory/2940-43-0x0000000006220000-0x0000000006643000-memory.dmp

memory/2476-44-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-40-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-47-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-49-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-50-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2940-51-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-55-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-54-0x0000000000CE0000-0x00000000011AA000-memory.dmp

C:\Windows\Tasks\Test Task17.job

MD5 e76da5e7b4eb7d0376c2c9da34124cfe
SHA1 d235c5456a452876ba1973c9d4fac6c4617aa356
SHA256 9f54d2232b4c824d78c27e9d2030c406a5f1eadc03101e7667f594257e4a915a
SHA512 1ef7db267c9e8c3adf8a568dd3e82addfb201f56f56c58cfed5d63202141e8f32fc4217b573478bfb4d664406d1028fbe280a5e80a9d84f8b86798fdd71f1c3f

memory/2940-57-0x0000000006220000-0x0000000006643000-memory.dmp

memory/2940-59-0x0000000006220000-0x0000000006643000-memory.dmp

memory/2476-58-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2476-60-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-61-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-62-0x0000000000400000-0x0000000000823000-memory.dmp

memory/944-63-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2476-64-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-65-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-66-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2476-67-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-68-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-69-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2476-70-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-71-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-72-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2476-73-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-74-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-75-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2476-76-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-77-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/2476-79-0x0000000000400000-0x0000000000823000-memory.dmp

memory/944-80-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-81-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-82-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-83-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-84-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-85-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-86-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-87-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-88-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-89-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-90-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-91-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-92-0x0000000000400000-0x0000000000823000-memory.dmp

memory/2940-93-0x0000000000CE0000-0x00000000011AA000-memory.dmp

memory/944-94-0x0000000000400000-0x0000000000823000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe

"C:\Users\Admin\AppData\Local\Temp\OEHBOHk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:52909 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\Ps7WqSx.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4888 -ip 4888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 304

Network

Country Destination Domain Proto
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4888-0-0x0000000000E10000-0x00000000014FE000-memory.dmp

memory/4888-1-0x00000000014B8000-0x00000000014B9000-memory.dmp

memory/4888-2-0x0000000000E10000-0x00000000014FE000-memory.dmp

memory/4888-3-0x0000000000E10000-0x00000000014FE000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2025-03-04 22:39

Reported

2025-03-04 22:42

Platform

win10v2004-20250217-en

Max time kernel

123s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 836 set thread context of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133856016676316730" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 836 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe
PID 2792 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2792 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 2148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 2148 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3156 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 3192 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3512 wrote to memory of 884 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

"C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe"

C:\Users\Admin\AppData\Local\Temp\SpotIfy_V2.467.exe

none

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc24bfcc40,0x7ffc24bfcc4c,0x7ffc24bfcc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1904 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2500 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4324,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4524 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3836,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4768 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4784 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4956,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4932 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4852 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4668 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3192,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4812 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4336,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4660 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5104 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5468,i,13729849221712009709,14453757209258206809,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5460 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc24c046f8,0x7ffc24c04708,0x7ffc24c04718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,8042973061990204690,8398507780632632877,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\0zuai" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 su.t.goldenloafuae.com udp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 104.86.110.200:80 e5.o.lencr.org tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.10:443 ogads-pa.googleapis.com udp
GB 216.58.201.110:443 apis.google.com udp
GB 142.250.200.10:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.46:443 play.google.com udp
GB 142.250.200.46:443 play.google.com tcp
GB 142.250.200.46:443 play.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 142.250.179.225:443 clients2.googleusercontent.com udp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 104.208.16.94:443 nw-umwatson.events.data.microsoft.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp
FI 95.217.27.252:443 su.t.goldenloafuae.com tcp

Files

memory/2792-0-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-1-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-7-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-13-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-20-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-21-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-26-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-27-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-30-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-34-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-35-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-36-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-40-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-44-0x00000000001C0000-0x00000000001E9000-memory.dmp

\??\pipe\crashpad_3512_HFKZIWRVCTXBHZLR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_794047087\bbb80ed6-03c5-48fe-8520-030639e5673d.tmp

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

C:\Users\Admin\AppData\Local\Temp\scoped_dir3512_794047087\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 583c839b8977bbd8b62e58a206a63254
SHA1 d50bb9597422f70e7e18f606b2d6ac24189e7b59
SHA256 ad72b5d8ce565b3d2b2a70ed528792674b0b7a3fcdb94f1430c8064eb28ed2f1
SHA512 5711214b201b05213df667d817160d6176758a870f1f643f45dfb00a1fdd5b3670539ab1d832798174c96b90a40de0d73330fd716729359082215283e418437d

memory/2792-469-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-470-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-471-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-472-0x00000000001C0000-0x00000000001E9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9f4a0b24e1ad3a25fc9435eb63195e60
SHA1 052b5a37605d7e0e27d8b47bf162a000850196cd
SHA256 7d70a8fc286520712421636b563e9ee32335bca9a5be764544a084c77ddd5feb
SHA512 70897560b30f7885745fede85def923fb9a4f63820e351247d5dcbe81daab9dab49c1db03b29c390f58b3907d5025737a84fff026af2372c3233bc585dcfd284

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4c9b7e612ef21ee665c70534d72524b0
SHA1 e76e22880ffa7d643933bf09544ceb23573d5add
SHA256 a64366387921aba157bba7472244791d5368aef8ecaf6472b616e1e130d7d05e
SHA512 e195e1ce5e7c06d193aa1f924d0079ea72b66eb22c3aea5b6811172251768f649368734e817996d9f0f72ddfd0e2bf2454aaee0bc650eaffd56fa125a334ae88

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\114cdbdf-5a6c-4f70-b4c2-6a842b8fc1fb.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cd5039e7f3bb0e084a24ff5a8a7ab2f7
SHA1 b8805f71f548e17544ec0dc42c5ff53a3c058c99
SHA256 67e668f07e9fbee9942baee29932dd26297f06d8c53ce36c65bc61d2b7677ca5
SHA512 6b73424f8b5f91a57b71e9a0acee0585b58b94045553fe6d550850bae6df8394a8ab79b0bd9bd81a8dbc22e2ea8aab3bbf024e91867158c0e6c2d749ed29e302

memory/2792-503-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-507-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-504-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-511-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-512-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-516-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-521-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-522-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-526-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-527-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-529-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-530-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-531-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-532-0x00000000001C0000-0x00000000001E9000-memory.dmp

memory/2792-533-0x00000000001C0000-0x00000000001E9000-memory.dmp

C:\ProgramData\0zuai\vsjwt0

MD5 cc42310c6b79fdea5a1f97dd860bc5c9
SHA1 8c5ae2648ee12ef044471ae7f26b4c814603e36d
SHA256 21f33455cd566ff43d91f43b052bfc39ab962c6c65cd3177ebdad3ad7716e452
SHA512 0953ed6e87fa90b85ae9f575079ab08a41a70253885738d6434e5e62ec2418481aaf0bafe158273488584b364d1acbf05478032c9e2ab9b874aeb15fe2404b33