c2cd34c0f4295339c1d611c5a9a4847be9da704e3454fe781f4af47540c0bb9d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/02/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 5.2MB
Sample260211-acn68act4b
SHA256 c2cd34c0f4295339c1d611c5a9a4847be9da704e3454fe781f4af47540c0bb9d
MD5 ab7bedfaddd68182ccc6d808c847dde8
SHA1 3419b68d113c4dfc2514fdb134dbb424b93f950a
SHA512 fb0ad733d1b26a889dfe173f8cd48be076971412fbaeb10370ea96e3f8c73675745a0107bd41cb42d274295f89559157ef15310e7c46336a048c86f8ea379336
SSDEEP 98304:UrirtAN325Iu0yPuEUayz5HjFsFeQZVHgDB6Xo5NIhGouQUIM85Rv+e:y2ApYewuysHj5+Y5NIh4812e
TLSH
T14A46022FB28BBC3EE41A3B370572E15494FB7A1DA5226D5686E4849CCE258D03D3E743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer privilege_escalation upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	3340	AvastSvc.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral24/files/0x000700000002443f-164.dat	acprotect
behavioral24/files/0x0009000000024301-435.dat	acprotect

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	AvastSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	random.tmp

Executes dropped EXE 10 IoCs

pid	Process
3784	random.tmp
1232	random.tmp
3340	AvastSvc.exe
3064	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
748	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
4852	AvastSvc.exe
3988	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
3140	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
4120	AvastSvc.exe
2684	AvastSvc.exe

Loads dropped DLL 34 IoCs

pid	Process
3784	random.tmp
3784	random.tmp
1232	random.tmp
1232	random.tmp
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
748	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
748	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
4852	AvastSvc.exe
4852	AvastSvc.exe
4852	AvastSvc.exe
4852	AvastSvc.exe
4852	AvastSvc.exe
4852	AvastSvc.exe
3140	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
3140	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
4120	AvastSvc.exe
4120	AvastSvc.exe
4120	AvastSvc.exe
4120	AvastSvc.exe
4120	AvastSvc.exe
4120	AvastSvc.exe
4120	AvastSvc.exe
2684	AvastSvc.exe
2684	AvastSvc.exe
2684	AvastSvc.exe
2684	AvastSvc.exe
2684	AvastSvc.exe
2684	AvastSvc.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral24/files/0x000700000002443f-164.dat	upx
behavioral24/memory/3340-166-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/3340-172-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/3340-176-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/3340-234-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/3340-249-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/4852-266-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/4852-274-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/memory/4852-277-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx
behavioral24/files/0x0009000000024301-435.dat	upx
behavioral24/memory/4120-441-0x0000000072280000-0x00000000724E3000-memory.dmp	upx
behavioral24/memory/4120-449-0x0000000072280000-0x00000000724E3000-memory.dmp	upx
behavioral24/memory/4120-451-0x0000000072280000-0x00000000724E3000-memory.dmp	upx
behavioral24/memory/2684-494-0x0000000073EA0000-0x00000000740F5000-memory.dmp	upx

Access Token Manipulation: Create Process with Token 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3340	AvastSvc.exe
4852	AvastSvc.exe
4120	AvastSvc.exe
2684	AvastSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Inno Setup is an open-source installation builder for Windows applications. 10 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral24/memory/4568-0-0x0000000000100000-0x00000000001D9000-memory.dmp	innosetup
behavioral24/memory/716-12-0x0000000000100000-0x00000000001D9000-memory.dmp	innosetup
behavioral24/memory/4568-17-0x0000000000100000-0x00000000001D9000-memory.dmp	innosetup
behavioral24/memory/716-170-0x0000000000100000-0x00000000001D9000-memory.dmp	innosetup
behavioral24/files/0x000700000002448b-210.dat	innosetup
behavioral24/memory/3064-220-0x0000000000940000-0x0000000000A41000-memory.dmp	innosetup
behavioral24/memory/3064-236-0x0000000000940000-0x0000000000A41000-memory.dmp	innosetup
behavioral24/memory/3988-285-0x0000000000940000-0x0000000000A41000-memory.dmp	innosetup
behavioral24/memory/3064-289-0x0000000000940000-0x0000000000A41000-memory.dmp	innosetup
behavioral24/memory/3988-445-0x0000000000940000-0x0000000000A41000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	AvastSvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AvastSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvastSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AvastSvc.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4924	timeout.exe
644	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1232	random.tmp
1232	random.tmp
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe
3340	AvastSvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1232	random.tmp
3140	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3784	4568	random.exe	88
PID 3784 wrote to memory of 716	3784	random.tmp	90
PID 716 wrote to memory of 1232	716	random.exe	91
PID 1232 wrote to memory of 3340	1232	random.tmp	92
PID 1232 wrote to memory of 3096	1232	random.tmp	93
PID 3096 wrote to memory of 4924	3096	cmd.exe	95
PID 3340 wrote to memory of 3064	3340	AvastSvc.exe	102
PID 3064 wrote to memory of 748	3064	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe	104
PID 748 wrote to memory of 3988	748	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp	115
PID 3988 wrote to memory of 3140	3988	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe	116
PID 3140 wrote to memory of 4120	3140	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp	117
PID 3140 wrote to memory of 208	3140	KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp	118
PID 208 wrote to memory of 644	208	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\is-RS3VV.tmp\random.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RS3VV.tmp\random.tmp" /SL5="$D01CC,4445063,828416,C:\Users\Admin\AppData\Local\Temp\random.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe" /VERYSILENT /PASSWORD=691377b6-a17b-4525-9d14-8a83ee9b2c65
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Users\Admin\AppData\Local\Temp\is-L38TF.tmp\random.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-L38TF.tmp\random.tmp" /SL5="$E01CC,4445063,828416,C:\Users\Admin\AppData\Local\Temp\random.exe" /VERYSILENT /PASSWORD=691377b6-a17b-4525-9d14-8a83ee9b2c65
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\ProgramData\rangeheap\AvastSvc.exe
        
        "C:\ProgramData\rangeheap\AvastSvc.exe" /runassvc
        5⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Access Token Manipulation: Create Process with Token
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\is-KJFESQ1XPT.tmp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KJFESQ1XPT.tmp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp" /SL5="$160198,4697249,991744,C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe" /VERYSILENT /PASSWORD=bf3ce5a8-9f30-4ccd-8967-b018bf016d17
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\is-DIBSBMSZCH.tmp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DIBSBMSZCH.tmp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp" /SL5="$170198,4697249,991744,C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe" /VERYSILENT /PASSWORD=bf3ce5a8-9f30-4ccd-8967-b018bf016d17
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\ProgramData\RoyalBlueSaddleBrown\AvastSvc.exe
        
        "C:\ProgramData\RoyalBlueSaddleBrown\AvastSvc.exe" /runassvc
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Access Token Manipulation: Create Process with Token
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        Checks processor information in registry
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c timeout /t 3 /nobreak > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        11⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:644
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c timeout /t 3 /nobreak > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\random.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4924

C:\ProgramData\rangeheap\AvastSvc.exe
C:\ProgramData\rangeheap\AvastSvc.exe /runassvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
PID:4852

C:\ProgramData\rangeheap\AvastSvc.exe
C:\ProgramData\rangeheap\AvastSvc.exe /runassvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aswCmnOS.dll

Path C:\ProgramData\RoyalBlueSaddleBrown\aswCmnOS.dll
Size 7.2MB
SHA256 51c781e01f1723377b89deca4a45b786528c1271dfc57c1d560fca76d03b2393
MD5 37b80e7b56c1a69c206677ea8e062ca4
SHA1 89e26110052c926f54cbc6adb2a6707c55a07f73
SHA512 4e92cd3ce625526ce9178211abbb6d6a9287fb0789b7bff722b2e8995e14ed4fd7c1f1c0cbfca05535092a28da103fa519b8b0eea05fe964b86ab4394e600315
SSDEEP 24576:Q0kt0J5ekq3KhemcanGuBQUMBQAanYvMPFeQ/Q3crPIknqerzZico:4C1qjmcEvLdck0Q/Qsckqo1ic
TLSH
T1F1763306B57BDF72DACF22B133E5214578FE4843869423264EE8479C6F55A90A402FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AvastSvc.exe

Path C:\ProgramData\rangeheap\AvastSvc.exe
Size 918KB
SHA256 4edf60d4efdae8a9688998bb16a6b35d7c95940e43d6baaa196e6af51679cd89
MD5 c7b35ce076e855a6c933f9f97a3dcee7
SHA1 ceac658b29fd971e100d933509a37374ba6c1e5f
SHA512 c28ab26c227510edd046305ca1daccd0f5af79353a32f13eb6ef2dcfbe435e9ffb63da3588ba83f5a97508ae72e0a1ef74efb7a4fa343e0301640750235664c5
SSDEEP 24576:Axa2co83qaGBqn8jzOh0lhSMXl9Rcd73jtcD8wCV:Axa1o83i6OzbracD8
TLSH
T189156D207E4AD076E59202B1D62C7FBA815AEEB50B6110CB63F47E6D7D701C32E36A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aswCmnBS.dll

Path C:\ProgramData\rangeheap\aswCmnBS.dll
Size 401KB
SHA256 c840ae8629e2e1d0ff041b805b7f11451994fd78f374f6818be1c3950c6e2bd7
MD5 55db67ceb5ca8c15a2fb709b8115f8d1
SHA1 e2c831ffe00b98f5db04484a5854b487bc698665
SHA512 e122ec4272bc0eeba2aa6c8df64e539963864d6d270ae1ede9ef6f9b1635eb2be88567b056b9faed1baa223cdfed1a344d6e6746c11fa1f68663eec4c6069d5a
SSDEEP 12288:5KzfMevp0Kvgq2F1e4CeoNR6vvT+5Kut8tV:IzfMy4CeKRwTtuGtV
TLSH
T137946C30F746C173E59215709EBEAB2F503D2D35277A48C7B2E85A9A18701E22B35F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aswCmnIS.dll

Path C:\ProgramData\rangeheap\aswCmnIS.dll
Size 379KB
SHA256 e8240eec54873e5f787ef1f8d91eff2d5e395d32fbc4b9b4ace8e2d2dab0067a
MD5 1477e827960055a9383aae5e49db36ef
SHA1 7a6e326552c1b67b3fcb776bb4132e459ddf04c1
SHA512 2970f30a08a095bfabc3064984dff84a240745700cdf2592c9838db5b20d6aaf2315b0ed2116c4f4690cdf7bbd6617829144e4e8709d5536cccc82665393bc0a
SSDEEP 6144:29oAIyVGtJFW51mNplWdZVGHF29h9R+a/b5GrQ2iXHGBkkkkSDh9VLkHDtqDCW3M:olVGtJFW51mNplWdZVGHF29h9R+WJ2iO
TLSH
T12584B022F2AA56B3F4A14472C7FE692BA5BD36245354C4D3D2907F541C929C32B343EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aswCmnOS.dll

Path C:\ProgramData\rangeheap\aswCmnOS.dll
Size 8.1MB
SHA256 e80ba49da317e2006d182ce2fc1f69f92a924f0a03b1e2314d51faffab575a1a
MD5 69a9c8e6eade7dfa7a9ce44f6faba636
SHA1 6131b9e0eb86b958c2a39196130cd66b2c9c127a
SHA512 4422e39d297faef509427f5fa81207a059edb6cfd5cfce311062bc88ab1e5cb90d8eb08954153e8e16b048e54acfdfafd459e35e7ff485f8f9e2bfdc40287a74
SSDEEP 24576:LUR1YijPeHoWmAe05MrF5u17963GttbnuSU/pT5t:qrW7e0+r7u143G/Luvp
TLSH
T15B863326A08BE238C1D989794DB4057A5DDFD19107B008E3FD98DBB037D74EC8E66785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dll_loader.dll

Path C:\ProgramData\rangeheap\dll_loader.dll
Size 187KB
SHA256 6410eb85e56d4f398a6d55d0afb3b34da3903ec6f4601d435fb6a3bb6928269a
MD5 90a955f5cd283d50d0d5a8f0b4809ce9
SHA1 cb3178b96000097981bddad5baa7cf9dad4e349e
SHA512 84923cfb8c1b0e22a72604b2862b13785c1facabda7980c8256acc853afc53a80f4ae8a3ce430eed0779869feb21d76be2a5c5fc203334f7a5e30c92dc5e2cde
SSDEEP 3072:R+CZ2pktpqqIGSzIxph0LR/hSMXlk4ZqKFya5XB67TzgKNz11scZZCNTV:R+CMS7gr8ph0lhSMXlBXBWHgKNz11poD
TLSH
T10114D0217A15C871E78D07B06CFD1FED7A3D47064BE61ACB237969289FA12C22D7680D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\rangeheap\local.crt\VCRUNTIME140.dll
Size 89KB
SHA256 63f98f7eb2b42d4e416d1a0e5631becb5ee6ee09393913b4e0d9b4b852355172
MD5 fd82c7b4ee2c40adaae774d7357426d3
SHA1 191b79e6a594bbf1ce17df6610f86d05082b36ca
SHA512 0a80d83e4ce3741378df1bd4115cac15f6e18f1bcfe740afdefd958773e252175a0495ff12ba509840e8b8928cdcfa914c4efe864c3375bca4b8bf86d5cd54b0
SSDEEP 1536:uPyFWhPlUYIUwiXKdM5Ri1mGWVYpz4hckJc2rElurnjvHkBGCGE7xRTkfSecb6RM:GOWhPyYIUpJGHlMElurn5Roxbecb6DSh
TLSH
T140937E9335E48272D89E05B0C97BFB162D3DE6510FF06BE71B949848DE62BC4DB3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\ProgramData\rangeheap\local.crt\msvcp140.dll
Size 437KB
SHA256 654412a50c83d218d9f72f8bbd0e0d2963ed0b58be59d6661e931f32dc9f80d8
MD5 05f1b8a11885aa248408597f25ee9d47
SHA1 d73ee3cd3b4a6993f8080211c2d4fdae500cc95d
SHA512 676bff631cbb503fe3b538ba34d6eccf3f5260e4325dc966c0fe56ca1c5696f8d2e11b4e652610fb031f066c01bb9112d738464d14ae1dc5ef15dab4d766d77f
SSDEEP 12288:5Cx3l90re/ICEc/pdmFAlG65ndMhUgiW6QR7t5s03Ooc8dHkC2esGd:M390re/ICEIdmFAlZd03Ooc8dHkC2eXd
TLSH
T10F9417227B064DF1E49923B572CA431293F9EC650360E3C3A3DEF5192F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe

Path C:\Users\Admin\AppData\Local\Temp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.exe
Size 6.6MB
SHA256 61c6a7b38310b7b24bd7600433606f19aa46f4ade3f8f5674d270780cf6c9c5c
MD5 a7eb8b9fc7307ca26230b2f19d1b6912
SHA1 a4cc76bd64b9c59694db829de20e82e00ee52256
SHA512 36ed2aaa66724f3e59b9ed21b0307d5cbd370c7a956d840580cb3bcddf64d7008395f1bb9a8673cfc4ae462793b8546ad5bdb3c63588ecd9262e66fbbf57ef63
SSDEEP 98304:mN66YsiTDjPchnbbfO5CZrlFeeAW6Jo4kUIemEcYi/OTrRATpRVweBCDD1wg3:2Ysej0JbymzpABRkbiliQrCTm2
TLSH
T19A661237B28AA33DE06E5A3799B2D1614D3B6E51A51A4C0397E47C8CDF2D0A01E7F643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-54M3D.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KJFESQ1XPT.tmp\KDR_DL_10041_focus%20group_5.3024.34.13_INSTALL.tmp
Size 3.7MB
SHA256 cd915a3409b207a852d482625705f395af6c5f08551870d6f449e1309d87bb2c
MD5 c7f75f06d10dbfa09fe639a46fac61cd
SHA1 1d5d33b2db7ad24f99c7ae0187804854d5d4fe00
SHA512 3732c03d813d51f8d96f825069e416b667fb73a17d19850251e158a7f23b64b373f42def98e47826f0388227cba08a6475cc8b7f180a682e42ed5404858490c9
SSDEEP 49152:jRlPTL3bZxTK30VySO6094L7WhIMTRZYiVIc3mjLXxumICaZ333YTzv:jvTgb42hIMTRZ/VF3MXxs333o
TLSH
T1A3067D13B388653FD05B1A395837BA94583F7E7229128C275BE42E8C4F752842E3A777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

random.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RS3VV.tmp\random.tmp
Size 3.3MB
SHA256 201f62ab90875a4c788abf6ec83570a15244a9ad0f0a183bc14c28c97fb049c5
MD5 50741a69afd908db2b9be1298b4e1158
SHA1 4f6088a9ade64f7949bf4cc271f23cbf4a338cef
SHA512 0e0d8668b630cf45868d0b971cdc95618388ef2707cf3cec135fd8df2b5b0692ac0eddfe9852fa9bb80700da3b7855775ba89cd7a6fd618aadde767ff2e8746d
SSDEEP 49152:IiE8NvQCX7lF4RQSxPodbxsl7IwDksRinJwj9LaDjppz0ooh+3331O:IiE8OQMlIwDkZqBL6333c
TLSH
T1F1F56C27F34D743EF06A2B399C379248583B7A6065168C5797FC3A4C8F365802E2A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-446-0x0000000000990000-0x00000000009D5000-memory.dmp

Download

memory/716-12-0x0000000000100000-0x00000000001D9000-memory.dmp

Download

memory/716-170-0x0000000000100000-0x00000000001D9000-memory.dmp

Download

memory/748-288-0x0000000001280000-0x00000000012C5000-memory.dmp

Download

memory/748-242-0x0000000000660000-0x0000000000A1D000-memory.dmp

Download

memory/748-238-0x0000000001280000-0x00000000012C5000-memory.dmp

Download

memory/748-237-0x0000000000660000-0x0000000000A1D000-memory.dmp

Download

memory/748-281-0x0000000001280000-0x00000000012C5000-memory.dmp

Download

memory/748-280-0x0000000000660000-0x0000000000A1D000-memory.dmp

Download

memory/748-287-0x0000000000660000-0x0000000000A1D000-memory.dmp

Download

memory/1232-22-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download

memory/1232-169-0x00000000010D0000-0x0000000001115000-memory.dmp

Download

memory/1232-167-0x0000000000190000-0x00000000004F0000-memory.dmp

Download

memory/2684-494-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/3064-289-0x0000000000940000-0x0000000000A41000-memory.dmp

Download

memory/3064-236-0x0000000000940000-0x0000000000A41000-memory.dmp

Download

memory/3064-220-0x0000000000940000-0x0000000000A41000-memory.dmp

Download

memory/3140-443-0x0000000000D20000-0x00000000010DD000-memory.dmp

Download

memory/3140-444-0x0000000001860000-0x00000000018A5000-memory.dmp

Download

memory/3340-173-0x0000000001880000-0x0000000001AD5000-memory.dmp

Download

memory/3340-195-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-191-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-190-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-188-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-187-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-186-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-184-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-178-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-197-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-199-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-198-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-193-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-194-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-222-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-192-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-235-0x00000000017F0000-0x0000000001865000-memory.dmp

Download

memory/3340-234-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/3340-196-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-189-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-185-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3340-176-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/3340-249-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/3340-172-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/3340-175-0x00000000017F0000-0x0000000001865000-memory.dmp

Download

memory/3340-166-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/3340-168-0x0000000001880000-0x0000000001AD5000-memory.dmp

Download

memory/3784-14-0x0000000000D30000-0x0000000001090000-memory.dmp

Download

memory/3784-15-0x0000000000C60000-0x0000000000CA5000-memory.dmp

Download

memory/3784-5-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/3988-285-0x0000000000940000-0x0000000000A41000-memory.dmp

Download

memory/3988-445-0x0000000000940000-0x0000000000A41000-memory.dmp

Download

memory/4120-465-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-463-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-453-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-442-0x0000000001140000-0x00000000013A3000-memory.dmp

Download

memory/4120-441-0x0000000072280000-0x00000000724E3000-memory.dmp

Download

memory/4120-459-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-469-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-461-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-462-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-449-0x0000000072280000-0x00000000724E3000-memory.dmp

Download

memory/4120-450-0x0000000001140000-0x00000000013A3000-memory.dmp

Download

memory/4120-452-0x0000000001140000-0x00000000011B5000-memory.dmp

Download

memory/4120-451-0x0000000072280000-0x00000000724E3000-memory.dmp

Download

memory/4120-460-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-464-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-467-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-466-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4120-468-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4568-0-0x0000000000100000-0x00000000001D9000-memory.dmp

Download

memory/4568-17-0x0000000000100000-0x00000000001D9000-memory.dmp

Download

memory/4852-278-0x00000000016F0000-0x0000000001765000-memory.dmp

Download

memory/4852-274-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/4852-273-0x00000000016F0000-0x0000000001765000-memory.dmp

Download

memory/4852-277-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/4852-266-0x0000000073EA0000-0x00000000740F5000-memory.dmp

Download

memory/4924-171-0x0000000000D20000-0x0000000000D65000-memory.dmp

Download