Resubmissions

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    152s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-01-2021 19:24

General

  • Target

    42f972925508a82236e8533567487761(1).exe

  • Size

    3MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Attributes
  • aes_key

    DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo

  • anti_detection

    true

  • autorun

    true

  • bdos

    false

  • delay

  • host

    sandyclark255.hopto.org

  • hwid

  • install_file

  • install_folder

    %AppData%

  • mutex

    adweqsds56332

  • pastebin_config

    null

  • port

    6606,8808,7707

  • version

    0.5.6A

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence ⋅ 2 TTPs 3 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload ⋅ 1 IoCs
  • Warzone RAT Payload ⋅ 3 IoCs
  • Disables RegEdit via registry modification
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory ⋅ 1 IoCs
  • Executes dropped EXE ⋅ 19 IoCs
  • Modifies Windows Firewall ⋅ 1 TTPs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file ⋅ 2 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext ⋅ 7 IoCs
  • Drops file in Windows directory ⋅ 1 IoCs
  • Program crash ⋅ 6 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 131 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 102 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 164 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe"
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:32
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        PID:2480
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          PID:2004
    • C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
      "C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe"
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:284
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 284
          Modifies WinLogon for persistence
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:2912
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:3448
    • C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
      "C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:1376
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        PID:2464
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          PID:748
        • C:\Users\Admin\Documents\excelsl.exe
          "C:\Users\Admin\Documents\excelsl.exe"
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:3544
          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
            Executes dropped EXE
            Adds Run key to start application
            Suspicious use of AdjustPrivilegeToken
            Suspicious use of SetWindowsHookEx
            PID:1124
            • C:\Windows\SysWOW64\notepad.exe
              notepad
              PID:2556
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1068
            Program crash
            PID:2388
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1040
            Suspicious use of NtCreateProcessExOtherParentProcess
            Program crash
            PID:2412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1068
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:1324
    • C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
      "C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe"
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:744
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
        Creates scheduled task(s)
        PID:3900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D58.tmp.bat""
        PID:8
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          Delays execution with timeout.exe
          PID:312
        • C:\Users\Admin\AppData\Roaming\prndrvest.exe
          "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
          Executes dropped EXE
          PID:1520
    • C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
      "C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
        "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        PID:3928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1068
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3164
    • C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
      "C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:416
      • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
        "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
        Executes dropped EXE
        PID:2652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1076
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3916
      • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
        "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
        Executes dropped EXE
        PID:644
    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
      Executes dropped EXE
      PID:3192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1584
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2768
    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
      Executes dropped EXE
      PID:3936

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                      MD5

                      9d2a888ca79e1ff3820882ea1d88d574

                      SHA1

                      112c38d80bf2c0d48256249bbabe906b834b1f66

                      SHA256

                      8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

                      SHA512

                      17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

                    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                      MD5

                      9d2a888ca79e1ff3820882ea1d88d574

                      SHA1

                      112c38d80bf2c0d48256249bbabe906b834b1f66

                      SHA256

                      8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

                      SHA512

                      17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

                    • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                      MD5

                      e87459f61fd1f017d4bd6b0a1a1fc86a

                      SHA1

                      30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                      SHA256

                      ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                      SHA512

                      dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                    • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                      MD5

                      e87459f61fd1f017d4bd6b0a1a1fc86a

                      SHA1

                      30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                      SHA256

                      ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                      SHA512

                      dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                    • C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
                      MD5

                      590acb5fa6b5c3001ebce3d67242aac4

                      SHA1

                      5df39906dc4e60f01b95783fc55af6128402d611

                      SHA256

                      7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                      SHA512

                      4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                    • C:\Users\Admin\AppData\Local\Temp\FmaukJ2K1Bmh5KdE.exe
                      MD5

                      590acb5fa6b5c3001ebce3d67242aac4

                      SHA1

                      5df39906dc4e60f01b95783fc55af6128402d611

                      SHA256

                      7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                      SHA512

                      4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                    • C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
                      MD5

                      f07d2c33e4afe36ec6f6f14f9a56e84a

                      SHA1

                      3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                      SHA256

                      309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                      SHA512

                      b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                    • C:\Users\Admin\AppData\Local\Temp\ILUGOhzA81LBewi0.exe
                      MD5

                      f07d2c33e4afe36ec6f6f14f9a56e84a

                      SHA1

                      3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                      SHA256

                      309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                      SHA512

                      b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                    • C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
                      MD5

                      9133c2a5ebf3e25aceae5a001ca6f279

                      SHA1

                      319f911282f3cded94de3730fa0abd5dec8f14be

                      SHA256

                      7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                      SHA512

                      1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                    • C:\Users\Admin\AppData\Local\Temp\InPeX2CdYyUbAcLA.exe
                      MD5

                      9133c2a5ebf3e25aceae5a001ca6f279

                      SHA1

                      319f911282f3cded94de3730fa0abd5dec8f14be

                      SHA256

                      7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                      SHA512

                      1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                      MD5

                      9133c2a5ebf3e25aceae5a001ca6f279

                      SHA1

                      319f911282f3cded94de3730fa0abd5dec8f14be

                      SHA256

                      7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                      SHA512

                      1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                      MD5

                      9133c2a5ebf3e25aceae5a001ca6f279

                      SHA1

                      319f911282f3cded94de3730fa0abd5dec8f14be

                      SHA256

                      7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                      SHA512

                      1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                      MD5

                      9133c2a5ebf3e25aceae5a001ca6f279

                      SHA1

                      319f911282f3cded94de3730fa0abd5dec8f14be

                      SHA256

                      7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                      SHA512

                      1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                      MD5

                      9133c2a5ebf3e25aceae5a001ca6f279

                      SHA1

                      319f911282f3cded94de3730fa0abd5dec8f14be

                      SHA256

                      7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                      SHA512

                      1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                    • C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
                      MD5

                      2819e45588024ba76f248a39d3e232ba

                      SHA1

                      08a797b87ecfbee682ce14d872177dae1a5a46a2

                      SHA256

                      b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                      SHA512

                      a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                    • C:\Users\Admin\AppData\Local\Temp\ULygfUIfmNSEzQdf.exe
                      MD5

                      2819e45588024ba76f248a39d3e232ba

                      SHA1

                      08a797b87ecfbee682ce14d872177dae1a5a46a2

                      SHA256

                      b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                      SHA512

                      a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                      MD5

                      f07d2c33e4afe36ec6f6f14f9a56e84a

                      SHA1

                      3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                      SHA256

                      309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                      SHA512

                      b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                      MD5

                      f07d2c33e4afe36ec6f6f14f9a56e84a

                      SHA1

                      3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                      SHA256

                      309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                      SHA512

                      b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                      MD5

                      f07d2c33e4afe36ec6f6f14f9a56e84a

                      SHA1

                      3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                      SHA256

                      309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                      SHA512

                      b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                    • C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\AppData\Local\Temp\gyjtWFykEqA0msjs.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
                      MD5

                      e87459f61fd1f017d4bd6b0a1a1fc86a

                      SHA1

                      30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                      SHA256

                      ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                      SHA512

                      dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                    • C:\Users\Admin\AppData\Local\Temp\lcNj3pHMkbO3HBih.exe
                      MD5

                      e87459f61fd1f017d4bd6b0a1a1fc86a

                      SHA1

                      30838d010aad8c9f3fd0fc302e71b4cbe6f138c0

                      SHA256

                      ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727

                      SHA512

                      dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2

                    • C:\Users\Admin\AppData\Local\Temp\tmp3D58.tmp.bat
                      MD5

                      ebd97833eda31663c742e55f90baa96b

                      SHA1

                      e5224c45647a85516db6adb080b3329e4d4ea7f7

                      SHA256

                      1ae69530efc098f3738011cc66fbca183170a5c17bec4045be0f3544ddf1d9ee

                      SHA512

                      ef3859c060c4c95a88312314635fa606d3f1a21ac8602c605038b98911cc639a5e33442369f78add69275cb790ddea26400fbccc546e57a7078622e3e357b811

                    • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                      MD5

                      1f15227774cb80a52bf37a00eae6049d

                      SHA1

                      b2b82dddbce6b91ae15637cfd4ba82643f4d62bc

                      SHA256

                      9f6bf9843d562cdf3f43b1e4cd5b3b4592733b86a546023afe8cc01799561541

                      SHA512

                      5f1fd5bb3f3423cb569207a57391187a66753a9d73d6d52917f7eb4e3e836248ed4044273e4ea88671f006dfc46f51b590e1f2d1a46aad226df00e20ffb5fd03

                    • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                      MD5

                      1f15227774cb80a52bf37a00eae6049d

                      SHA1

                      b2b82dddbce6b91ae15637cfd4ba82643f4d62bc

                      SHA256

                      9f6bf9843d562cdf3f43b1e4cd5b3b4592733b86a546023afe8cc01799561541

                      SHA512

                      5f1fd5bb3f3423cb569207a57391187a66753a9d73d6d52917f7eb4e3e836248ed4044273e4ea88671f006dfc46f51b590e1f2d1a46aad226df00e20ffb5fd03

                    • C:\Users\Admin\Documents\excelsl.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Users\Admin\Documents\excelsl.exe
                      MD5

                      3e804917c454ca31c1cbd602682542b7

                      SHA1

                      1df3e81b9d879e21af299f5478051b98f3cb7739

                      SHA256

                      f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                      SHA512

                      28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                    • C:\Windows\svehosts.exe
                      MD5

                      2819e45588024ba76f248a39d3e232ba

                      SHA1

                      08a797b87ecfbee682ce14d872177dae1a5a46a2

                      SHA256

                      b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                      SHA512

                      a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                    • C:\Windows\svehosts.exe
                      MD5

                      2819e45588024ba76f248a39d3e232ba

                      SHA1

                      08a797b87ecfbee682ce14d872177dae1a5a46a2

                      SHA256

                      b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                      SHA512

                      a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                    • memory/8-110-0x0000000000000000-mapping.dmp
                    • memory/32-23-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                    • memory/32-3-0x0000000000000000-mapping.dmp
                    • memory/284-54-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/284-43-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/284-44-0x000000000046A08C-mapping.dmp
                    • memory/312-112-0x0000000000000000-mapping.dmp
                    • memory/416-32-0x00000000015E0000-0x00000000015E1000-memory.dmp
                    • memory/416-13-0x0000000000000000-mapping.dmp
                    • memory/644-55-0x0000000000400000-0x0000000000554000-memory.dmp
                    • memory/644-61-0x0000000000400000-0x0000000000554000-memory.dmp
                    • memory/644-58-0x0000000000405CE2-mapping.dmp
                    • memory/744-12-0x0000000000000000-mapping.dmp
                    • memory/744-25-0x0000000000E30000-0x0000000000E31000-memory.dmp
                    • memory/744-40-0x0000000005973000-0x0000000005975000-memory.dmp
                    • memory/744-35-0x00000000019B0000-0x00000000019B1000-memory.dmp
                    • memory/744-64-0x0000000003130000-0x000000000313D000-memory.dmp
                    • memory/744-39-0x0000000005970000-0x0000000005971000-memory.dmp
                    • memory/744-90-0x000000000B290000-0x000000000B291000-memory.dmp
                    • memory/744-34-0x00000000057B0000-0x00000000057B1000-memory.dmp
                    • memory/744-31-0x0000000005D60000-0x0000000005D61000-memory.dmp
                    • memory/744-41-0x0000000005CE0000-0x0000000005CFD000-memory.dmp
                    • memory/744-106-0x000000000B6E0000-0x000000000B6E1000-memory.dmp
                    • memory/744-16-0x0000000070F60000-0x000000007164E000-memory.dmp
                    • memory/748-71-0x0000000000000000-mapping.dmp
                    • memory/748-72-0x0000000003180000-0x0000000003181000-memory.dmp
                    • memory/1124-94-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/1124-92-0x000000000048F888-mapping.dmp
                    • memory/1124-95-0x00000000028B0000-0x00000000028B1000-memory.dmp
                    • memory/1324-74-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
                    • memory/1324-70-0x00000000048A0000-0x00000000048A1000-memory.dmp
                    • memory/1376-9-0x0000000000000000-mapping.dmp
                    • memory/1376-30-0x00000000025D0000-0x00000000025D1000-memory.dmp
                    • memory/1520-116-0x0000000070FB0000-0x000000007169E000-memory.dmp
                    • memory/1520-113-0x0000000000000000-mapping.dmp
                    • memory/1520-122-0x00000000058E0000-0x00000000058E1000-memory.dmp
                    • memory/1520-123-0x00000000058E3000-0x00000000058E5000-memory.dmp
                    • memory/2004-108-0x0000000000000000-mapping.dmp
                    • memory/2388-100-0x0000000004280000-0x0000000004281000-memory.dmp
                    • memory/2388-99-0x0000000004280000-0x0000000004281000-memory.dmp
                    • memory/2412-103-0x0000000004D70000-0x0000000004D71000-memory.dmp
                    • memory/2464-67-0x000000000048F888-mapping.dmp
                    • memory/2464-77-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/2464-78-0x0000000001110000-0x0000000001111000-memory.dmp
                    • memory/2464-66-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/2480-73-0x0000000000000000-mapping.dmp
                    • memory/2480-79-0x0000000002E80000-0x0000000002E81000-memory.dmp
                    • memory/2556-97-0x0000000000000000-mapping.dmp
                    • memory/2556-98-0x00000000031D0000-0x00000000031D1000-memory.dmp
                    • memory/2612-2-0x0000000003150000-0x0000000003151000-memory.dmp
                    • memory/2768-36-0x0000000004540000-0x0000000004541000-memory.dmp
                    • memory/2768-37-0x0000000004540000-0x0000000004541000-memory.dmp
                    • memory/2836-27-0x0000000000910000-0x0000000000911000-memory.dmp
                    • memory/2836-6-0x0000000000000000-mapping.dmp
                    • memory/2912-48-0x0000000000000000-mapping.dmp
                    • memory/2912-56-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
                    • memory/3164-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
                    • memory/3192-24-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/3192-26-0x000000000048F888-mapping.dmp
                    • memory/3448-89-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/3448-87-0x000000000046A08C-mapping.dmp
                    • memory/3544-82-0x0000000000000000-mapping.dmp
                    • memory/3544-85-0x0000000002C60000-0x0000000002C61000-memory.dmp
                    • memory/3748-33-0x0000000002F60000-0x0000000002F61000-memory.dmp
                    • memory/3748-17-0x0000000000000000-mapping.dmp
                    • memory/3900-109-0x0000000000000000-mapping.dmp
                    • memory/3916-63-0x00000000043A0000-0x00000000043A1000-memory.dmp
                    • memory/3928-47-0x0000000000400000-0x000000000040F000-memory.dmp
                    • memory/3928-49-0x000000000040715C-mapping.dmp
                    • memory/3928-59-0x0000000000400000-0x000000000040F000-memory.dmp