Malware Analysis Report

2024-10-23 17:13

Sample ID 210616-t4m33rsm7a
Target 0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0
SHA256 0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0
Tags
njrat taurus batvoi evasion persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0

Threat Level: Known bad

The file 0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0 was found to be: Known bad.

Malicious Activity Summary

njrat taurus batvoi evasion persistence spyware stealer trojan

Taurus Stealer

Taurus Stealer Payload

njRAT/Bladabindi

Modifies Windows Firewall

Executes dropped EXE

Loads dropped DLL

Drops startup file

Checks BIOS information in registry

Accesses 2FA software files, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-06-16 07:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-06-16 07:12

Reported

2021-06-16 07:16

Platform

win7v20210410

Max time kernel

150s

Max time network

187s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe"

Signatures

Taurus Stealer

trojan stealer taurus

Taurus Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\MRGO.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\MRGO.EXE N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0de45b5c6627a3e65a4b2a1e68ec841b.exe C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0de45b5c6627a3e65a4b2a1e68ec841b.exe C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A

Accesses 2FA software files, possible credential harvesting

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\0de45b5c6627a3e65a4b2a1e68ec841b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WMI Performance Reverse Adapters.exe\" .." C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0de45b5c6627a3e65a4b2a1e68ec841b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WMI Performance Reverse Adapters.exe\" .." C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1784 set thread context of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\system32\WerFault.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WerFault.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1836 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
PID 1836 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
PID 1836 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
PID 1836 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
PID 1836 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 1836 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 1836 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 1836 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 1836 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 1836 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 1836 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 1836 wrote to memory of 1784 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 1940 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 1940 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 1940 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 1940 wrote to memory of 340 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 340 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 340 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 340 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 340 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 1120 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\MRGO.EXE C:\Windows\system32\WerFault.exe
PID 1120 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\MRGO.EXE C:\Windows\system32\WerFault.exe
PID 1120 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\MRGO.EXE C:\Windows\system32\WerFault.exe
PID 1784 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe

"C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe"

C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

"C:\Users\Admin\AppData\Local\Temp\MRGO.EXE"

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

"C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE"

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

"C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE"

C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

"C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe" "WMI Performance Reverse Adapters.exe" ENABLE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 1120 -s 680

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 1368.vnh.wtf udp
N/A 103.89.91.133:5552 1368.vnh.wtf tcp
N/A 8.8.8.8:53 cracked.to udp
N/A 172.67.73.245:443 cracked.to tcp
N/A 172.67.73.245:443 cracked.to tcp
N/A 8.8.8.8:53 funpet.uk udp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp

Files

memory/1836-60-0x00000000757D1000-0x00000000757D3000-memory.dmp

\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

memory/1120-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

MD5 5375abc86290f5c3ffa86d4129e4bd27
SHA1 a1a3b2165549bd4c34985d3a230f8304202926ab
SHA256 c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f
SHA512 f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

memory/1940-66-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

memory/1784-68-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

MD5 5375abc86290f5c3ffa86d4129e4bd27
SHA1 a1a3b2165549bd4c34985d3a230f8304202926ab
SHA256 c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f
SHA512 f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

MD5 5375abc86290f5c3ffa86d4129e4bd27
SHA1 a1a3b2165549bd4c34985d3a230f8304202926ab
SHA256 c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f
SHA512 f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

memory/1940-74-0x0000000000340000-0x0000000000341000-memory.dmp

memory/1784-76-0x0000000000930000-0x0000000000931000-memory.dmp

memory/1784-78-0x00000000008F0000-0x0000000000930000-memory.dmp

memory/1784-79-0x00000000003A0000-0x00000000003B9000-memory.dmp

memory/1784-80-0x00000000044B0000-0x00000000044B1000-memory.dmp

\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

memory/340-82-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

memory/340-85-0x0000000000050000-0x0000000000051000-memory.dmp

memory/1556-87-0x0000000000000000-mapping.dmp

memory/340-89-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

memory/1784-90-0x0000000000420000-0x0000000000426000-memory.dmp

memory/1608-91-0x0000000000000000-mapping.dmp

memory/1608-92-0x000007FEFBDA1000-0x000007FEFBDA3000-memory.dmp

\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

memory/1608-96-0x0000000001D70000-0x0000000001D71000-memory.dmp

memory/832-97-0x0000000000400000-0x0000000000437000-memory.dmp

memory/832-98-0x000000000041CEE8-mapping.dmp

memory/832-100-0x0000000000400000-0x0000000000437000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-06-16 07:12

Reported

2021-06-16 07:16

Platform

win10v20210408

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe"

Signatures

Taurus Stealer

trojan stealer taurus

Taurus Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\MRGO.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\MRGO.EXE N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0de45b5c6627a3e65a4b2a1e68ec841b.exe C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0de45b5c6627a3e65a4b2a1e68ec841b.exe C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A

Accesses 2FA software files, possible credential harvesting

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\0de45b5c6627a3e65a4b2a1e68ec841b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WMI Performance Reverse Adapters.exe\" .." C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0de45b5c6627a3e65a4b2a1e68ec841b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WMI Performance Reverse Adapters.exe\" .." C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2468 set thread context of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 852 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
PID 852 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\MRGO.EXE
PID 852 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 852 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 852 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE
PID 852 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 852 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 852 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE
PID 3600 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 3600 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 3600 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe
PID 2208 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 2208 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 2208 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe C:\Windows\SysWOW64\netsh.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
PID 2468 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe

"C:\Users\Admin\AppData\Local\Temp\0c9e45bf4ffe549dddd3c0735fee3bfee13bb8fa795ac3831ea7cf657dd19dd0.exe"

C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

"C:\Users\Admin\AppData\Local\Temp\MRGO.EXE"

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

"C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE"

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

"C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE"

C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

"C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe" "WMI Performance Reverse Adapters.exe" ENABLE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 1368.vnh.wtf udp
N/A 103.89.91.133:5552 1368.vnh.wtf tcp
N/A 8.8.8.8:53 funpet.uk udp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp
N/A 118.27.4.18:80 funpet.uk tcp

Files

memory/3676-114-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

memory/3600-116-0x0000000000000000-mapping.dmp

memory/2468-118-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

MD5 5375abc86290f5c3ffa86d4129e4bd27
SHA1 a1a3b2165549bd4c34985d3a230f8304202926ab
SHA256 c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f
SHA512 f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

C:\Users\Admin\AppData\Local\Temp\MRGO.EXE

MD5 9a6a87cffd1c2f6c4f7f86ccc23b8c79
SHA1 7daccbbc9c9165451fd3d5d4edd2c58db1cf26f2
SHA256 3bc300c1fbad940dcefdca5f8cb0907656a7615de8517421b12def81c20fab39
SHA512 a4cf85fcb827422d21ee33e8de8b5be348b7aaa1cb43c930b1dc0de61acd18201fd0e805a541af22be3e09076c98a46d86c81fd01d34b2c3fe5d4bc2cb4419b7

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADPIRE.EXE

MD5 5375abc86290f5c3ffa86d4129e4bd27
SHA1 a1a3b2165549bd4c34985d3a230f8304202926ab
SHA256 c499e93433a8ff462799108ac5462ce05fa93bf716f3723fbccb7ff13dbebb9f
SHA512 f951acf23e5576fae983fd805a32eebea95966c74ffffd99bbd6de17d2e5db0db9b282c242d00e5515b4d67d885f09c749fae09aece26275f17f0d20670b6709

C:\Users\Admin\AppData\Local\Temp\WMI PERFORMANCE REVERSE ADAPTER.EXE

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

memory/3600-123-0x0000000000920000-0x0000000000921000-memory.dmp

memory/2468-124-0x00000000007C0000-0x00000000007C1000-memory.dmp

memory/3600-127-0x0000000005160000-0x0000000005161000-memory.dmp

memory/3600-128-0x0000000005750000-0x0000000005751000-memory.dmp

memory/2468-130-0x00000000050C0000-0x00000000050C1000-memory.dmp

memory/2468-132-0x0000000005020000-0x0000000005060000-memory.dmp

memory/2468-133-0x0000000005070000-0x0000000005089000-memory.dmp

memory/2468-134-0x00000000050C0000-0x00000000055BE000-memory.dmp

memory/2208-135-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

C:\Users\Admin\AppData\Local\Temp\WMI Performance Reverse Adapters.exe

MD5 870a6f849d1e8f3297d3d947de1d3dda
SHA1 2f618fdf99aa8b94c7ef34fe93f73fce8afeaf97
SHA256 b94a72f37633262bc036a0ff29cdd2ec4f6f26ea3dee357ef727defeffcea39b
SHA512 f3cbf80e3b5200bc926b098840230189c15dcd7cd81792fa3461de5c999f83f352a5529db3c3fc045e43110c9e35d8676bdb3343597663f17dfd840e503adad7

memory/3280-142-0x0000000000000000-mapping.dmp

memory/2208-144-0x0000000005420000-0x00000000054BC000-memory.dmp

memory/2208-145-0x0000000005630000-0x0000000005631000-memory.dmp

memory/2208-146-0x0000000005880000-0x0000000005881000-memory.dmp

memory/2468-147-0x00000000052E0000-0x00000000052E6000-memory.dmp

memory/2468-148-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

memory/1820-149-0x0000000000400000-0x0000000000437000-memory.dmp

memory/1820-150-0x000000000041CEE8-mapping.dmp

memory/1820-151-0x0000000000400000-0x0000000000437000-memory.dmp