Malware Analysis Report

2025-04-14 08:26

Sample ID 211021-w52hxaafb7
Target DRAFTCOPY-BILL-PDF309874847.js
SHA256 65a5df237d47b30ebe2f5b01c7e9e99e29d9d6ee14c2c6d718a538e4013c0a55
Tags
wshrat persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

65a5df237d47b30ebe2f5b01c7e9e99e29d9d6ee14c2c6d718a538e4013c0a55

Threat Level: Known bad

The file DRAFTCOPY-BILL-PDF309874847.js was found to be: Known bad.

Malicious Activity Summary

wshrat persistence trojan

WSHRAT

WSHRAT Payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Drops startup file

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-10-21 18:31

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-10-21 18:31

Reported

2021-10-21 18:33

Platform

win7-en-20211014

Max time kernel

143s

Max time network

143s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\DRAFTCOPY-BILL-PDF309874847.js

Signatures

WSHRAT

trojan wshrat

WSHRAT Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe N/A
N/A N/A C:\74800197\WHS2.0.exe N/A
N/A N/A C:\74800197\wcnaumia.pif N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\software\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\software\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 976 set thread context of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Windows\system32\wscript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Windows\system32\wscript.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Windows\system32\wscript.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 1528 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 2044 wrote to memory of 1528 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 2044 wrote to memory of 1528 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 2044 wrote to memory of 1528 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 1528 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 1528 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 1528 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 1528 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 1528 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 1528 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 1528 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 1528 wrote to memory of 976 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 976 wrote to memory of 780 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1964 wrote to memory of 1272 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 1964 wrote to memory of 1272 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 1964 wrote to memory of 1272 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 1964 wrote to memory of 1272 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 780 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 780 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 780 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 780 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\DRAFTCOPY-BILL-PDF309874847.js

C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe

"C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe"

C:\74800197\WHS2.0.exe

"C:\74800197\WHS2.0.exe" Community portal – Bulletin board,

C:\74800197\wcnaumia.pif

"C:\74800197\wcnaumia.pif" fhmoqoe.prw

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\EkoHX.vbs

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\OPAFu.vbs

Network

Country Destination Domain Proto
US 8.8.8.8:53 edufin-fcpcbiessimbabura.com.ec udp
US 144.208.68.94:443 edufin-fcpcbiessimbabura.com.ec tcp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 concideritdone.duckdns.org udp
US 8.8.8.8:53 concideritdone.duckdns.org udp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp

Files

memory/1528-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe

MD5 4fb831a65cce2392df4c5f792dad31e2
SHA1 887b24b866d5ad917273a3e8391ba785a5ba90a5
SHA256 2e4d9754a395aa51d9d35a6af209c4b041b8fa5c7fdad41bfc0df97d841091f6
SHA512 c2a2952741d4c045fe5a641bf7ff8ccfefa54608fa73a875eab00c74cc03464c2808c548df0a6abfeb52eeb2956fac0eecd67f2a4ab62a2f8d13613e670f20c5

memory/1528-57-0x0000000075191000-0x0000000075193000-memory.dmp

C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe

MD5 4fb831a65cce2392df4c5f792dad31e2
SHA1 887b24b866d5ad917273a3e8391ba785a5ba90a5
SHA256 2e4d9754a395aa51d9d35a6af209c4b041b8fa5c7fdad41bfc0df97d841091f6
SHA512 c2a2952741d4c045fe5a641bf7ff8ccfefa54608fa73a875eab00c74cc03464c2808c548df0a6abfeb52eeb2956fac0eecd67f2a4ab62a2f8d13613e670f20c5

\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

memory/1964-64-0x0000000000000000-mapping.dmp

C:\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

C:\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

memory/976-71-0x0000000000000000-mapping.dmp

C:\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

C:\74800197\fhmoqoe.prw

MD5 e75fbfd8862e84ee21bcb907cc2892b5
SHA1 4e9cfb118f78515f50f55f0db76d31cbeea2d5f7
SHA256 608eaa0d2ace789444e27bf7f5da436e6c9d5459fddcb9d7237d7c2cb93261b4
SHA512 310538d019cc1a363b97d4c2a14998aaa2984e5284aa046478bf19539bffb55e08e8c19272361f2146ada6195380741d874a20e11f729b54f956d87292d07b1b

memory/1964-76-0x00000000020E0000-0x00000000020E1000-memory.dmp

C:\74800197\vijppg.txt

MD5 808bdb5b8f93f34c6d64bb48283776ec
SHA1 e3f096b0ea493885ba3e1058594c2d48d4ea89c9
SHA256 799a62dc96ba037ccec9ca7a417a4c5428454a3f52c7b4444f728d79b5f06fd7
SHA512 97582524e55fbb90185dd4e5c8eb6ea5e1a57aa5354278878786881593ef2bd85f3fba8ef6a94d89b8f9dc14c07ee85553e58fa00dd64adfe73d954f3a4af0ff

C:\74800197\envmhh.cos

MD5 80eee5b692798640be0b6d0ca2f8768c
SHA1 c39d4b5b048194ef1acdecc8b7cab27e63bc0402
SHA256 9b6c1dad4b42a308e4fade72da97589161c7cc37c5d926353f216e1903ec9780
SHA512 c587cc27b96fa66a1188947b85f9f27ea61e502e21456411536f48e533377e80301a4fe82eba451d82c1d12b9c5368336d166542d44f12b990a73d10382612d8

memory/780-79-0x00000000003F0000-0x0000000000B37000-memory.dmp

memory/780-80-0x00000000003F0000-0x0000000000B37000-memory.dmp

memory/780-81-0x00000000004742AE-mapping.dmp

memory/1272-82-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\EkoHX.vbs

MD5 952b1cbd78885f81760a77dc3b453fd3
SHA1 4af75b46620b063fc23652c3ecaa3b4081074572
SHA256 fe3f15e4a3d59457c16fb955e38be8df4bfe3a0978a2b09c85705f14bb6d751d
SHA512 1d6f2f6d91f88725b9515b2877348616dee3d96b862014f6c6b54f41b18835483cdf5b6294e99e0fdff17d80d79b27ac70638cab6376b15526b87b592313b837

memory/780-84-0x00000000003F0000-0x0000000000B37000-memory.dmp

memory/1680-87-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\OPAFu.vbs

MD5 952b1cbd78885f81760a77dc3b453fd3
SHA1 4af75b46620b063fc23652c3ecaa3b4081074572
SHA256 fe3f15e4a3d59457c16fb955e38be8df4bfe3a0978a2b09c85705f14bb6d751d
SHA512 1d6f2f6d91f88725b9515b2877348616dee3d96b862014f6c6b54f41b18835483cdf5b6294e99e0fdff17d80d79b27ac70638cab6376b15526b87b592313b837

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KC94CCU5\json[1].json

MD5 0c17abb0ed055fecf0c48bb6e46eb4eb
SHA1 a692730c8ec7353c31b94a888f359edb54aaa4c8
SHA256 f41e99f954e33e7b0e39930ec8620bf29801efc44275c1ee6b5cfa5e1be202c0
SHA512 645a9f2f94461d8a187261b736949df398ece5cfbf1af8653d18d3487ec1269d9f565534c1e249c12f31b3b1a41a8512953b1e991b001fc1360059e3fd494ec3

Analysis: behavioral2

Detonation Overview

Submitted

2021-10-21 18:31

Reported

2021-10-21 18:33

Platform

win10-en-20210920

Max time kernel

135s

Max time network

149s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\DRAFTCOPY-BILL-PDF309874847.js

Signatures

WSHRAT

trojan wshrat

WSHRAT Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe N/A
N/A N/A C:\74800197\WHS2.0.exe N/A
N/A N/A C:\74800197\wcnaumia.pif N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EkoHX.vbs C:\Windows\SysWOW64\wscript.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OPAFu.vbs C:\Windows\SysWOW64\wscript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\software\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OPAFu = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\OPAFu.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\software\microsoft\windows\currentversion\run C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\EkoHX = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\EkoHX.vbs\"" C:\Windows\SysWOW64\wscript.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4560 set thread context of 1640 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Windows\system32\wscript.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Windows\system32\wscript.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4060 wrote to memory of 728 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 4060 wrote to memory of 728 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 4060 wrote to memory of 728 N/A C:\Windows\system32\wscript.exe C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe
PID 728 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 728 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 728 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\WHS2.0.exe
PID 728 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 728 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 728 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe C:\74800197\wcnaumia.pif
PID 3232 wrote to memory of 912 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 3232 wrote to memory of 912 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 3232 wrote to memory of 912 N/A C:\74800197\WHS2.0.exe C:\Windows\SysWOW64\wscript.exe
PID 4560 wrote to memory of 1640 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4560 wrote to memory of 1640 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4560 wrote to memory of 1640 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4560 wrote to memory of 1640 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4560 wrote to memory of 1640 N/A C:\74800197\wcnaumia.pif C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1640 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 1640 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe
PID 1640 wrote to memory of 1976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\wscript.exe

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\DRAFTCOPY-BILL-PDF309874847.js

C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe

"C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe"

C:\74800197\WHS2.0.exe

"C:\74800197\WHS2.0.exe" Community portal – Bulletin board,

C:\74800197\wcnaumia.pif

"C:\74800197\wcnaumia.pif" fhmoqoe.prw

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\EkoHX.vbs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\wscript.exe

"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Roaming\OPAFu.vbs

Network

Country Destination Domain Proto
US 8.8.8.8:53 edufin-fcpcbiessimbabura.com.ec udp
US 144.208.68.94:443 edufin-fcpcbiessimbabura.com.ec tcp
US 8.8.8.8:53 time.windows.com udp
NL 20.101.57.9:123 time.windows.com udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 concideritdone.duckdns.org udp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 208.95.112.1:80 ip-api.com tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp
US 156.96.151.237:5001 concideritdone.duckdns.org tcp

Files

memory/728-115-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe

MD5 4fb831a65cce2392df4c5f792dad31e2
SHA1 887b24b866d5ad917273a3e8391ba785a5ba90a5
SHA256 2e4d9754a395aa51d9d35a6af209c4b041b8fa5c7fdad41bfc0df97d841091f6
SHA512 c2a2952741d4c045fe5a641bf7ff8ccfefa54608fa73a875eab00c74cc03464c2808c548df0a6abfeb52eeb2956fac0eecd67f2a4ab62a2f8d13613e670f20c5

C:\Users\Admin\AppData\Roaming\DRAFTCOPY-BILL-PDF309874847.exe

MD5 4fb831a65cce2392df4c5f792dad31e2
SHA1 887b24b866d5ad917273a3e8391ba785a5ba90a5
SHA256 2e4d9754a395aa51d9d35a6af209c4b041b8fa5c7fdad41bfc0df97d841091f6
SHA512 c2a2952741d4c045fe5a641bf7ff8ccfefa54608fa73a875eab00c74cc03464c2808c548df0a6abfeb52eeb2956fac0eecd67f2a4ab62a2f8d13613e670f20c5

memory/3232-118-0x0000000000000000-mapping.dmp

C:\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

memory/4560-120-0x0000000000000000-mapping.dmp

C:\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

C:\74800197\wcnaumia.pif

MD5 1d7071dd5cda216508b235c0e2318b05
SHA1 0b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256 788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA512 65965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118

C:\74800197\WHS2.0.exe

MD5 40acb53d42e4b4d20a0111e6dd847606
SHA1 d010be1ba9ceea60098bebbfee425c0cda66b9a2
SHA256 213d841404449d68dd9f50c18f7259074c43df2fd5221f0bbd34d2e89b611b73
SHA512 a7834c27ab5e432a9243376fc7b058e819c56290580f96c28dcd61ca6356d4a7507f907373635cfec933c2fb916cbd07abb50ef39b7b1416c665c77b3930794d

C:\74800197\fhmoqoe.prw

MD5 e75fbfd8862e84ee21bcb907cc2892b5
SHA1 4e9cfb118f78515f50f55f0db76d31cbeea2d5f7
SHA256 608eaa0d2ace789444e27bf7f5da436e6c9d5459fddcb9d7237d7c2cb93261b4
SHA512 310538d019cc1a363b97d4c2a14998aaa2984e5284aa046478bf19539bffb55e08e8c19272361f2146ada6195380741d874a20e11f729b54f956d87292d07b1b

memory/3232-125-0x00000000029D0000-0x00000000029D1000-memory.dmp

memory/912-126-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\EkoHX.vbs

MD5 952b1cbd78885f81760a77dc3b453fd3
SHA1 4af75b46620b063fc23652c3ecaa3b4081074572
SHA256 fe3f15e4a3d59457c16fb955e38be8df4bfe3a0978a2b09c85705f14bb6d751d
SHA512 1d6f2f6d91f88725b9515b2877348616dee3d96b862014f6c6b54f41b18835483cdf5b6294e99e0fdff17d80d79b27ac70638cab6376b15526b87b592313b837

C:\74800197\vijppg.txt

MD5 808bdb5b8f93f34c6d64bb48283776ec
SHA1 e3f096b0ea493885ba3e1058594c2d48d4ea89c9
SHA256 799a62dc96ba037ccec9ca7a417a4c5428454a3f52c7b4444f728d79b5f06fd7
SHA512 97582524e55fbb90185dd4e5c8eb6ea5e1a57aa5354278878786881593ef2bd85f3fba8ef6a94d89b8f9dc14c07ee85553e58fa00dd64adfe73d954f3a4af0ff

C:\74800197\envmhh.cos

MD5 80eee5b692798640be0b6d0ca2f8768c
SHA1 c39d4b5b048194ef1acdecc8b7cab27e63bc0402
SHA256 9b6c1dad4b42a308e4fade72da97589161c7cc37c5d926353f216e1903ec9780
SHA512 c587cc27b96fa66a1188947b85f9f27ea61e502e21456411536f48e533377e80301a4fe82eba451d82c1d12b9c5368336d166542d44f12b990a73d10382612d8

memory/1640-130-0x0000000000700000-0x0000000000BE5000-memory.dmp

memory/1640-131-0x00000000007842AE-mapping.dmp

memory/1976-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\OPAFu.vbs

MD5 952b1cbd78885f81760a77dc3b453fd3
SHA1 4af75b46620b063fc23652c3ecaa3b4081074572
SHA256 fe3f15e4a3d59457c16fb955e38be8df4bfe3a0978a2b09c85705f14bb6d751d
SHA512 1d6f2f6d91f88725b9515b2877348616dee3d96b862014f6c6b54f41b18835483cdf5b6294e99e0fdff17d80d79b27ac70638cab6376b15526b87b592313b837

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HBPS4WXS\json[1].json

MD5 149c2823b7eadbfb0a82388a2ab9494f
SHA1 415fe979ce5fd0064d2557a48745a3ed1a3fbf9c
SHA256 06fa5d4e7fbfb1efdc19baa034601a894b21cf729785732853ced4bb40aca869
SHA512 f8fb6b7c93c4ab37f6e250ba8ac5c82f6e17fe52156cab81d34e91107d1da716b744bfe02ee0306497a3876d5352af789a1e66dab10e11e22065bac3050475fe

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY8D4S7I\json[1].json

MD5 149c2823b7eadbfb0a82388a2ab9494f
SHA1 415fe979ce5fd0064d2557a48745a3ed1a3fbf9c
SHA256 06fa5d4e7fbfb1efdc19baa034601a894b21cf729785732853ced4bb40aca869
SHA512 f8fb6b7c93c4ab37f6e250ba8ac5c82f6e17fe52156cab81d34e91107d1da716b744bfe02ee0306497a3876d5352af789a1e66dab10e11e22065bac3050475fe