gh0strat | 414d68f1148a3b596cef9291ebd25582017349216f259819c4d7c6c66dc4384d

General

Target

data.exe
Size

121KB
MD5

ecffbccad6aecd736cbc7e9ba525a00a
SHA1

195636cf0307fd7e56c4254bba6a500c5421b934
SHA256

313ee6496bf01e9b17d76081ebe76efd04c6fc056ff9749cfff960a00fe36299
SHA512

d7d3f7c60b3045fe109b40b5d18a3348eb25da2f7dc2832dc7855e66de714b1c40963e3a9b138df3aabfd3fc4ddac5731221037c171e5b85634ed7d847e23de5

Score

10^/10

gh0strat ramnit banker persistence rat spyware stealer trojan upx worm

Malware Config

Signatures

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral8/memory/444-150-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral8/memory/444-149-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral8/memory/444-155-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 3 IoCs

Processes:

UnRARSrv.exeDesktopLayer.exefun.exe

pid process

4400 UnRARSrv.exe
4352 DesktopLayer.exe
444 fun.exe

pid	process
4400	UnRARSrv.exe
4352	DesktopLayer.exe
444	fun.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral8/memory/4352-140-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral8/memory/4400-137-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral8/memory/4352-141-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fun.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	fun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX00587F8E = "C:\\Windows\\XXXXXX00587F8E\\svchsot.exe"	fun.exe

Drops file in Program Files directory 3 IoCs

Processes:

UnRARSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxF542.tmp	UnRARSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	UnRARSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	UnRARSrv.exe

Drops file in Windows directory 1 IoCs

Processes:

fun.exe

description ioc process

File created C:\Windows\XXXXXX00587F8E\JH.BAT fun.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4456 sc.exe

description	ioc	process
File created	C:\Windows\XXXXXX00587F8E\JH.BAT	fun.exe

pid	process
4456	sc.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3603509401"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FCB60CC1-FEC4-11EC-B274-7E9F925D3B67} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364053233"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3603509401"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30970577"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30970577"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

DesktopLayer.exefun.exe

pid	process
4352	DesktopLayer.exe
4352	DesktopLayer.exe
4352	DesktopLayer.exe
4352	DesktopLayer.exe
4352	DesktopLayer.exe
4352	DesktopLayer.exe
4352	DesktopLayer.exe
4352	DesktopLayer.exe
444	fun.exe
444	fun.exe
444	fun.exe
444	fun.exe
444	fun.exe
444	fun.exe
444	fun.exe
444	fun.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4288 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4288 iexplore.exe
4288 iexplore.exe
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE
2024 IEXPLORE.EXE

pid	process
4288	iexplore.exe

pid	process
4288	iexplore.exe
4288	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

data.execmd.exeUnRAR.exeUnRARSrv.exeDesktopLayer.exeiexplore.execmd.exefun.execmd.exenet.exe

description	pid	process	target process
PID 2252 wrote to memory of 4736	2252	data.exe	cmd.exe
PID 2252 wrote to memory of 4736	2252	data.exe	cmd.exe
PID 2252 wrote to memory of 4736	2252	data.exe	cmd.exe
PID 4736 wrote to memory of 1016	4736	cmd.exe	UnRAR.exe
PID 4736 wrote to memory of 1016	4736	cmd.exe	UnRAR.exe
PID 4736 wrote to memory of 1016	4736	cmd.exe	UnRAR.exe
PID 1016 wrote to memory of 4400	1016	UnRAR.exe	UnRARSrv.exe
PID 1016 wrote to memory of 4400	1016	UnRAR.exe	UnRARSrv.exe
PID 1016 wrote to memory of 4400	1016	UnRAR.exe	UnRARSrv.exe
PID 4400 wrote to memory of 4352	4400	UnRARSrv.exe	DesktopLayer.exe
PID 4400 wrote to memory of 4352	4400	UnRARSrv.exe	DesktopLayer.exe
PID 4400 wrote to memory of 4352	4400	UnRARSrv.exe	DesktopLayer.exe
PID 4352 wrote to memory of 4288	4352	DesktopLayer.exe	iexplore.exe
PID 4352 wrote to memory of 4288	4352	DesktopLayer.exe	iexplore.exe
PID 4288 wrote to memory of 2024	4288	iexplore.exe	IEXPLORE.EXE
PID 4288 wrote to memory of 2024	4288	iexplore.exe	IEXPLORE.EXE
PID 4288 wrote to memory of 2024	4288	iexplore.exe	IEXPLORE.EXE
PID 2252 wrote to memory of 4444	2252	data.exe	cmd.exe
PID 2252 wrote to memory of 4444	2252	data.exe	cmd.exe
PID 2252 wrote to memory of 4444	2252	data.exe	cmd.exe
PID 4444 wrote to memory of 444	4444	cmd.exe	fun.exe
PID 4444 wrote to memory of 444	4444	cmd.exe	fun.exe
PID 4444 wrote to memory of 444	4444	cmd.exe	fun.exe
PID 444 wrote to memory of 4428	444	fun.exe	cmd.exe
PID 444 wrote to memory of 4428	444	fun.exe	cmd.exe
PID 444 wrote to memory of 4428	444	fun.exe	cmd.exe
PID 4428 wrote to memory of 3344	4428	cmd.exe	schtasks.exe
PID 4428 wrote to memory of 3344	4428	cmd.exe	schtasks.exe
PID 4428 wrote to memory of 3344	4428	cmd.exe	schtasks.exe
PID 4428 wrote to memory of 4456	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 4456	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 4456	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 4164	4428	cmd.exe	net.exe
PID 4428 wrote to memory of 4164	4428	cmd.exe	net.exe
PID 4428 wrote to memory of 4164	4428	cmd.exe	net.exe
PID 4164 wrote to memory of 4792	4164	net.exe	net1.exe
PID 4164 wrote to memory of 4792	4164	net.exe	net1.exe
PID 4164 wrote to memory of 4792	4164	net.exe	net1.exe
PID 4428 wrote to memory of 2332	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2332	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2332	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 1728	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 1728	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 1728	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 4712	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 4712	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 4712	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2328	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2328	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2328	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2276	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2276	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2276	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 4076	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 4076	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 4076	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 3088	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 3088	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 3088	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 992	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 992	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 992	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2248	4428	cmd.exe	at.exe
PID 4428 wrote to memory of 2248	4428	cmd.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\data.exe
"C:\Users\Admin\AppData\Local\Temp\data.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c unrar e -p03DFF56238E52E88 -y pack.rar
2⤵
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Local\Temp\UnRAR.exe
unrar e -p03DFF56238E52E88 -y pack.rar
3⤵
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4400

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4288 CREDAT:17410 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start fun.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Users\Admin\AppData\Local\Temp\fun.exe
fun.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\XXXXXX00587F8E\JH.BAT
4⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn * /f
5⤵
PID:3344

C:\Windows\SysWOW64\sc.exe
sc config Schedule start= auto
5⤵
- Launches sc.exe
PID:4456

C:\Windows\SysWOW64\net.exe
net start "Task Scheduler"
5⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "Task Scheduler"
6⤵
PID:4792

C:\Windows\SysWOW64\at.exe
At 0:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2332

C:\Windows\SysWOW64\at.exe
At 1:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1728

C:\Windows\SysWOW64\at.exe
At 2:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:4712

C:\Windows\SysWOW64\at.exe
At 3:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2328

C:\Windows\SysWOW64\at.exe
At 4:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2276

C:\Windows\SysWOW64\at.exe
At 5:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:4076

C:\Windows\SysWOW64\at.exe
At 6:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:3088

C:\Windows\SysWOW64\at.exe
At 7:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:992

C:\Windows\SysWOW64\at.exe
At 8:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2248

C:\Windows\SysWOW64\at.exe
At 9:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1224

C:\Windows\SysWOW64\at.exe
At 10:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:3628

C:\Windows\SysWOW64\at.exe
At 11:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:456

C:\Windows\SysWOW64\at.exe
At 12:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1960

C:\Windows\SysWOW64\at.exe
At 13:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:644

C:\Windows\SysWOW64\at.exe
At 14:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2044

C:\Windows\SysWOW64\at.exe
At 15:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2584

C:\Windows\SysWOW64\at.exe
At 16:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2628

C:\Windows\SysWOW64\at.exe
At 17:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1240

C:\Windows\SysWOW64\at.exe
At 18:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2072

C:\Windows\SysWOW64\at.exe
At 19:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:4748

C:\Windows\SysWOW64\at.exe
At 20:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:4836

C:\Windows\SysWOW64\at.exe
At 21:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1320

C:\Windows\SysWOW64\at.exe
At 22:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1644

C:\Windows\SysWOW64\at.exe
At 23:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:3748

C:\Windows\SysWOW64\at.exe
At 24:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fun.exe
Filesize
183KB

MD5
e30a6a423ed21d7106fd5433cf72c023

SHA1
abeae0fcc61080fbed7cd23684bf66d28ae33b86

SHA256
0d40c508008ccd5f9fbd5965f997f98ae00a3e94b1d0bc1fcc617fe9826023d4

SHA512
cec97a26d9922a1871605afe6af7c2cecf413c93f58d2cd54d10f7d7f1558b25e5cf6b067c4a84bae81b547970cbd9f13b2245e7b44cdec922a0360e9c7b6d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fun.exe
Filesize
183KB

MD5
e30a6a423ed21d7106fd5433cf72c023

SHA1
abeae0fcc61080fbed7cd23684bf66d28ae33b86

SHA256
0d40c508008ccd5f9fbd5965f997f98ae00a3e94b1d0bc1fcc617fe9826023d4

SHA512
cec97a26d9922a1871605afe6af7c2cecf413c93f58d2cd54d10f7d7f1558b25e5cf6b067c4a84bae81b547970cbd9f13b2245e7b44cdec922a0360e9c7b6d1e

Download Submit
C:\Windows\XXXXXX00587F8E\JH.BAT
Filesize
1KB

MD5
771de19c28cde1d4a7d632b46a3b0e14

SHA1
33193cd299a3df198db951f61ffe1c7db11bd865

SHA256
f8aff1d929ced28db09fc4e08c89d4b5c214353ba93235a87ee3e4c340713d59

SHA512
311d9be5371b992f35d64cc15956e880cefb42faf6c6a4ca0c980bb77d960a801533c021c92db1f6747470ead65717ee043b533c3b279896e116f3c635a08397

Download Submit
memory/444-155-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/444-149-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/444-150-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/444-147-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/444-144-0x0000000000000000-mapping.dmp

Download
memory/456-170-0x0000000000000000-mapping.dmp

Download
memory/644-172-0x0000000000000000-mapping.dmp

Download
memory/992-166-0x0000000000000000-mapping.dmp

Download
memory/1016-142-0x0000000000980000-0x00000000009EF000-memory.dmp

Filesize
444KB

Download
memory/1016-131-0x0000000000000000-mapping.dmp

Download
memory/1016-139-0x0000000000980000-0x00000000009EF000-memory.dmp

Filesize
444KB

Download
memory/1224-168-0x0000000000000000-mapping.dmp

Download
memory/1240-176-0x0000000000000000-mapping.dmp

Download
memory/1320-180-0x0000000000000000-mapping.dmp

Download
memory/1644-181-0x0000000000000000-mapping.dmp

Download
memory/1728-160-0x0000000000000000-mapping.dmp

Download
memory/1960-171-0x0000000000000000-mapping.dmp

Download
memory/2044-173-0x0000000000000000-mapping.dmp

Download
memory/2072-177-0x0000000000000000-mapping.dmp

Download
memory/2248-167-0x0000000000000000-mapping.dmp

Download
memory/2276-163-0x0000000000000000-mapping.dmp

Download
memory/2328-162-0x0000000000000000-mapping.dmp

Download
memory/2332-159-0x0000000000000000-mapping.dmp

Download
memory/2584-174-0x0000000000000000-mapping.dmp

Download
memory/2628-175-0x0000000000000000-mapping.dmp

Download
memory/3000-183-0x0000000000000000-mapping.dmp

Download
memory/3088-165-0x0000000000000000-mapping.dmp

Download
memory/3344-154-0x0000000000000000-mapping.dmp

Download
memory/3628-169-0x0000000000000000-mapping.dmp

Download
memory/3748-182-0x0000000000000000-mapping.dmp

Download
memory/4076-164-0x0000000000000000-mapping.dmp

Download
memory/4164-157-0x0000000000000000-mapping.dmp

Download
memory/4352-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4352-141-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4352-135-0x0000000000000000-mapping.dmp

Download
memory/4400-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4400-132-0x0000000000000000-mapping.dmp

Download
memory/4428-152-0x0000000000000000-mapping.dmp

Download
memory/4444-143-0x0000000000000000-mapping.dmp

Download
memory/4456-156-0x0000000000000000-mapping.dmp

Download
memory/4712-161-0x0000000000000000-mapping.dmp

Download
memory/4736-130-0x0000000000000000-mapping.dmp

Download
memory/4748-178-0x0000000000000000-mapping.dmp

Download
memory/4792-158-0x0000000000000000-mapping.dmp

Download
memory/4836-179-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads