nanocore | a2f3ffda7ff60101962f01bf24faeb3537edb6cbf7670dfdc9f62ed3ee65fbea

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16/11/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f73719885ad1f1beafd8f6b9589fd47.exe
Size 1.6MB
Sample221116-vs4xtscb66
SHA256 a2f3ffda7ff60101962f01bf24faeb3537edb6cbf7670dfdc9f62ed3ee65fbea
MD5 3f73719885ad1f1beafd8f6b9589fd47
SHA1 e358eaa4d1c4746fd3e245491071f4d4078535ba
SHA512 6cb9b819025ef833dc6b4d89e50e2d20e41d4b2b0c5f902e8dcf7794de1950e7fa11780d0dcdb9fd3ca4f6a8caabebf9ec4cbdfb7ffc5d8c515a1b184220f3ae
SSDEEP 24576:7AOcZ5xrfuMjeW3nuBdHyPQvTqm9t0v1fbb3cvV9u02gzf3hLuwkuhaJa:dKfuzW1PQvTR9uv5bzk+Yvh7aw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nanocore wshrat evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

concideritdone.duckdns.org:6969
127.0.0.1:6969

Mutex

60bc481c-f4fd-43f5-954e-1dbff9fbcd0c

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2022-08-24T00:38:50.973861436Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
6969
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
60bc481c-f4fd-43f5-954e-1dbff9fbcd0c
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
concideritdone.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

wshrat

http://newmoney2033.duckdns.org:5000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 12 IoCs

resource	yara_rule
behavioral1/files/0x000600000001412b-88.dat	family_wshrat
behavioral1/files/0x0006000000014143-92.dat	family_wshrat
behavioral1/files/0x000600000001414c-96.dat	family_wshrat
behavioral1/files/0x000600000001412b-112.dat	family_wshrat
behavioral1/files/0x000600000001414c-116.dat	family_wshrat
behavioral1/files/0x000600000001414c-122.dat	family_wshrat
behavioral1/files/0x000600000001412b-133.dat	family_wshrat
behavioral1/files/0x000600000001414c-137.dat	family_wshrat
behavioral1/files/0x000600000001414c-139.dat	family_wshrat
behavioral1/files/0x000600000001412b-154.dat	family_wshrat
behavioral1/files/0x000600000001414c-157.dat	family_wshrat
behavioral1/files/0x000600000001414c-160.dat	family_wshrat

Blocklisted process makes network request 16 IoCs

flow	pid	Process
11	1940	wscript.exe
13	1940	wscript.exe
14	1940	wscript.exe
15	1940	wscript.exe
19	1940	wscript.exe
20	1940	wscript.exe
21	1940	wscript.exe
24	1940	wscript.exe
25	1940	wscript.exe
27	1940	wscript.exe
32	1940	wscript.exe
33	1940	wscript.exe
34	1940	wscript.exe
36	1940	wscript.exe
39	1940	wscript.exe
40	1940	wscript.exe

Executes dropped EXE 6 IoCs

pid	Process
2032	test file.exe
1536	faksdkoas.exe
912	FAKSDK~1.EXE
280	FAKSDK~1.EXE
856	FAKSDK~1.EXE
1108	FAKSDK~1.EXE

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe

Loads dropped DLL 9 IoCs

pid	Process
1892	3f73719885ad1f1beafd8f6b9589fd47.exe
1892	3f73719885ad1f1beafd8f6b9589fd47.exe
1892	3f73719885ad1f1beafd8f6b9589fd47.exe
1892	3f73719885ad1f1beafd8f6b9589fd47.exe
1640	WScript.exe
1900	WScript.exe
940	WScript.exe
2044	WScript.exe
300	WScript.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\software\microsoft\windows\currentversion\run	wscript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	test file.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1536 set thread context of 1404	1536	faksdkoas.exe	33
PID 912 set thread context of 1812	912	FAKSDK~1.EXE	41
PID 280 set thread context of 1144	280	FAKSDK~1.EXE	47
PID 856 set thread context of 1316	856	FAKSDK~1.EXE	54

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
2032	test file.exe
2032	test file.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
1536	faksdkoas.exe
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
912	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
280	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE
856	FAKSDK~1.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	test file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	test file.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2032	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	28
PID 1892 wrote to memory of 2032	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	28
PID 1892 wrote to memory of 2032	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	28
PID 1892 wrote to memory of 2032	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	28
PID 1892 wrote to memory of 1640	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	29
PID 1892 wrote to memory of 1640	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	29
PID 1892 wrote to memory of 1640	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	29
PID 1892 wrote to memory of 1640	1892	3f73719885ad1f1beafd8f6b9589fd47.exe	29
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 1640 wrote to memory of 1536	1640	WScript.exe	30
PID 2032 wrote to memory of 1488	2032	test file.exe	31
PID 2032 wrote to memory of 1488	2032	test file.exe	31
PID 2032 wrote to memory of 1488	2032	test file.exe	31
PID 2032 wrote to memory of 1488	2032	test file.exe	31
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1536 wrote to memory of 1404	1536	faksdkoas.exe	33
PID 1404 wrote to memory of 1992	1404	RegSvcs.exe	34
PID 1404 wrote to memory of 1992	1404	RegSvcs.exe	34
PID 1404 wrote to memory of 1992	1404	RegSvcs.exe	34
PID 1404 wrote to memory of 1992	1404	RegSvcs.exe	34
PID 1992 wrote to memory of 1940	1992	wscript.exe	35
PID 1992 wrote to memory of 1940	1992	wscript.exe	35
PID 1992 wrote to memory of 1940	1992	wscript.exe	35
PID 1992 wrote to memory of 1940	1992	wscript.exe	35
PID 1536 wrote to memory of 1900	1536	faksdkoas.exe	36
PID 1536 wrote to memory of 1900	1536	faksdkoas.exe	36
PID 1536 wrote to memory of 1900	1536	faksdkoas.exe	36
PID 1536 wrote to memory of 1900	1536	faksdkoas.exe	36
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 1900 wrote to memory of 912	1900	WScript.exe	38
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 912 wrote to memory of 1812	912	FAKSDK~1.EXE	41
PID 1812 wrote to memory of 2044	1812	RegSvcs.exe	42
PID 1812 wrote to memory of 2044	1812	RegSvcs.exe	42
PID 1812 wrote to memory of 2044	1812	RegSvcs.exe	42
PID 1812 wrote to memory of 2044	1812	RegSvcs.exe	42
PID 912 wrote to memory of 940	912	FAKSDK~1.EXE	44
PID 912 wrote to memory of 940	912	FAKSDK~1.EXE	44
PID 912 wrote to memory of 940	912	FAKSDK~1.EXE	44
PID 912 wrote to memory of 940	912	FAKSDK~1.EXE	44

C:\Users\Admin\AppData\Local\Temp\3f73719885ad1f1beafd8f6b9589fd47.exe
"C:\Users\Admin\AppData\Local\Temp\3f73719885ad1f1beafd8f6b9589fd47.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\temp\2_41\test file.exe
  "C:\Users\Admin\AppData\Local\temp\2_41\test file.exe" ä¼ŠèŽŽè´æ‹‰25ç¾Žåˆ†ç¡¬å¸æ˜¯1893å¹´é“¸é€ çš„ä¸€ç§ç¾Žå›½çºªå¿µå¸ï¼Œç”±è”é‚¦å›½ä¼šåº”èŠåŠ å“¥å“¥ä¼¦å¸ƒçºªå¿µåšè§ˆä¼šå¥³å£«ç»ç†äººè‘£äº‹ä¼šçš„è¯·æ±‚æŽˆæƒå‘è¡Œã€‚
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE15.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:1488
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\2_41\feudamoc.vbe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
    "C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe" xccsbp.vlf
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        5⤵
        Drops startup file
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        6⤵
        Blocklisted process makes network request
        Drops startup file
        Adds Run key to start application
        
        PID:1940
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_41\run.vbs"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE" xccsbp.vlf
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:912
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        7⤵
        Drops startup file
        Adds Run key to start application
        
        PID:2044
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        8⤵
        
        PID:592
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_41\run.vbs"
        6⤵
        Loads dropped DLL
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE" xccsbp.vlf
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:280
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        8⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        9⤵
        Drops startup file
        Adds Run key to start application
        
        PID:2020
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        10⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_41\run.vbs"
        8⤵
        Loads dropped DLL
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE" xccsbp.vlf
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:856
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        10⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        11⤵
        Drops startup file
        Adds Run key to start application
        
        PID:1936
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        12⤵
        
        PID:812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_41\run.vbs"
        10⤵
        Loads dropped DLL
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\2_41\FAKSDK~1.EXE" xccsbp.vlf
        11⤵
        Executes dropped EXE
        
        PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

faksdkoas.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lhjgib.jpg

Path C:\Users\Admin\AppData\Local\Temp\2_41\lhjgib.jpg
Size 45KB
SHA256 26a133075b6be4ce1eaa4db17934f0c04566b134956f3c812ec15ce49b18b38c
MD5 4f465f14923a494e8859dbba24220b73
SHA1 f48e8e8e3effea4198d7959522bb324832dde5f1
SHA512 cb450623e42ffd8541519002e2e96aadcba69b6b8e4c8ee914d5b3a3f346646a64479e2c1095a1378023ce2dc6c5aaad74e0600ee2addcfc08030683d630f9ec
SSDEEP 768:60VTzWm5wy/1eQK8pzFTrgIcvoyweVGEnZojxItNQJ9SfhouDU7542:d5wU1eQK8pzF5cvoyweVzoj0aJunA75/
MD5 SHA1 SHA512 SSDEEP

Submit Download

lpwbjuoh.nij

Path C:\Users\Admin\AppData\Local\Temp\2_41\lpwbjuoh.nij
Size 1.0MB
SHA256 d82b29c882634308da49dcdf9ba8c185785cc4d7f8ec3a9cc2bf879ffecae582
MD5 7c96d13a20336ad9faebd5e285971268
SHA1 8409f340067cb2504d6ef27868c619cb76983074
SHA512 b96138c07fff116944fac53df077cd5e6012e7c8c0a11af324ca80a095fe650fb256beda6f0d56b9be03965a0ef7b5d87d69cfc08dfc59d9756f317bfeb87465
SSDEEP 12288:MEFQDRYQ3f/uQXWGOblvc28s6/fmrFiVOcTx2bXa+p:MsQtxOXDasBiD2bXB
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\2_41\run.vbs
Size 130B
SHA256 1884da07b862d8c4075ea87cea80c47b0f8157976d60e0fc30645eb04515bb06
MD5 c03b2eecc2088d3a7d9b13cad82e52a3
SHA1 1f02fa3c133606411f31dd7f779940bd614fcb3b
SHA512 81c3bb353b66519861b2949c9f3928ad1338a4afd70d213ca87529d84bb54933463f7ab79104b48319fb7e39d7dce833047a8d189e5778924b4275523b9ae855
MD5 SHA1 SHA512

Submit Download

test file.exe

Path C:\Users\Admin\AppData\Local\Temp\2_41\test file.exe
Size 203KB
SHA256 b4869c17fe516e2f8fe649349710de4b7e8667a30714fe66746fe6248025a36b
MD5 1f09eca585c701bbbf4a63ce5e1771f6
SHA1 8b3405e33b91e3d6b3860afa86e6c98a5e908abb
SHA512 4a28f0ea613ad9ad0f1f33dac804b6918da75a509cd7dea04bc9fc2cb89cffe85eacc187811baf8f4b6e9de22e51ec9fe2ab3939ec311eb0b7bb877aa3f2215c
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqhDcdg0nZfileCvGZ49hpUOwZ:sLV6Bta6dtJmakIM59V0wQr8aOwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xccsbp.vlf

Path C:\Users\Admin\AppData\Local\Temp\2_41\xccsbp.vlf
Size 117.2MB
SHA256 0d83d6e9ef379af14333b94d049547b5b8a4f35afcd25cc3b95ab2bf5e077117
MD5 e49659c07ebff776159f1beb52d42388
SHA1 d2e99e21830af1e4ae96f7a77c73ffe8ddd123a4
SHA512 c6ee65e2cdcf68f78438de79b003ca6f7fb537746b927f715f25cb451a14e51150ff4e70c9df565b1ec86ed0997ab4860c244fcb2ed623f6719482fd94c12815
SSDEEP 98304:LYkb3V7QwL4gSrrdfD0dhSGH5Oq9gJobKI08fN/I0I9EF3mu1WLK5GvSeVZEtR9r:D
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpE15.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE15.tmp
Size 1KB
SHA256 80682948d9e9a49fa0178623808cf4507fd6c1123b248abe4e8fa2bc52ef4c50
MD5 a220d91757de399952b90c35eeecf792
SHA1 ea298bd9a2e6bd50068452cd8a5b979796fada71
SHA512 c6cc0629c6696117a0f0e04ed1844a354ea4e202982463a0deb7a9196d35f007d4928f0556db4bcde94d3d5be4cda7d5d5157784a441035877f288c4f2aa22ac
MD5 SHA1 SHA512

Submit Download

feudamoc.vbe

Path C:\Users\Admin\AppData\Local\temp\2_41\feudamoc.vbe
Size 24KB
SHA256 36893fd0ecb7b83e5af0581f5df677a65a01808e18edaa95530cdfdad45cf0a9
MD5 a56332f161b32fcd30f48ac8a66975e8
SHA1 3c9dda1587ae925c492ffab42bb55ef27f54fe7f
SHA512 47b4584756bd2639f33f148911ff562a3a070b857112c51138ef228430b4b38b7eb3881917b0a159b5914b0f5a3591e85429ae231f202b20c59c10c05c2ddd92
SSDEEP 768:9i2vD9M1YSi2vD9M1YJi2vD9M1Ybi2vD9M1Yei2vD9M1YN:9pvD9M1lpvD9M1+pvD9M1spvD9M1hpvN
MD5 SHA1 SHA512 SSDEEP

Submit Download

test file.exe

Path C:\Users\Admin\AppData\Local\temp\2_41\test file.exe
Size 203KB
SHA256 b4869c17fe516e2f8fe649349710de4b7e8667a30714fe66746fe6248025a36b
MD5 1f09eca585c701bbbf4a63ce5e1771f6
SHA1 8b3405e33b91e3d6b3860afa86e6c98a5e908abb
SHA512 4a28f0ea613ad9ad0f1f33dac804b6918da75a509cd7dea04bc9fc2cb89cffe85eacc187811baf8f4b6e9de22e51ec9fe2ab3939ec311eb0b7bb877aa3f2215c
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqhDcdg0nZfileCvGZ49hpUOwZ:sLV6Bta6dtJmakIM59V0wQr8aOwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path \Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path \Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path \Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path \Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

faksdkoas.exe

Path \Users\Admin\AppData\Local\Temp\2_41\faksdkoas.exe
Size 888KB
SHA256 9627afb0cbf7be37b214254ec758cd1b33bde61eff49cca58c87e66e670073a9
MD5 04f0c3f70461916af763532c37542cbc
SHA1 cc224f14986caa4bb5a5f74ba987702492938d8b
SHA512 86219a977a82447294b314f5a610ab58ab9e6ff93f9c480eb50910954b1c861cd91148315b68e5c64e0a6f96c6b0d652de22fbc04c6f493092703784737b034e
SSDEEP 24576:oErOxpVnqgt5ExLh27RQlf7Yfq2WZz2alW6j:o86pqeE74aB0SdiaTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

test file.exe

Path \Users\Admin\AppData\Local\Temp\2_41\test file.exe
Size 203KB
SHA256 b4869c17fe516e2f8fe649349710de4b7e8667a30714fe66746fe6248025a36b
MD5 1f09eca585c701bbbf4a63ce5e1771f6
SHA1 8b3405e33b91e3d6b3860afa86e6c98a5e908abb
SHA512 4a28f0ea613ad9ad0f1f33dac804b6918da75a509cd7dea04bc9fc2cb89cffe85eacc187811baf8f4b6e9de22e51ec9fe2ab3939ec311eb0b7bb877aa3f2215c
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqhDcdg0nZfileCvGZ49hpUOwZ:sLV6Bta6dtJmakIM59V0wQr8aOwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

test file.exe

Path \Users\Admin\AppData\Local\Temp\2_41\test file.exe
Size 203KB
SHA256 b4869c17fe516e2f8fe649349710de4b7e8667a30714fe66746fe6248025a36b
MD5 1f09eca585c701bbbf4a63ce5e1771f6
SHA1 8b3405e33b91e3d6b3860afa86e6c98a5e908abb
SHA512 4a28f0ea613ad9ad0f1f33dac804b6918da75a509cd7dea04bc9fc2cb89cffe85eacc187811baf8f4b6e9de22e51ec9fe2ab3939ec311eb0b7bb877aa3f2215c
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqhDcdg0nZfileCvGZ49hpUOwZ:sLV6Bta6dtJmakIM59V0wQr8aOwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

test file.exe

Path \Users\Admin\AppData\Local\Temp\2_41\test file.exe
Size 203KB
SHA256 b4869c17fe516e2f8fe649349710de4b7e8667a30714fe66746fe6248025a36b
MD5 1f09eca585c701bbbf4a63ce5e1771f6
SHA1 8b3405e33b91e3d6b3860afa86e6c98a5e908abb
SHA512 4a28f0ea613ad9ad0f1f33dac804b6918da75a509cd7dea04bc9fc2cb89cffe85eacc187811baf8f4b6e9de22e51ec9fe2ab3939ec311eb0b7bb877aa3f2215c
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqhDcdg0nZfileCvGZ49hpUOwZ:sLV6Bta6dtJmakIM59V0wQr8aOwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

test file.exe

Path \Users\Admin\AppData\Local\Temp\2_41\test file.exe
Size 203KB
SHA256 b4869c17fe516e2f8fe649349710de4b7e8667a30714fe66746fe6248025a36b
MD5 1f09eca585c701bbbf4a63ce5e1771f6
SHA1 8b3405e33b91e3d6b3860afa86e6c98a5e908abb
SHA512 4a28f0ea613ad9ad0f1f33dac804b6918da75a509cd7dea04bc9fc2cb89cffe85eacc187811baf8f4b6e9de22e51ec9fe2ab3939ec311eb0b7bb877aa3f2215c
SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIqhDcdg0nZfileCvGZ49hpUOwZ:sLV6Bta6dtJmakIM59V0wQr8aOwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1144-128-0x0000000000390000-0x0000000001390000-memory.dmp

Download

memory/1144-125-0x0000000000390000-0x0000000001390000-memory.dmp

Download

memory/1144-131-0x0000000000390000-0x000000000041A000-memory.dmp

Download

memory/1144-130-0x0000000000390000-0x0000000001390000-memory.dmp

Download

memory/1316-152-0x00000000002C0000-0x000000000034A000-memory.dmp

Download

memory/1316-146-0x00000000002C0000-0x00000000012C0000-memory.dmp

Download

memory/1316-149-0x00000000002C0000-0x00000000012C0000-memory.dmp

Download

memory/1316-151-0x00000000002C0000-0x00000000012C0000-memory.dmp

Download

memory/1404-86-0x0000000000A60000-0x0000000000AEA000-memory.dmp

Download

memory/1404-85-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/1404-83-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/1404-80-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/1404-78-0x0000000000A60000-0x0000000001A60000-memory.dmp

Download

memory/1812-107-0x00000000003E0000-0x00000000013E0000-memory.dmp

Download

memory/1812-104-0x00000000003E0000-0x00000000013E0000-memory.dmp

Download

memory/1812-109-0x00000000003E0000-0x00000000013E0000-memory.dmp

Download

memory/1812-110-0x00000000003E0000-0x000000000046A000-memory.dmp

Download

memory/1892-54-0x0000000075EC1000-0x0000000075EC3000-memory.dmp

Download

memory/2032-76-0x0000000073B40000-0x00000000740EB000-memory.dmp

Download

memory/2032-66-0x0000000073B40000-0x00000000740EB000-memory.dmp

Download