wshrat | fa2e0066a72e409c12bb2f71eb282d8feb9cf7a956ed51a22a69c4a43c7a9dba

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17/12/2022, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRAFT199849-BILADING-8458886.exe
Size 1.5MB
Sample221217-ktwbzagd87
SHA256 fa2e0066a72e409c12bb2f71eb282d8feb9cf7a956ed51a22a69c4a43c7a9dba
MD5 f0b94cd08cddbffeafd2e96ca4cc5e3e
SHA1 50fe4df2e4974447a23baa0007aec7e81db2fa29
SHA512 6c489f64857d494826c0fe504b7351047692f10cecea2795c1b6d8dd246d3ed7742577511f8e18caaf8ad8d7e949f5e6f92bf042bae12e7d772684ddbb51ed12
SSDEEP 24576:8AOcZ+2JfN+Owq85kORkr+5fvQz6TzGouZuvhHbyC1BQrXAz3fJzQsZx4Zig:q5KUOwq85kikQvQOvvhuCkAz3fBQsZOj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://newmoney2033.duckdns.org:5000

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0006000000015bf9-86.dat	family_wshrat
behavioral1/files/0x0006000000015c12-90.dat	family_wshrat
behavioral1/files/0x0006000000015c1e-94.dat	family_wshrat
behavioral1/files/0x0006000000015bf9-120.dat	family_wshrat
behavioral1/files/0x0006000000015c1e-123.dat	family_wshrat

Blocklisted process makes network request 12 IoCs

flow	pid	Process
5	752	wscript.exe
7	752	wscript.exe
8	752	wscript.exe
9	752	wscript.exe
11	752	wscript.exe
12	752	wscript.exe
13	752	wscript.exe
15	752	wscript.exe
16	752	wscript.exe
17	752	wscript.exe
19	752	wscript.exe
20	752	wscript.exe

Executes dropped EXE 5 IoCs

pid	Process
696	lemt.exe
1696	RegSvcs.exe
1648	lemt.exe
1744	RegSvcs.exe
1228	lemt.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe

Loads dropped DLL 5 IoCs

pid	Process
280	wscript.exe
696	lemt.exe
1404	WScript.exe
1648	lemt.exe
1876	WScript.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lemt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\lemt.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\cwrv.xml"	lemt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\lemt.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\cwrv.xml"	lemt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lemt.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 1696	696	lemt.exe	37
PID 1648 set thread context of 1744	1648	lemt.exe	55

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
696	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe
1648	lemt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 280	1976	DRAFT199849-BILADING-8458886.exe	28
PID 1976 wrote to memory of 280	1976	DRAFT199849-BILADING-8458886.exe	28
PID 1976 wrote to memory of 280	1976	DRAFT199849-BILADING-8458886.exe	28
PID 1976 wrote to memory of 280	1976	DRAFT199849-BILADING-8458886.exe	28
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 280 wrote to memory of 696	280	wscript.exe	29
PID 696 wrote to memory of 1712	696	lemt.exe	30
PID 696 wrote to memory of 1712	696	lemt.exe	30
PID 696 wrote to memory of 1712	696	lemt.exe	30
PID 696 wrote to memory of 1712	696	lemt.exe	30
PID 696 wrote to memory of 1924	696	lemt.exe	31
PID 696 wrote to memory of 1924	696	lemt.exe	31
PID 696 wrote to memory of 1924	696	lemt.exe	31
PID 696 wrote to memory of 1924	696	lemt.exe	31
PID 696 wrote to memory of 1308	696	lemt.exe	32
PID 696 wrote to memory of 1308	696	lemt.exe	32
PID 696 wrote to memory of 1308	696	lemt.exe	32
PID 696 wrote to memory of 1308	696	lemt.exe	32
PID 696 wrote to memory of 1500	696	lemt.exe	33
PID 696 wrote to memory of 1500	696	lemt.exe	33
PID 696 wrote to memory of 1500	696	lemt.exe	33
PID 696 wrote to memory of 1500	696	lemt.exe	33
PID 696 wrote to memory of 932	696	lemt.exe	34
PID 696 wrote to memory of 932	696	lemt.exe	34
PID 696 wrote to memory of 932	696	lemt.exe	34
PID 696 wrote to memory of 932	696	lemt.exe	34
PID 696 wrote to memory of 1932	696	lemt.exe	35
PID 696 wrote to memory of 1932	696	lemt.exe	35
PID 696 wrote to memory of 1932	696	lemt.exe	35
PID 696 wrote to memory of 1932	696	lemt.exe	35
PID 696 wrote to memory of 1560	696	lemt.exe	36
PID 696 wrote to memory of 1560	696	lemt.exe	36
PID 696 wrote to memory of 1560	696	lemt.exe	36
PID 696 wrote to memory of 1560	696	lemt.exe	36
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 696 wrote to memory of 1696	696	lemt.exe	37
PID 1696 wrote to memory of 368	1696	RegSvcs.exe	38
PID 1696 wrote to memory of 368	1696	RegSvcs.exe	38
PID 1696 wrote to memory of 368	1696	RegSvcs.exe	38
PID 1696 wrote to memory of 368	1696	RegSvcs.exe	38
PID 368 wrote to memory of 752	368	wscript.exe	39
PID 368 wrote to memory of 752	368	wscript.exe	39
PID 368 wrote to memory of 752	368	wscript.exe	39
PID 368 wrote to memory of 752	368	wscript.exe	39
PID 696 wrote to memory of 1404	696	lemt.exe	40
PID 696 wrote to memory of 1404	696	lemt.exe	40
PID 696 wrote to memory of 1404	696	lemt.exe	40
PID 696 wrote to memory of 1404	696	lemt.exe	40
PID 1404 wrote to memory of 1648	1404	WScript.exe	41
PID 1404 wrote to memory of 1648	1404	WScript.exe	41
PID 1404 wrote to memory of 1648	1404	WScript.exe	41
PID 1404 wrote to memory of 1648	1404	WScript.exe	41

C:\Users\Admin\AppData\Local\Temp\DRAFT199849-BILADING-8458886.exe
"C:\Users\Admin\AppData\Local\Temp\DRAFT199849-BILADING-8458886.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" incve-kbktrxnm.docx.vbe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
    "C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe" cwrv.xml
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1308
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        5⤵
        Drops startup file
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:368
      - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        6⤵
        Blocklisted process makes network request
        Drops startup file
        Adds Run key to start application
        
        PID:752
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6_71\run.vbs"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe" cwrv.xml
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:1648
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:964
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1400
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1876
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:976
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1048
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1136
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        6⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        7⤵
        Drops startup file
        Adds Run key to start application
        
        PID:320
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        8⤵
        
        PID:1640
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6_71\run.vbs"
        6⤵
        Loads dropped DLL
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe" cwrv.xml
        7⤵
        Executes dropped EXE
        
        PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwrv.xml

Path C:\Users\Admin\AppData\Local\Temp\6_71\cwrv.xml
Size 112.5MB
SHA256 8e96a439e9315097cbc7574e7e03f03a5136b7146b6d3788580855d0546a16e0
MD5 ed33cc743d130710832eab07801bf435
SHA1 9bffc99421cb95302e03d7a7972e3cedd8cd42cc
SHA512 103b3a802b9a13500acd5e31dfe52084d68cb634f6ca8fb502ddb4b562d4ae3d55e9ca47ead0ad80bc3c90f96ddca9d0b6dc8d8ab742cb4c2ce14814c64d9af1
SSDEEP 393216:ncIzZZDkkz8UiTTx3bYx1i2vnuqxUNMDqsYwXBXM4MRopf2uZGTqd2ni+5dIhFxO:C
MD5 SHA1 SHA512 SSDEEP

Submit Download

eiqvmdrp.bin

Path C:\Users\Admin\AppData\Local\Temp\6_71\eiqvmdrp.bin
Size 61KB
SHA256 ff4de0f00bfb232f66b0104ddaf71a89237526e3f88fb09f86094b6c037b85a3
MD5 acd44fc45e9437c37565aded9ff2409b
SHA1 013ce6d74dcea4ebb25baf1373e4ef370e84d874
SHA512 cb4fac58d6a4fca868e559683c10ada6d1365f99623d8d1cb9d4603f1e35a5b0ffab3bb45188a282e0d7e83b4c4fd75a8838469f5ab0eb9903e907c6755a6e12
SSDEEP 1536:MO2jEWW5yEmq7CWY5NtJgbBYrUUG7dOxhPuGpuIUwvKju9IsCF/zla:f2wWfEmq7C/N0ixGyhmGpuNwexs+zE
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvuqk.xfd

Path C:\Users\Admin\AppData\Local\Temp\6_71\kvuqk.xfd
Size 1.0MB
SHA256 99e46de7c1acc7c76eee2dccc6128c557a8791b469d457b053a78d6f1ca5d8fe
MD5 477a8a33de4f2dae436f1646100d5a4a
SHA1 5e394c2541f2ccd8ed462046a207827a9e8bd9c3
SHA512 e1eb0b2d7097b8546806b6177998db81bec427a101be0778a8a6e776ebe9ab609b858926c0945e64a8d007e9644cf2d4090a07d7af850c9bd91832e51c43d785
SSDEEP 12288:fxryA/9phu1I40uwKjXF7RSLN5NCQvck1OJh9ofmMuDg7PS:YA/9RF1KjaNCQvczJhAu0K
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\6_71\run.vbs
Size 124B
SHA256 5c0f8f2bd0937fc05578531141412604baf6e405e8e822a6c306ccd52937517b
MD5 34f7e07b3a29ca4c2ba4929ec6686ced
SHA1 e8e143c09b4821946d597c0e847e3a2c51582a64
SHA512 614508bcfe4492946c5e8473898ecb30ce6e7dc335ba9e24a71c2274fa537e5f47d7d4d8dd06735a14a2bad58020220b2d80e08712ad7d67b3b5c8f24b883300
MD5 SHA1 SHA512

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

incve-kbktrxnm.docx.vbe

Path C:\Users\Admin\AppData\Local\temp\6_71\incve-kbktrxnm.docx.vbe
Size 62KB
SHA256 003edd78a452744c128714259a7ebba275ea2b287b5c51776a41131db3e5f4a5
MD5 43e67314acfe367bbc74d920b6dfa5bf
SHA1 e0071e7310259b96dcc8d3791c529ed6810a8d41
SHA512 92c804a7c0739e75f693005764a014a0efdf56535f7b356a6844229d588d5634922f5f18e0f3bb2bdeed8006aaa34a8b1eefd459663e8373b3abfa998e1cab07
SSDEEP 1536:euCXxuCXSuCXSuCXSuCXXuCXFuCXbuCXyuCXXuCXE:HTEEEJn9EZ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path \Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path \Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path \Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path \Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path \Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
MD5 0e06054beb13192588e745ee63a84173
SHA1 30b7d4d1277bafd04a83779fd566a1f834a8d113
SHA512 251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
SSDEEP 768:lBbSoy+SdIBf0k2dszJw6Iq8GGDaoViwLjwjS:aoOIBf0ddszJPSDhVLjwjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1696-84-0x0000000000410000-0x000000000049A000-memory.dmp

Download

memory/1696-82-0x0000000000410000-0x0000000000913000-memory.dmp

Download

memory/1696-74-0x0000000000410000-0x0000000000913000-memory.dmp

Download

memory/1696-76-0x0000000000410000-0x0000000000913000-memory.dmp

Download

memory/1696-80-0x0000000000410000-0x0000000000913000-memory.dmp

Download

memory/1744-108-0x0000000000260000-0x000000000095C000-memory.dmp

Download

memory/1744-116-0x0000000000260000-0x000000000095C000-memory.dmp

Download

memory/1744-114-0x0000000000260000-0x000000000095C000-memory.dmp

Download

memory/1744-118-0x0000000000260000-0x00000000002EA000-memory.dmp

Download

memory/1744-110-0x0000000000260000-0x000000000095C000-memory.dmp

Download

memory/1976-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Download