wshrat | fa2e0066a72e409c12bb2f71eb282d8feb9cf7a956ed51a22a69c4a43c7a9dba

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2022, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DRAFT199849-BILADING-8458886.exe
Size 1.5MB
Sample221217-ktwbzagd87
SHA256 fa2e0066a72e409c12bb2f71eb282d8feb9cf7a956ed51a22a69c4a43c7a9dba
MD5 f0b94cd08cddbffeafd2e96ca4cc5e3e
SHA1 50fe4df2e4974447a23baa0007aec7e81db2fa29
SHA512 6c489f64857d494826c0fe504b7351047692f10cecea2795c1b6d8dd246d3ed7742577511f8e18caaf8ad8d7e949f5e6f92bf042bae12e7d772684ddbb51ed12
SSDEEP 24576:8AOcZ+2JfN+Owq85kORkr+5fvQz6TzGouZuvhHbyC1BQrXAz3fJzQsZx4Zig:q5KUOwq85kikQvQOvvhuCkAz3fBQsZOj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://newmoney2033.duckdns.org:5000

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

WSHRAT payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001f020-153.dat	family_wshrat
behavioral2/files/0x0002000000021835-155.dat	family_wshrat
behavioral2/files/0x0002000000022db1-156.dat	family_wshrat
behavioral2/files/0x0002000000022db1-172.dat	family_wshrat
behavioral2/files/0x0002000000022db1-176.dat	family_wshrat

Blocklisted process makes network request 15 IoCs

flow	pid	Process
45	2608	wscript.exe
47	2608	wscript.exe
48	2608	wscript.exe
49	2608	wscript.exe
50	2608	wscript.exe
53	2608	wscript.exe
54	2608	wscript.exe
55	2608	wscript.exe
57	2608	wscript.exe
58	2608	wscript.exe
59	2608	wscript.exe
60	2608	wscript.exe
61	2608	wscript.exe
62	2608	wscript.exe
63	2608	wscript.exe

Executes dropped EXE 5 IoCs

pid	Process
4764	lemt.exe
3044	RegSvcs.exe
3956	lemt.exe
4812	RegSvcs.exe
496	lemt.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	lemt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DRAFT199849-BILADING-8458886.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	lemt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RegSvcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RegSvcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs	wscript.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	lemt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\lemt.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\cwrv.xml"	lemt.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	lemt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\lemt.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6_71\\cwrv.xml"	lemt.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmBqH = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WmBqH.vbs\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 3044	4764	lemt.exe	99
PID 3956 set thread context of 4812	3956	lemt.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	lemt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	lemt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
4764	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe
3956	lemt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2656	3556	DRAFT199849-BILADING-8458886.exe	83
PID 3556 wrote to memory of 2656	3556	DRAFT199849-BILADING-8458886.exe	83
PID 3556 wrote to memory of 2656	3556	DRAFT199849-BILADING-8458886.exe	83
PID 2656 wrote to memory of 4764	2656	wscript.exe	87
PID 2656 wrote to memory of 4764	2656	wscript.exe	87
PID 2656 wrote to memory of 4764	2656	wscript.exe	87
PID 4764 wrote to memory of 4560	4764	lemt.exe	92
PID 4764 wrote to memory of 4560	4764	lemt.exe	92
PID 4764 wrote to memory of 4560	4764	lemt.exe	92
PID 4764 wrote to memory of 2744	4764	lemt.exe	93
PID 4764 wrote to memory of 2744	4764	lemt.exe	93
PID 4764 wrote to memory of 2744	4764	lemt.exe	93
PID 4764 wrote to memory of 2232	4764	lemt.exe	94
PID 4764 wrote to memory of 2232	4764	lemt.exe	94
PID 4764 wrote to memory of 2232	4764	lemt.exe	94
PID 4764 wrote to memory of 4360	4764	lemt.exe	95
PID 4764 wrote to memory of 4360	4764	lemt.exe	95
PID 4764 wrote to memory of 4360	4764	lemt.exe	95
PID 4764 wrote to memory of 2432	4764	lemt.exe	96
PID 4764 wrote to memory of 2432	4764	lemt.exe	96
PID 4764 wrote to memory of 2432	4764	lemt.exe	96
PID 4764 wrote to memory of 4060	4764	lemt.exe	97
PID 4764 wrote to memory of 4060	4764	lemt.exe	97
PID 4764 wrote to memory of 4060	4764	lemt.exe	97
PID 4764 wrote to memory of 2644	4764	lemt.exe	98
PID 4764 wrote to memory of 2644	4764	lemt.exe	98
PID 4764 wrote to memory of 2644	4764	lemt.exe	98
PID 4764 wrote to memory of 3044	4764	lemt.exe	99
PID 4764 wrote to memory of 3044	4764	lemt.exe	99
PID 4764 wrote to memory of 3044	4764	lemt.exe	99
PID 4764 wrote to memory of 3044	4764	lemt.exe	99
PID 4764 wrote to memory of 3044	4764	lemt.exe	99
PID 3044 wrote to memory of 3460	3044	RegSvcs.exe	100
PID 3044 wrote to memory of 3460	3044	RegSvcs.exe	100
PID 3044 wrote to memory of 3460	3044	RegSvcs.exe	100
PID 3460 wrote to memory of 2608	3460	wscript.exe	101
PID 3460 wrote to memory of 2608	3460	wscript.exe	101
PID 3460 wrote to memory of 2608	3460	wscript.exe	101
PID 4764 wrote to memory of 1284	4764	lemt.exe	102
PID 4764 wrote to memory of 1284	4764	lemt.exe	102
PID 4764 wrote to memory of 1284	4764	lemt.exe	102
PID 1284 wrote to memory of 3956	1284	WScript.exe	103
PID 1284 wrote to memory of 3956	1284	WScript.exe	103
PID 1284 wrote to memory of 3956	1284	WScript.exe	103
PID 3956 wrote to memory of 428	3956	lemt.exe	104
PID 3956 wrote to memory of 428	3956	lemt.exe	104
PID 3956 wrote to memory of 428	3956	lemt.exe	104
PID 3956 wrote to memory of 5004	3956	lemt.exe	105
PID 3956 wrote to memory of 5004	3956	lemt.exe	105
PID 3956 wrote to memory of 5004	3956	lemt.exe	105
PID 3956 wrote to memory of 3120	3956	lemt.exe	106
PID 3956 wrote to memory of 3120	3956	lemt.exe	106
PID 3956 wrote to memory of 3120	3956	lemt.exe	106
PID 3956 wrote to memory of 1372	3956	lemt.exe	107
PID 3956 wrote to memory of 1372	3956	lemt.exe	107
PID 3956 wrote to memory of 1372	3956	lemt.exe	107
PID 3956 wrote to memory of 4500	3956	lemt.exe	108
PID 3956 wrote to memory of 4500	3956	lemt.exe	108
PID 3956 wrote to memory of 4500	3956	lemt.exe	108
PID 3956 wrote to memory of 1288	3956	lemt.exe	109
PID 3956 wrote to memory of 1288	3956	lemt.exe	109
PID 3956 wrote to memory of 1288	3956	lemt.exe	109
PID 3956 wrote to memory of 3928	3956	lemt.exe	110
PID 3956 wrote to memory of 3928	3956	lemt.exe	110

C:\Users\Admin\AppData\Local\Temp\DRAFT199849-BILADING-8458886.exe
"C:\Users\Admin\AppData\Local\Temp\DRAFT199849-BILADING-8458886.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" incve-kbktrxnm.docx.vbe
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
    "C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe" cwrv.xml
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:2232
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe"
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3044
    - - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        5⤵
        Checks computer location settings
        Drops startup file
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        6⤵
        Blocklisted process makes network request
        Drops startup file
        Adds Run key to start application
        
        PID:2608
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6_71\run.vbs"
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe" cwrv.xml
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3956
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:428
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:5004
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:3120
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1372
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:4500
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:1288
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe"
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4812
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\WmBqH.vbs"
        7⤵
        Checks computer location settings
        Drops startup file
        Adds Run key to start application
        
        PID:1080
        
        C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs"
        8⤵
        
        PID:2972
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6_71\run.vbs"
        6⤵
        Checks computer location settings
        Modifies registry class
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe" cwrv.xml
        7⤵
        Executes dropped EXE
        
        PID:496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwrv.xml

Path C:\Users\Admin\AppData\Local\Temp\6_71\cwrv.xml
Size 112.5MB
SHA256 8e96a439e9315097cbc7574e7e03f03a5136b7146b6d3788580855d0546a16e0
MD5 ed33cc743d130710832eab07801bf435
SHA1 9bffc99421cb95302e03d7a7972e3cedd8cd42cc
SHA512 103b3a802b9a13500acd5e31dfe52084d68cb634f6ca8fb502ddb4b562d4ae3d55e9ca47ead0ad80bc3c90f96ddca9d0b6dc8d8ab742cb4c2ce14814c64d9af1
SSDEEP 393216:ncIzZZDkkz8UiTTx3bYx1i2vnuqxUNMDqsYwXBXM4MRopf2uZGTqd2ni+5dIhFxO:C
MD5 SHA1 SHA512 SSDEEP

Submit Download

eiqvmdrp.bin

Path C:\Users\Admin\AppData\Local\Temp\6_71\eiqvmdrp.bin
Size 61KB
SHA256 ff4de0f00bfb232f66b0104ddaf71a89237526e3f88fb09f86094b6c037b85a3
MD5 acd44fc45e9437c37565aded9ff2409b
SHA1 013ce6d74dcea4ebb25baf1373e4ef370e84d874
SHA512 cb4fac58d6a4fca868e559683c10ada6d1365f99623d8d1cb9d4603f1e35a5b0ffab3bb45188a282e0d7e83b4c4fd75a8838469f5ab0eb9903e907c6755a6e12
SSDEEP 1536:MO2jEWW5yEmq7CWY5NtJgbBYrUUG7dOxhPuGpuIUwvKju9IsCF/zla:f2wWfEmq7C/N0ixGyhmGpuNwexs+zE
MD5 SHA1 SHA512 SSDEEP

Submit Download

kvuqk.xfd

Path C:\Users\Admin\AppData\Local\Temp\6_71\kvuqk.xfd
Size 1.0MB
SHA256 99e46de7c1acc7c76eee2dccc6128c557a8791b469d457b053a78d6f1ca5d8fe
MD5 477a8a33de4f2dae436f1646100d5a4a
SHA1 5e394c2541f2ccd8ed462046a207827a9e8bd9c3
SHA512 e1eb0b2d7097b8546806b6177998db81bec427a101be0778a8a6e776ebe9ab609b858926c0945e64a8d007e9644cf2d4090a07d7af850c9bd91832e51c43d785
SSDEEP 12288:fxryA/9phu1I40uwKjXF7RSLN5NCQvck1OJh9ofmMuDg7PS:YA/9RF1KjaNCQvczJhAu0K
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lemt.exe

Path C:\Users\Admin\AppData\Local\Temp\6_71\lemt.exe
Size 887KB
SHA256 8c5c8085c2b0ab5afacd633f74583a50cdec8a65036c636b9c84c7f35d48a467
MD5 e3425941149899428ef0d3b2d0819f98
SHA1 15942b4afb623470919f8c7af00781605eead810
SHA512 a044db04a3968d5747ea34bd24a32c8001ed91f161adb69261a98f61aae8528ec9a6d1ccaeafb7bc65082023fe4bb0b0c349f5bbf60247f1aa7e627168193681
SSDEEP 24576:oYgAon+KfqNbXD2XJ2PH1ddATgs/u2kat+Q:o37+KSbq5e1diEnHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\6_71\run.vbs
Size 124B
SHA256 5c0f8f2bd0937fc05578531141412604baf6e405e8e822a6c306ccd52937517b
MD5 34f7e07b3a29ca4c2ba4929ec6686ced
SHA1 e8e143c09b4821946d597c0e847e3a2c51582a64
SHA512 614508bcfe4492946c5e8473898ecb30ce6e7dc335ba9e24a71c2274fa537e5f47d7d4d8dd06735a14a2bad58020220b2d80e08712ad7d67b3b5c8f24b883300
MD5 SHA1 SHA512

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe

Path C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Local\Temp\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

incve-kbktrxnm.docx.vbe

Path C:\Users\Admin\AppData\Local\temp\6_71\incve-kbktrxnm.docx.vbe
Size 62KB
SHA256 003edd78a452744c128714259a7ebba275ea2b287b5c51776a41131db3e5f4a5
MD5 43e67314acfe367bbc74d920b6dfa5bf
SHA1 e0071e7310259b96dcc8d3791c529ed6810a8d41
SHA512 92c804a7c0739e75f693005764a014a0efdf56535f7b356a6844229d588d5634922f5f18e0f3bb2bdeed8006aaa34a8b1eefd459663e8373b3abfa998e1cab07
SSDEEP 1536:euCXxuCXSuCXSuCXSuCXXuCXFuCXbuCXyuCXXuCXE:HTEEEJn9EZ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 64KB
SHA256 d98b5fd4eb237919baf53175a6fbe62f71598b22bf0ecad89ff893abe316bd66
MD5 21099e5ede9594274cd48bfeacf81e5f
SHA1 86fe4c46e9fccff2e16a02bbe0cc0d1785c91fc4
SHA512 ce9bdca6d91450fc88f2ed0a82f80224912bab920b553c59e1968ffc52a71c88ee01873980cc132dc088891687dd0424387575f3ba76f502eafe4e1f357dd930
SSDEEP 1536:4hCg8aOnSlpAmshW1SeWBLB+0vTamZeIi9eXjO+:4Ag8xSXAmshISeWJQ0bamQvEzx
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmBqH.vbs

Path C:\Users\Admin\AppData\Roaming\WmBqH.vbs
Size 180KB
SHA256 40a21327272d9c522a6061a595c640a33780a59a1cab0cc93706bb28a67891b7
MD5 a2c40a28f05614c3d68c9c9727fa9584
SHA1 c9d7c014564072d2ea951ede6718632c20a5cd48
SHA512 36beb41f0679d04fb60ebfdd0f60eb7b862591bc91bd1c93b66619213d13ef7a4b0b81d8c38d4a65870bb6163d00234af2f8fbccdb11311d4d0a12f8ee13c2aa
SSDEEP 3072:4Ag8xSXAmshISeWJQ0bamQvEz7ZAbURC3eGK/6xbIpklgVDSxGfmuZ1D:4Ag8xSQmshISeWmM6iRC3eGKoAklgF28
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3044-151-0x0000000000C00000-0x0000000000C8A000-memory.dmp

Download

memory/3044-148-0x0000000000C00000-0x00000000010DC000-memory.dmp

Download

memory/4812-169-0x0000000000F00000-0x0000000001614000-memory.dmp

Download