dcrat | 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

Resubmissions

12/01/2023, 20:01

230112-yrh6hsae5210

07/01/2023, 04:41

230107-fa3jqagb8t10

07/01/2023, 04:21

230107-eynj2acf8710

Analysis

max time kernel
60s
max time network
62s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/01/2023, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Size 3.8MB
Sample230107-fa3jqagb8t
SHA256 6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1
MD5 0a0a64f3c4fa7d960be983aa0a7d0ce8
SHA1 b597c7397ecaff7c5c1aa27f5124fc7b8a94e643
SHA512 ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4
SSDEEP 98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat 10 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		540	schtasks.exe
		1284	schtasks.exe
		1732	schtasks.exe
		968	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
		620	schtasks.exe
		440	schtasks.exe
		1536	schtasks.exe
		1816	schtasks.exe
		1372	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Favorites\\lsass.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\sppsvc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Favorites\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Favorites\\lsass.exe\", \"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	660	schtasks.exe	28

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1016-54-0x0000000000050000-0x000000000041A000-memory.dmp	dcrat
behavioral2/files/0x000d0000000054a8-88.dat	dcrat
behavioral2/files/0x000d0000000054a8-89.dat	dcrat
behavioral2/memory/1452-90-0x0000000000E20000-0x00000000011EA000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1452	lsass.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\Favorites\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\All Users\\Favorites\\lsass.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\smss.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\sppsvc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\\sppsvc.exe\""	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io
7	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1816	schtasks.exe
968	schtasks.exe
1284	schtasks.exe
620	schtasks.exe
440	schtasks.exe
1372	schtasks.exe
1732	schtasks.exe
1536	schtasks.exe
540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
1452	lsass.exe
1608	powershell.exe
2000	powershell.exe
904	powershell.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe
1452	lsass.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Token: SeDebugPrivilege	1452	lsass.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeBackupPrivilege	1036	vssvc.exe
Token: SeRestorePrivilege	1036	vssvc.exe
Token: SeAuditPrivilege	1036	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2000	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	38
PID 1016 wrote to memory of 2000	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	38
PID 1016 wrote to memory of 2000	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	38
PID 1016 wrote to memory of 788	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	39
PID 1016 wrote to memory of 788	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	39
PID 1016 wrote to memory of 788	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	39
PID 1016 wrote to memory of 1608	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	41
PID 1016 wrote to memory of 1608	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	41
PID 1016 wrote to memory of 1608	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	41
PID 1016 wrote to memory of 904	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	43
PID 1016 wrote to memory of 904	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	43
PID 1016 wrote to memory of 904	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	43
PID 1016 wrote to memory of 1452	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	46
PID 1016 wrote to memory of 1452	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	46
PID 1016 wrote to memory of 1452	1016	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe	46
PID 1452 wrote to memory of 1700	1452	lsass.exe	47
PID 1452 wrote to memory of 1700	1452	lsass.exe	47
PID 1452 wrote to memory of 1700	1452	lsass.exe	47
PID 1452 wrote to memory of 1104	1452	lsass.exe	48
PID 1452 wrote to memory of 1104	1452	lsass.exe	48
PID 1452 wrote to memory of 1104	1452	lsass.exe	48

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
"C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\lsass.exe'
  2⤵
  PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Users\All Users\Favorites\lsass.exe
  "C:\Users\All Users\Favorites\lsass.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1452
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8779be4c-4877-451e-a356-2867dba7e75a.vbs"
    3⤵
    PID:1700
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4771eca1-baeb-4f85-bc5a-bfcaadb7b9e2.vbs"
    3⤵
    PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Favorites\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Favorites\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Recovery\c0f67622-1a8a-11ed-ae9f-b21da26d38ed\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4771eca1-baeb-4f85-bc5a-bfcaadb7b9e2.vbs

Path C:\Users\Admin\AppData\Local\Temp\4771eca1-baeb-4f85-bc5a-bfcaadb7b9e2.vbs
Size 490B
SHA256 cf3f1b69bbdc009a07d8cc8ee67c1d39dcd290e3c94f0374bef06136144ce9ae
MD5 62126b74368d64907088d3c59c553ecd
SHA1 7ea3fc1026e7895346dd2990a0bcaf01c1288a14
SHA512 1dc2be5861124b209009563d82da57deb101134bab096d03ccc96110eca8b50d1d29ed01b4704ee2056ea6ea118505d9e8f0fadabbbd72dc3dfab46886f08970
MD5 SHA1 SHA512

Submit Download

8779be4c-4877-451e-a356-2867dba7e75a.vbs

Path C:\Users\Admin\AppData\Local\Temp\8779be4c-4877-451e-a356-2867dba7e75a.vbs
Size 714B
SHA256 6c17f5b0396264945baf0e12102c04081635ff0ec7afa84991ece7a2e96120a2
MD5 800eb65e6b423837c8daac9179563732
SHA1 9cf0f92001a1d67d6906bcb9560605b4ac53db4e
SHA512 67761ea0957f1f518e91881895e259f2efe8026345f652cc93e93036da9706d76ae8d1788801900e9cdbdf5107edf2029afe68a0242c539678e540bf0d29303c
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c44e58bf9c3af6f9d761a89a91356caecd0d1f2ff892d7006445bd30802e02c2
MD5 7b1040cf108c247dfc90dd966bb7c0b7
SHA1 d488d99f2b8cc0349f8ec6b64cd37a320fbbb054
SHA512 e547984f63619c0c40623f33a04361cee900ffa762a1a608cbd3f58880c4f3c1f4aaa2fb2a73b2b631a60ab50ae9461850f161b658c6562a6ae69f34eab471ab
SSDEEP 96:chmxCNM8InqvsqvJCwod51hmxCNM8InqvsEHyqvJCwor/58/v2pQHqB7gfXlUVS1:ErkUo/rkAHnorKY3B7gfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c44e58bf9c3af6f9d761a89a91356caecd0d1f2ff892d7006445bd30802e02c2
MD5 7b1040cf108c247dfc90dd966bb7c0b7
SHA1 d488d99f2b8cc0349f8ec6b64cd37a320fbbb054
SHA512 e547984f63619c0c40623f33a04361cee900ffa762a1a608cbd3f58880c4f3c1f4aaa2fb2a73b2b631a60ab50ae9461850f161b658c6562a6ae69f34eab471ab
SSDEEP 96:chmxCNM8InqvsqvJCwod51hmxCNM8InqvsEHyqvJCwor/58/v2pQHqB7gfXlUVS1:ErkUo/rkAHnorKY3B7gfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Users\All Users\Favorites\lsass.exe
Size 3.8MB
SHA256 ed9806b6ca433fa7207636e5eb27bfacf475514765712ce37b41dff6890187e9
MD5 71436e482e0d0bd7648ee96cb6936613
SHA1 71b954f5971ef7e1549a2abd7391ec841f092ac4
SHA512 5889958d772e10f42ae6667f01b2c9a5b29e6918f21d4bdce1bd7f2a256c0cf9ddc4aed430d30f7df0c9fab1713f0d981bd74220306e0769936fcb86ab537e1b
SSDEEP 98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Users\Public\Favorites\lsass.exe
Size 3.8MB
SHA256 ed9806b6ca433fa7207636e5eb27bfacf475514765712ce37b41dff6890187e9
MD5 71436e482e0d0bd7648ee96cb6936613
SHA1 71b954f5971ef7e1549a2abd7391ec841f092ac4
SHA512 5889958d772e10f42ae6667f01b2c9a5b29e6918f21d4bdce1bd7f2a256c0cf9ddc4aed430d30f7df0c9fab1713f0d981bd74220306e0769936fcb86ab537e1b
SSDEEP 98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/904-98-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

Download

memory/904-106-0x000000000289B000-0x00000000028BA000-memory.dmp

Download

memory/904-104-0x0000000002894000-0x0000000002897000-memory.dmp

Download

memory/904-102-0x000000001B770000-0x000000001BA6F000-memory.dmp

Download

memory/904-97-0x0000000002894000-0x0000000002897000-memory.dmp

Download

memory/904-86-0x000007FEEB840000-0x000007FEEC263000-memory.dmp

Download

memory/1016-57-0x0000000000870000-0x0000000000880000-memory.dmp

Download

memory/1016-59-0x00000000009B0000-0x00000000009BA000-memory.dmp

Download

memory/1016-70-0x0000000002440000-0x000000000244E000-memory.dmp

Download

memory/1016-71-0x0000000002450000-0x0000000002458000-memory.dmp

Download

memory/1016-72-0x0000000002460000-0x000000000246C000-memory.dmp

Download

memory/1016-73-0x0000000002480000-0x000000000248A000-memory.dmp

Download

memory/1016-74-0x0000000002490000-0x000000000249C000-memory.dmp

Download

memory/1016-55-0x0000000000840000-0x000000000085C000-memory.dmp

Download

memory/1016-61-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Download

memory/1016-56-0x0000000000860000-0x0000000000868000-memory.dmp

Download

memory/1016-68-0x0000000002250000-0x000000000225E000-memory.dmp

Download

memory/1016-69-0x0000000002430000-0x0000000002438000-memory.dmp

Download

memory/1016-60-0x00000000009C0000-0x0000000000A16000-memory.dmp

Download

memory/1016-54-0x0000000000050000-0x000000000041A000-memory.dmp

Download

memory/1016-66-0x0000000002230000-0x0000000002238000-memory.dmp

Download

memory/1016-58-0x0000000000990000-0x00000000009A6000-memory.dmp

Download

memory/1016-62-0x0000000000C30000-0x0000000000C42000-memory.dmp

Download

memory/1016-65-0x0000000002220000-0x0000000002228000-memory.dmp

Download

memory/1016-67-0x0000000002240000-0x000000000224A000-memory.dmp

Download

memory/1016-63-0x0000000000C60000-0x0000000000C68000-memory.dmp

Download

memory/1016-64-0x0000000000C70000-0x0000000000C7C000-memory.dmp

Download

memory/1452-95-0x00000000005F0000-0x0000000000646000-memory.dmp

Download

memory/1452-90-0x0000000000E20000-0x00000000011EA000-memory.dmp

Download

memory/1608-107-0x000000000235B000-0x000000000237A000-memory.dmp

Download

memory/1608-91-0x000007FEEB840000-0x000007FEEC263000-memory.dmp

Download

memory/1608-93-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

Download

memory/1608-103-0x0000000002354000-0x0000000002357000-memory.dmp

Download

memory/1608-99-0x000000001B700000-0x000000001B9FF000-memory.dmp

Download

memory/1608-105-0x0000000002354000-0x0000000002357000-memory.dmp

Download

memory/1608-92-0x0000000002354000-0x0000000002357000-memory.dmp

Download

memory/2000-101-0x000000000249B000-0x00000000024BA000-memory.dmp

Download

memory/2000-84-0x000007FEEB840000-0x000007FEEC263000-memory.dmp

Download

memory/2000-96-0x0000000002494000-0x0000000002497000-memory.dmp

Download

memory/2000-100-0x0000000002494000-0x0000000002497000-memory.dmp

Download

memory/2000-94-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

Download

memory/2000-79-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Download