dcrat | c98e35ff05689705117dbb7e36e58f1237f08df30637132d6e2106db1bddff77

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2023, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c98e35ff05689705117dbb7e36e58f1237f08df306371.exe
Size 7.8MB
Sample230124-wwfvvada67
SHA256 c98e35ff05689705117dbb7e36e58f1237f08df30637132d6e2106db1bddff77
MD5 09e9cefb358c55b03e898488f8d052df
SHA1 4e8a3b17d01b386e0e1442ae05d885168c1206e4
SHA512 8f80435e4f5e82465a98327c915c689ad97b66e822397b82d0b70e9d45d4158c373b33b92cb06cfefc4068e156ac0aa7012ade22b07552cbe911e41b6a44fa59
SSDEEP 196608:W5YhQECsXDjpf3ZkJMFEAJX8JvC/UcwCK:8YhQECENZkcJVw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1280	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1280	schtasks.exe	30

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000022dcd-145.dat	dcrat
behavioral2/files/0x000a000000022dcd-146.dat	dcrat
behavioral2/files/0x0006000000022de4-153.dat	dcrat
behavioral2/files/0x0006000000022de4-154.dat	dcrat
behavioral2/files/0x0006000000022de9-160.dat	dcrat
behavioral2/files/0x0006000000022de9-161.dat	dcrat
behavioral2/memory/2656-162-0x00000000008F0000-0x0000000000A42000-memory.dmp	dcrat
behavioral2/files/0x0006000000022de9-165.dat	dcrat
behavioral2/files/0x0006000000022e07-177.dat	dcrat
behavioral2/files/0x0006000000022e07-178.dat	dcrat

Executes dropped EXE 5 IoCs

pid	Process
2856	main.exe
3636	main1.exe
2656	Agentbrokerhost.exe
2572	Agentbrokerhost.exe
3200	lsass.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	main1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Agentbrokerhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	main.exe

Loads dropped DLL 4 IoCs

pid	Process
1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe
1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe
1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe
1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\conhost.exe	Agentbrokerhost.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\088424020bedd6	Agentbrokerhost.exe
File created	C:\Program Files\Google\Chrome\Application\SppExtComObj.exe	Agentbrokerhost.exe
File created	C:\Program Files\Google\Chrome\Application\e1ef82546f0b02	Agentbrokerhost.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\IME\ja-JP\Agentbrokerhost.exe	Agentbrokerhost.exe
File created	C:\Windows\WaaS\services\sppsvc.exe	Agentbrokerhost.exe
File created	C:\Windows\tracing\dllhost.exe	Agentbrokerhost.exe
File opened for modification	C:\Windows\tracing\dllhost.exe	Agentbrokerhost.exe
File created	C:\Windows\Web\4K\Wallpaper\fontdrvhost.exe	Agentbrokerhost.exe
File created	C:\Windows\IME\ja-JP\4d54b1c88a4dbc	Agentbrokerhost.exe
File created	C:\Windows\tracing\5940a34987c991	Agentbrokerhost.exe
File created	C:\Windows\Web\4K\Wallpaper\5b884080fd4f94	Agentbrokerhost.exe
File created	C:\Windows\PolicyDefinitions\it-IT\Agentbrokerhost.exe	Agentbrokerhost.exe
File created	C:\Windows\PolicyDefinitions\it-IT\4d54b1c88a4dbc	Agentbrokerhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3852	schtasks.exe
3000	schtasks.exe
3512	schtasks.exe
3176	schtasks.exe
3712	schtasks.exe
428	schtasks.exe
404	schtasks.exe
3136	schtasks.exe
2936	schtasks.exe
2076	schtasks.exe
3612	schtasks.exe
1208	schtasks.exe
3412	schtasks.exe
2460	schtasks.exe
3068	schtasks.exe
3256	schtasks.exe
4628	schtasks.exe
3232	schtasks.exe
1164	schtasks.exe
1928	schtasks.exe
2748	schtasks.exe
1144	schtasks.exe
2456	schtasks.exe
3492	schtasks.exe
4036	schtasks.exe
2036	schtasks.exe
2540	schtasks.exe
4380	schtasks.exe
5016	schtasks.exe
1844	schtasks.exe
4192	schtasks.exe
3452	schtasks.exe
2184	schtasks.exe
4752	schtasks.exe
4652	schtasks.exe
2112	schtasks.exe
4876	schtasks.exe
2836	schtasks.exe
4904	schtasks.exe
2276	schtasks.exe
4820	schtasks.exe
4144	schtasks.exe
4848	schtasks.exe
600	schtasks.exe
4784	schtasks.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	main1.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	Agentbrokerhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	main.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
2656	Agentbrokerhost.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe
3200	lsass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3200	lsass.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	Agentbrokerhost.exe
Token: SeDebugPrivilege	2572	Agentbrokerhost.exe
Token: SeDebugPrivilege	3200	lsass.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 1316	4160	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe	82
PID 4160 wrote to memory of 1316	4160	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe	82
PID 1316 wrote to memory of 1664	1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe	85
PID 1316 wrote to memory of 1664	1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe	85
PID 1664 wrote to memory of 2856	1664	cmd.exe	88
PID 1664 wrote to memory of 2856	1664	cmd.exe	88
PID 1664 wrote to memory of 2856	1664	cmd.exe	88
PID 2856 wrote to memory of 4296	2856	main.exe	89
PID 2856 wrote to memory of 4296	2856	main.exe	89
PID 2856 wrote to memory of 4296	2856	main.exe	89
PID 2856 wrote to memory of 5104	2856	main.exe	90
PID 2856 wrote to memory of 5104	2856	main.exe	90
PID 2856 wrote to memory of 5104	2856	main.exe	90
PID 1316 wrote to memory of 260	1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe	91
PID 1316 wrote to memory of 260	1316	c98e35ff05689705117dbb7e36e58f1237f08df306371.exe	91
PID 260 wrote to memory of 3636	260	cmd.exe	93
PID 260 wrote to memory of 3636	260	cmd.exe	93
PID 260 wrote to memory of 3636	260	cmd.exe	93
PID 3636 wrote to memory of 984	3636	main1.exe	94
PID 3636 wrote to memory of 984	3636	main1.exe	94
PID 3636 wrote to memory of 984	3636	main1.exe	94
PID 3636 wrote to memory of 3720	3636	main1.exe	95
PID 3636 wrote to memory of 3720	3636	main1.exe	95
PID 3636 wrote to memory of 3720	3636	main1.exe	95
PID 4296 wrote to memory of 3716	4296	WScript.exe	96
PID 4296 wrote to memory of 3716	4296	WScript.exe	96
PID 4296 wrote to memory of 3716	4296	WScript.exe	96
PID 3716 wrote to memory of 2656	3716	cmd.exe	98
PID 3716 wrote to memory of 2656	3716	cmd.exe	98
PID 984 wrote to memory of 4800	984	WScript.exe	100
PID 984 wrote to memory of 4800	984	WScript.exe	100
PID 984 wrote to memory of 4800	984	WScript.exe	100
PID 4800 wrote to memory of 2572	4800	cmd.exe	102
PID 4800 wrote to memory of 2572	4800	cmd.exe	102
PID 2656 wrote to memory of 2008	2656	Agentbrokerhost.exe	150
PID 2656 wrote to memory of 2008	2656	Agentbrokerhost.exe	150
PID 2008 wrote to memory of 3424	2008	cmd.exe	152
PID 2008 wrote to memory of 3424	2008	cmd.exe	152
PID 2008 wrote to memory of 3200	2008	cmd.exe	153
PID 2008 wrote to memory of 3200	2008	cmd.exe	153

C:\Users\Admin\AppData\Local\Temp\c98e35ff05689705117dbb7e36e58f1237f08df306371.exe
"C:\Users\Admin\AppData\Local\Temp\c98e35ff05689705117dbb7e36e58f1237f08df306371.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\c98e35ff05689705117dbb7e36e58f1237f08df306371.exe
  "C:\Users\Admin\AppData\Local\Temp\c98e35ff05689705117dbb7e36e58f1237f08df306371.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\\main.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\main.exe
      C:\\main.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperReviewsvc\tSkbM8Kgd45HNZU2lIsTAW.vbe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\hyperReviewsvc\ds6dhr0GsXgFgRJynyVxU1.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe
        
        "C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J8xCQcsPs3.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3424
        
        C:\Recovery\WindowsRE\lsass.exe
        
        "C:\Recovery\WindowsRE\lsass.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperReviewsvc\file.vbs"
        5⤵
        
        PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\\main1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\main1.exe
      C:\\main1.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperReviewsvc\tSkbM8Kgd45HNZU2lIsTAW.vbe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:984
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\hyperReviewsvc\ds6dhr0GsXgFgRJynyVxU1.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe
        
        "C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperReviewsvc\file.vbs"
        5⤵
        
        PID:3720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\tracing\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\tracing\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\odt\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\odt\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\odt\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\4K\Wallpaper\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Web\4K\Wallpaper\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\Web\4K\Wallpaper\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AgentbrokerhostA" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\it-IT\Agentbrokerhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Agentbrokerhost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\it-IT\Agentbrokerhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AgentbrokerhostA" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\it-IT\Agentbrokerhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\odt\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\odt\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AgentbrokerhostA" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\ja-JP\Agentbrokerhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Agentbrokerhost" /sc ONLOGON /tr "'C:\Windows\IME\ja-JP\Agentbrokerhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AgentbrokerhostA" /sc MINUTE /mo 10 /tr "'C:\Windows\IME\ja-JP\Agentbrokerhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Recovery\WindowsRE\lsass.exe
Size 1.3MB
SHA256 b7976a3465d72517957a09a6e595980a2ab4f3079a9b9bbd3cf4758776409ce1
MD5 b6b8ed3f241a8ec6c92614939819f96e
SHA1 36ba697c15cc03e6547e940058655b29c8a467f7
SHA512 a99f1a8493db96d9b902a97b2d05f8e18465a8da52c6ea52fb354056c8da06cdd9c5b23db2309e8a3f920f7a61b937f0c940c9de76940d4b4e15769599bcde6d
SSDEEP 24576:trtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5ud:VtDUn1WZzx5yKd8tR4vARj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Recovery\WindowsRE\lsass.exe
Size 1.3MB
SHA256 b7976a3465d72517957a09a6e595980a2ab4f3079a9b9bbd3cf4758776409ce1
MD5 b6b8ed3f241a8ec6c92614939819f96e
SHA1 36ba697c15cc03e6547e940058655b29c8a467f7
SHA512 a99f1a8493db96d9b902a97b2d05f8e18465a8da52c6ea52fb354056c8da06cdd9c5b23db2309e8a3f920f7a61b937f0c940c9de76940d4b4e15769599bcde6d
SSDEEP 24576:trtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5ud:VtDUn1WZzx5yKd8tR4vARj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agentbrokerhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Agentbrokerhost.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

J8xCQcsPs3.bat

Path C:\Users\Admin\AppData\Local\Temp\J8xCQcsPs3.bat
Size 196B
SHA256 663b2be342e999dae354ae619a4fcb26e84b72759008d8772f632ab4651d6588
MD5 39bad0db3233f946910817bb8dc799c9
SHA1 06fdf273544babb2d234160252d8b605ad423c86
SHA512 c37f5dc895db1f17f5288e76b5103f05a49fe6a375272014052e705a6b92c9940d8795c5b618cf8b7adf876f72950984cbdc790326508ece93675346735d150c
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\_bz2.pyd
Size 84KB
SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
MD5 e91b4f8e1592da26bacaceb542a220a8
SHA1 5459d4c2147fa6db75211c3ec6166b869738bd38
SHA512 cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9
SSDEEP 1536:5XZb8z78wjtQYeO9vDTwE0UaDnV8AQ6HiI37mZIyMVm/yH:5pAzjXeovDsE0UaDnaAQ6HiI3SZIyMVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\_bz2.pyd
Size 84KB
SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
MD5 e91b4f8e1592da26bacaceb542a220a8
SHA1 5459d4c2147fa6db75211c3ec6166b869738bd38
SHA512 cb797fa758c65358e5b0fef739181f6b39e0629758a6f8d5c4bd7dc6422001769a19df0c746724fb2567a58708b18bbd098327bfbdf3378426049b113eb848e9
SSDEEP 1536:5XZb8z78wjtQYeO9vDTwE0UaDnV8AQ6HiI37mZIyMVm/yH:5pAzjXeovDsE0UaDnaAQ6HiI3SZIyMVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\_lzma.pyd
Size 159KB
SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
MD5 493c33ddf375b394b648c4283b326481
SHA1 59c87ee582ba550f064429cb26ad79622c594f08
SHA512 a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2
SSDEEP 3072:ajV4pA1vcDRI45a4I9ihQsDPGAznfo9mNo6ndir1NZIyD1UsVM:ajV4pA10Dj5azDePlwYO6cr1NFVM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\_lzma.pyd
Size 159KB
SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
MD5 493c33ddf375b394b648c4283b326481
SHA1 59c87ee582ba550f064429cb26ad79622c594f08
SHA512 a4a83f04c7fc321796ce6a932d572dca1ad6ecefd31002320aeaa2453701ed49ef9f0d9ba91c969737565a6512b94fbb0311aee53d355345a03e98f43e6f98b2
SSDEEP 3072:ajV4pA1vcDRI45a4I9ihQsDPGAznfo9mNo6ndir1NZIyD1UsVM:ajV4pA10Dj5azDePlwYO6cr1NFVM
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\base_library.zip
Size 1012KB
SHA256 b1eb88441c0c413e7f3cf1db4114c403e0ace1ae0dbe3c285804347241720166
MD5 82a7ff1c3fd2a685d48a2d8901286eba
SHA1 4327631bbc3d7fb79bc5562c1ce2d7389000f2f1
SHA512 7129f500c594a5ce36fbee54a3dd8b90984fe9512d043bad270c6b094221b014b5dbee6974a74461d0dd937d6fcbc06d16ab7192eaa5e8b9bc563fe2516220f2
SSDEEP 24576:Phia1ONQcosQNRs54PK4ItkVwHEfVEZIXgettE0w:Phia1OCcosQNRs54PK4IbILt4
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\main.zip
Size 2.1MB
SHA256 fef0d4804c2faa0a67dd917067e87cbe46a9f64f0d38898cfb0c75d8986088f8
MD5 123877dd77c88c247d34baecf8d4dc8f
SHA1 0e4599e431f1bd6bb986faa06fd45f8ee0319673
SHA512 ac77040953760edb9bb3ee8186b2b2c59ee8be5174e03d454ed729fde0380b0146cc77a637b476aec7885b8ef52a3b2b7f24feeb3f8cb24fd5a28d83acd13e85
SSDEEP 49152:kI3YZOrcdAIWDhMrtDOrELi6NXJPhwKz+cCZNKpT4MmYL8:jYuNIW96gP6tJPB+cC6TQYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\python39.dll
Size 4.3MB
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f
SSDEEP 49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBl:RQkQ7o/Qeef6K3AroFVvrHRMRLwbCP
MD5 SHA1 SHA512 SSDEEP

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41602\python39.dll
Size 4.3MB
SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
MD5 5cd203d356a77646856341a0c9135fc6
SHA1 a1f4ac5cc2f5ecb075b3d0129e620784814a48f7
SHA512 390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f
SSDEEP 49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBl:RQkQ7o/Qeef6K3AroFVvrHRMRLwbCP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agentbrokerhost.exe

Path C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe
Size 1.3MB
SHA256 b7976a3465d72517957a09a6e595980a2ab4f3079a9b9bbd3cf4758776409ce1
MD5 b6b8ed3f241a8ec6c92614939819f96e
SHA1 36ba697c15cc03e6547e940058655b29c8a467f7
SHA512 a99f1a8493db96d9b902a97b2d05f8e18465a8da52c6ea52fb354056c8da06cdd9c5b23db2309e8a3f920f7a61b937f0c940c9de76940d4b4e15769599bcde6d
SSDEEP 24576:trtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5ud:VtDUn1WZzx5yKd8tR4vARj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agentbrokerhost.exe

Path C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe
Size 1.3MB
SHA256 b7976a3465d72517957a09a6e595980a2ab4f3079a9b9bbd3cf4758776409ce1
MD5 b6b8ed3f241a8ec6c92614939819f96e
SHA1 36ba697c15cc03e6547e940058655b29c8a467f7
SHA512 a99f1a8493db96d9b902a97b2d05f8e18465a8da52c6ea52fb354056c8da06cdd9c5b23db2309e8a3f920f7a61b937f0c940c9de76940d4b4e15769599bcde6d
SSDEEP 24576:trtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5ud:VtDUn1WZzx5yKd8tR4vARj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agentbrokerhost.exe

Path C:\Users\Admin\AppData\Roaming\hyperReviewsvc\Agentbrokerhost.exe
Size 1.3MB
SHA256 b7976a3465d72517957a09a6e595980a2ab4f3079a9b9bbd3cf4758776409ce1
MD5 b6b8ed3f241a8ec6c92614939819f96e
SHA1 36ba697c15cc03e6547e940058655b29c8a467f7
SHA512 a99f1a8493db96d9b902a97b2d05f8e18465a8da52c6ea52fb354056c8da06cdd9c5b23db2309e8a3f920f7a61b937f0c940c9de76940d4b4e15769599bcde6d
SSDEEP 24576:trtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5ud:VtDUn1WZzx5yKd8tR4vARj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ds6dhr0GsXgFgRJynyVxU1.bat

Path C:\Users\Admin\AppData\Roaming\hyperReviewsvc\ds6dhr0GsXgFgRJynyVxU1.bat
Size 46B
SHA256 1e0b86cf353bc25005f07930e896b913a967b33edaa97776e48ca0d6111b999a
MD5 fe96d641dd5093cd3752a9cc51b3b2f5
SHA1 32d760110d0ea649ce22b4efc4e2f2545ba51fe7
SHA512 02265faec82c67f3969ee4793471c109176cd197c27847f3f1d78d48f872dd13003c106481a4d166d84cffee1a992681b55c3bdf9bb823acedc12b858ade83e7
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Roaming\hyperReviewsvc\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

tSkbM8Kgd45HNZU2lIsTAW.vbe

Path C:\Users\Admin\AppData\Roaming\hyperReviewsvc\tSkbM8Kgd45HNZU2lIsTAW.vbe
Size 220B
SHA256 b12df8d67bb03ccfa0251341ba18ee05a3331768062be4b79b12ed3675279aaa
MD5 b32277a5411e9a2fc74244b09baef5dd
SHA1 b3bb4bd83f5cb716dc44a64e3a0efaa53347f58a
SHA512 50179c1a2f6a22bd12985c7356edcdb396c8fad8706e0bdc7e77d57ea671706350df2f26a9fbc4490d7f65737d7dc396f73442fb32f0f1c25c90912ef6364075
MD5 SHA1 SHA512

Submit Download

main.exe

Path C:\main.exe
Size 1.6MB
SHA256 d2292ddd2e8a43d635bb060db6633e6ce62dd078ab8a0a62636b717f234fc69b
MD5 72424a924263141e04f605b0a8b1efa2
SHA1 f77690345b00318d5f27917b25d4cf98d9d22528
SHA512 6010f07ce47d41f762af0c2b0829cbc103d688edf3461b4f7db3ceb1d5d03e1d64b5b6730fb7592e5e1f358359a8d8051e8e434c9f4b2e7ed838db90ef8db83e
SSDEEP 24576:U2G/nvxW3Ww0tXrtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5udE:UbA30btDUn1WZzx5yKd8tR4vARjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.exe

Path C:\main.exe
Size 1.6MB
SHA256 d2292ddd2e8a43d635bb060db6633e6ce62dd078ab8a0a62636b717f234fc69b
MD5 72424a924263141e04f605b0a8b1efa2
SHA1 f77690345b00318d5f27917b25d4cf98d9d22528
SHA512 6010f07ce47d41f762af0c2b0829cbc103d688edf3461b4f7db3ceb1d5d03e1d64b5b6730fb7592e5e1f358359a8d8051e8e434c9f4b2e7ed838db90ef8db83e
SSDEEP 24576:U2G/nvxW3Ww0tXrtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5udE:UbA30btDUn1WZzx5yKd8tR4vARjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

main1.exe

Path C:\main1.exe
Size 1.6MB
SHA256 d2292ddd2e8a43d635bb060db6633e6ce62dd078ab8a0a62636b717f234fc69b
MD5 72424a924263141e04f605b0a8b1efa2
SHA1 f77690345b00318d5f27917b25d4cf98d9d22528
SHA512 6010f07ce47d41f762af0c2b0829cbc103d688edf3461b4f7db3ceb1d5d03e1d64b5b6730fb7592e5e1f358359a8d8051e8e434c9f4b2e7ed838db90ef8db83e
SSDEEP 24576:U2G/nvxW3Ww0tXrtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5udE:UbA30btDUn1WZzx5yKd8tR4vARjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

main1.exe

Path C:\main1.exe
Size 1.6MB
SHA256 d2292ddd2e8a43d635bb060db6633e6ce62dd078ab8a0a62636b717f234fc69b
MD5 72424a924263141e04f605b0a8b1efa2
SHA1 f77690345b00318d5f27917b25d4cf98d9d22528
SHA512 6010f07ce47d41f762af0c2b0829cbc103d688edf3461b4f7db3ceb1d5d03e1d64b5b6730fb7592e5e1f358359a8d8051e8e434c9f4b2e7ed838db90ef8db83e
SSDEEP 24576:U2G/nvxW3Ww0tXrtDUn1WZ9px5LtkKTEFkyWUXPA8tIA0dtvAC1tyN5udE:UbA30btDUn1WZzx5yKd8tR4vARjd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2572-175-0x00007FFA22640000-0x00007FFA23101000-memory.dmp

Download

memory/2572-169-0x00007FFA22640000-0x00007FFA23101000-memory.dmp

Download

memory/2656-162-0x00000000008F0000-0x0000000000A42000-memory.dmp

Download

memory/2656-173-0x00007FFA22640000-0x00007FFA23101000-memory.dmp

Download

memory/2656-166-0x00007FFA22640000-0x00007FFA23101000-memory.dmp

Download

memory/2656-167-0x0000000002CA0000-0x0000000002CF0000-memory.dmp

Download

memory/2656-168-0x000000001D9F0000-0x000000001DF18000-memory.dmp

Download

memory/3200-179-0x00007FFA22640000-0x00007FFA23101000-memory.dmp

Download

memory/3200-180-0x00007FFA22640000-0x00007FFA23101000-memory.dmp

Download