warzonerat | f520f6f73efb0658ac2ee9c61cff3bc8d95f2ab0853ef6bee3edbdfb3db7d3fc

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2023, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 581KB
Sample230126-q4nyjadh29
SHA256 f520f6f73efb0658ac2ee9c61cff3bc8d95f2ab0853ef6bee3edbdfb3db7d3fc
MD5 c5559921fdf3950c63cba88ca2efd7e2
SHA1 4a58b42c2a82ff43d42eedc93becf741f4017c33
SHA512 fb151b2a1d4328ab5600d410afa48d248879d55b4ed67daab8ea446f78fb249c3292615eef4c0d35a3042bc12cde7885667e9f67e4f6275cd8d9af7bbd716a8b
SSDEEP 12288:CMjmOVDf3DES1C0MYE1/8GIG++F5IBRKYWTHK:CMlD9CIEGG+Ruq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat evasion infostealer persistence rat upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\klnvand.exe,"	reg.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 4 IoCs

pid	Process
1948	klnvand.exe
1428	aQbbNbh.exe
4952	13.exe
5024	aQbbNbh.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2540	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll"	AddInProcess32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022e8a-160.dat	upx
behavioral2/files/0x0008000000022e8a-159.dat	upx
behavioral2/memory/4952-163-0x0000000000C10000-0x0000000000C3D000-memory.dmp	upx
behavioral2/memory/4952-173-0x0000000000C10000-0x0000000000C3D000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	klnvand.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	aQbbNbh.exe

Loads dropped DLL 1 IoCs

pid	Process
4752	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 3712	1948	klnvand.exe	101

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	AddInProcess32.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	AddInProcess32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1468	PING.EXE
2212	PING.EXE
4724	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
4588	file.exe
1948	klnvand.exe
1948	klnvand.exe
1948	klnvand.exe
1948	klnvand.exe
1948	klnvand.exe
1948	klnvand.exe
1948	klnvand.exe
1428	aQbbNbh.exe
5024	aQbbNbh.exe
5024	aQbbNbh.exe
5024	aQbbNbh.exe
1948	klnvand.exe
1948	klnvand.exe
4752	svchost.exe
4752	svchost.exe
4752	svchost.exe
4752	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
644	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	file.exe
Token: SeDebugPrivilege	1948	klnvand.exe
Token: 33	2612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2612	AUDIODG.EXE
Token: SeDebugPrivilege	1428	aQbbNbh.exe
Token: SeDebugPrivilege	5024	aQbbNbh.exe
Token: SeDebugPrivilege	3712	AddInProcess32.exe
Token: SeAuditPrivilege	4752	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 2180	4588	file.exe	83
PID 4588 wrote to memory of 2180	4588	file.exe	83
PID 4588 wrote to memory of 2180	4588	file.exe	83
PID 2180 wrote to memory of 1468	2180	cmd.exe	85
PID 2180 wrote to memory of 1468	2180	cmd.exe	85
PID 2180 wrote to memory of 1468	2180	cmd.exe	85
PID 4588 wrote to memory of 5028	4588	file.exe	86
PID 4588 wrote to memory of 5028	4588	file.exe	86
PID 4588 wrote to memory of 5028	4588	file.exe	86
PID 5028 wrote to memory of 2212	5028	cmd.exe	88
PID 5028 wrote to memory of 2212	5028	cmd.exe	88
PID 5028 wrote to memory of 2212	5028	cmd.exe	88
PID 2180 wrote to memory of 4860	2180	cmd.exe	93
PID 2180 wrote to memory of 4860	2180	cmd.exe	93
PID 2180 wrote to memory of 4860	2180	cmd.exe	93
PID 5028 wrote to memory of 4724	5028	cmd.exe	96
PID 5028 wrote to memory of 4724	5028	cmd.exe	96
PID 5028 wrote to memory of 4724	5028	cmd.exe	96
PID 5028 wrote to memory of 1948	5028	cmd.exe	98
PID 5028 wrote to memory of 1948	5028	cmd.exe	98
PID 5028 wrote to memory of 1948	5028	cmd.exe	98
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 1208	1948	klnvand.exe	99
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 2736	1948	klnvand.exe	100
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 3712	1948	klnvand.exe	101
PID 1948 wrote to memory of 1428	1948	klnvand.exe	104
PID 1948 wrote to memory of 1428	1948	klnvand.exe	104
PID 1948 wrote to memory of 1428	1948	klnvand.exe	104
PID 3712 wrote to memory of 4952	3712	AddInProcess32.exe	105
PID 3712 wrote to memory of 4952	3712	AddInProcess32.exe	105
PID 3712 wrote to memory of 4952	3712	AddInProcess32.exe	105
PID 4952 wrote to memory of 2540	4952	13.exe	107
PID 4952 wrote to memory of 2540	4952	13.exe	107
PID 4952 wrote to memory of 2540	4952	13.exe	107
PID 1428 wrote to memory of 5024	1428	aQbbNbh.exe	108

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\klnvand.exe,"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 10
    3⤵
    - Runs ping.exe
    PID:1468
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\klnvand.exe,"
    3⤵
    - Modifies WinLogon for persistence
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Local\Temp\file.exe" "C:\Users\Admin\AppData\Roaming\klnvand.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\AppData\Roaming\klnvand.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 18
    3⤵
    - Runs ping.exe
    PID:2212
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 18
    3⤵
    - Runs ping.exe
    PID:4724
- - C:\Users\Admin\AppData\Roaming\klnvand.exe
    "C:\Users\Admin\AppData\Roaming\klnvand.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:1208
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:2736
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      Sets DLL path for service in the registry
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\13.exe
        
        "C:\Users\Admin\AppData\Local\Temp\13.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4952
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
        6⤵
        Modifies Windows Firewall
        
        PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe
      "C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5024

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4dc 0x240
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlmap.dll

Path C:\Program Files\Microsoft DN1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

aQbbNbh.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aQbbNbh.exe.log
Size 1KB
SHA256 90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c
MD5 7dca233df92b3884663fa5a40db8d49c
SHA1 208b8f27b708c4e06ac37f974471cc7b29c29b60
SHA512 d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07
MD5 SHA1 SHA512

Submit Download

13.exe

Path C:\Users\Admin\AppData\Local\Temp\13.exe
Size 70KB
SHA256 0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
MD5 ca96229390a0e6a53e8f2125f2c01114
SHA1 a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA512 e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
SSDEEP 1536:tjL6b1xoQ66K+jLMqPHULq87qdGN2B30GfDQ+1FIRXWHH0:t0BVbjQaNpd82xpLQ+126H0
MD5 SHA1 SHA512 SSDEEP

Submit Download

13.exe

Path C:\Users\Admin\AppData\Local\Temp\13.exe
Size 70KB
SHA256 0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
MD5 ca96229390a0e6a53e8f2125f2c01114
SHA1 a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA512 e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
SSDEEP 1536:tjL6b1xoQ66K+jLMqPHULq87qdGN2B30GfDQ+1FIRXWHH0:t0BVbjQaNpd82xpLQ+126H0
MD5 SHA1 SHA512 SSDEEP

Submit Download

aQbbNbh.exe

Path C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aQbbNbh.exe

Path C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aQbbNbh.exe

Path C:\Users\Admin\AppData\Local\Temp\aQbbNbh.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

aQbbNbh.txt

Path C:\Users\Admin\AppData\Local\Temp\aQbbNbh.txt
Size 56B
SHA256 f3ccd19479b83dcb8599e216abd231c604153a9056ca498649cabde1eb7ba428
MD5 96b24e15c831cfe6da8450b5f4c46e94
SHA1 9b0bca2f1849e3d5e1363ade13179609413cdfbf
SHA512 fa2a6e5b6880d9e8f78b7c2beca60ed975cf5d97703db51c045ac36afb70babb60c704203a5a67a160c0cc18ee3f07eedbcfc698d47d4ea8e603230b13e6f603
MD5 SHA1 SHA512

Submit Download

aQbbNbh.txt

Path C:\Users\Admin\AppData\Local\Temp\aQbbNbh.txt
Size 56B
SHA256 7ff2e229363df30cdc189cccfff8e324087830569141012310cf7b173944a6d7
MD5 c9fa16c5bed0cfd52f231bfc46e69683
SHA1 09a20bb25edcc80239add4eab92a8c9b97094ed8
SHA512 5e9d8f2d147cd317b392e3a2d84d41a672303ac90eb33d5f30f84dc6c0e1ef328d90e6d295987fe9f8a55946e9876a44ba9b3b2bcace22e02aa1c03a0bba95fa
MD5 SHA1 SHA512

Submit Download

aQbbNbh.txt

Path C:\Users\Admin\AppData\Local\Temp\aQbbNbh.txt
Size 56B
SHA256 7ff2e229363df30cdc189cccfff8e324087830569141012310cf7b173944a6d7
MD5 c9fa16c5bed0cfd52f231bfc46e69683
SHA1 09a20bb25edcc80239add4eab92a8c9b97094ed8
SHA512 5e9d8f2d147cd317b392e3a2d84d41a672303ac90eb33d5f30f84dc6c0e1ef328d90e6d295987fe9f8a55946e9876a44ba9b3b2bcace22e02aa1c03a0bba95fa
MD5 SHA1 SHA512

Submit Download

klnvand.exe

Path C:\Users\Admin\AppData\Roaming\klnvand.exe
Size 581KB
SHA256 f520f6f73efb0658ac2ee9c61cff3bc8d95f2ab0853ef6bee3edbdfb3db7d3fc
MD5 c5559921fdf3950c63cba88ca2efd7e2
SHA1 4a58b42c2a82ff43d42eedc93becf741f4017c33
SHA512 fb151b2a1d4328ab5600d410afa48d248879d55b4ed67daab8ea446f78fb249c3292615eef4c0d35a3042bc12cde7885667e9f67e4f6275cd8d9af7bbd716a8b
SSDEEP 12288:CMjmOVDf3DES1C0MYE1/8GIG++F5IBRKYWTHK:CMlD9CIEGG+Ruq
MD5 SHA1 SHA512 SSDEEP

Submit Download

klnvand.exe

Path C:\Users\Admin\AppData\Roaming\klnvand.exe
Size 581KB
SHA256 f520f6f73efb0658ac2ee9c61cff3bc8d95f2ab0853ef6bee3edbdfb3db7d3fc
MD5 c5559921fdf3950c63cba88ca2efd7e2
SHA1 4a58b42c2a82ff43d42eedc93becf741f4017c33
SHA512 fb151b2a1d4328ab5600d410afa48d248879d55b4ed67daab8ea446f78fb249c3292615eef4c0d35a3042bc12cde7885667e9f67e4f6275cd8d9af7bbd716a8b
SSDEEP 12288:CMjmOVDf3DES1C0MYE1/8GIG++F5IBRKYWTHK:CMlD9CIEGG+Ruq
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdpwrap.ini

Path \??\c:\program files\microsoft dn1\rdpwrap.ini
Size 299KB
SHA256 1c4930123ec2a809b3bd93969967d6c321d8d65fc7b886e062b2581c741944e5
MD5 fca6ba93c780afa00a5703df9ac65754
SHA1 3ed423763fdd9722ff8bed3667ffa93f77390138
SHA512 538b0995be3796737575a2fd3aaa1644b3e6566e4cd5ed5c4df9e0a586368e7ceea8f0284de53f7c3f0874fc90b9a194d2ea1438bc9d7779eb12d00b8807f595
SSDEEP 768:yUiQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb5x8Rr/d6gl/+f8jZ0ftlFi4p7QK:fjt33L+McIiG4IvREWddadl/Fj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlmap.dll

Path \??\c:\program files\microsoft dn1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1428-157-0x00000000005D0000-0x00000000005EA000-memory.dmp

Download

memory/1948-146-0x00000000003D0000-0x0000000000468000-memory.dmp

Download

memory/3712-153-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/3712-152-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/3712-150-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/3712-172-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4588-132-0x0000000000FF0000-0x0000000001088000-memory.dmp

Download

memory/4588-136-0x000000000BFE0000-0x000000000BFEA000-memory.dmp

Download

memory/4588-135-0x0000000005480000-0x000000000551C000-memory.dmp

Download

memory/4588-134-0x00000000053E0000-0x0000000005472000-memory.dmp

Download

memory/4588-133-0x0000000005B30000-0x00000000060D4000-memory.dmp

Download

memory/4952-163-0x0000000000C10000-0x0000000000C3D000-memory.dmp

Download

memory/4952-173-0x0000000000C10000-0x0000000000C3D000-memory.dmp

Download