quasar | f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6

Analysis

max time kernel
43s
max time network
91s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe
Size

11.3MB
MD5

73227127a3d640f47ee9155ca93376ea
SHA1

2bdec123a95cee29753f4f8262d1c8aee4373b54
SHA256

f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6
SHA512

513fb2743cd508be198edb932341608bc5177aa9153fe5d37f7450c2dfe060b4417d4dd4e72c80bad6c7ff6ee56652a2e353271de7b5ae2278af4fa5361167cc
SSDEEP

196608:08U2MU8vvO95NZVDmCvsjtXje8rJFrF49/zMMnJ1WkGAEGVPMDPjcHdB6UE14:0z2F8gnVCze8nrmhJ4kGAEjPj+dBo14

Score

10^/10

quasar venomrat jarmoir evasion pyinstaller rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Jarmoir

extra-large-step.auto.playit.gg:41705

Mutex

VNM_MUTEX_C21ZcJOFvO32vviyP0

Attributes

encryption_key
itjIdJFadVQmRz5fsUXr
install_name
$77boniarz.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Update
subdirectory
System32

Signatures

Contains code to disable Windows Defender 11 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\$77-Venom1.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\$77-Venom1.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\$77-Venom1.exe	disable_win_def
behavioral1/memory/952-60-0x0000000000A00000-0x0000000000A8C000-memory.dmp	disable_win_def
\Windows\SysWOW64\System32\$77boniarz.exe	disable_win_def
behavioral1/memory/292-128-0x00000000011B0000-0x000000000123C000-memory.dmp	disable_win_def
C:\Windows\SysWOW64\System32\$77boniarz.exe	disable_win_def
C:\Windows\SysWOW64\System32\$77boniarz.exe	disable_win_def
\Windows\SysWOW64\System32\$77boniarz.exe	disable_win_def
\Windows\SysWOW64\System32\$77boniarz.exe	disable_win_def
behavioral1/memory/1608-147-0x00000000002D0000-0x000000000035C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

$77-Venom1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	$77-Venom1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	$77-Venom1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	$77-Venom1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	$77-Venom1.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 11 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\$77-Venom1.exe	family_quasar
C:\Users\Admin\AppData\Roaming\$77-Venom1.exe	family_quasar
C:\Users\Admin\AppData\Roaming\$77-Venom1.exe	family_quasar
behavioral1/memory/952-60-0x0000000000A00000-0x0000000000A8C000-memory.dmp	family_quasar
\Windows\SysWOW64\System32\$77boniarz.exe	family_quasar
behavioral1/memory/292-128-0x00000000011B0000-0x000000000123C000-memory.dmp	family_quasar
C:\Windows\SysWOW64\System32\$77boniarz.exe	family_quasar
C:\Windows\SysWOW64\System32\$77boniarz.exe	family_quasar
\Windows\SysWOW64\System32\$77boniarz.exe	family_quasar
\Windows\SysWOW64\System32\$77boniarz.exe	family_quasar
behavioral1/memory/1608-147-0x00000000002D0000-0x000000000035C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Executes dropped EXE 5 IoCs

Processes:

$77-Venom1.exeN̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exeN̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe$77boniarz.exe$77-Venom1.exe

pid process

952 $77-Venom1.exe
1568 N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680 N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
292 $77boniarz.exe
1608 $77-Venom1.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

584 cmd.exe

pid	process
952	$77-Venom1.exe
1568	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
292	$77boniarz.exe
1608	$77-Venom1.exe

pid	process
584	cmd.exe

Loads dropped DLL 31 IoCs

Processes:

f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exeN̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe$77-Venom1.exeWerFault.exe

pid	process
2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe
2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
952	$77-Venom1.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

$77-Venom1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	$77-Venom1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	$77-Venom1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Drops file in System32 directory 5 IoCs

Processes:

$77-Venom1.exe$77boniarz.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\System32\$77boniarz.exe	$77-Venom1.exe
File opened for modification	C:\Windows\SysWOW64\System32\$77boniarz.exe	$77boniarz.exe
File opened for modification	C:\Windows\SysWOW64\System32	$77boniarz.exe
File created	C:\Windows\SysWOW64\System32\r77-x64.dll	$77-Venom1.exe
File created	C:\Windows\SysWOW64\System32\$77boniarz.exe	$77-Venom1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

pid process

1680 N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

pid	process
1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1156 292 WerFault.exe $77boniarz.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1768 schtasks.exe
912 schtasks.exe

pid	pid_target	process	target process
1156	292	WerFault.exe	$77boniarz.exe

pid	process
1768	schtasks.exe
912	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

$77-Venom1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	$77-Venom1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	$77-Venom1.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1928 PING.EXE
1840 PING.EXE

pid	process
1928	PING.EXE
1840	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exe$77-Venom1.exe$77-Venom1.exe

pid	process
1580	powershell.exe
952	$77-Venom1.exe
952	$77-Venom1.exe
952	$77-Venom1.exe
952	$77-Venom1.exe
952	$77-Venom1.exe
952	$77-Venom1.exe
952	$77-Venom1.exe
1608	$77-Venom1.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe$77-Venom1.exepowershell.exe$77boniarz.exe$77-Venom1.exe

description	pid	process
Token: 35	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
Token: SeDebugPrivilege	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
Token: SeDebugPrivilege	952	$77-Venom1.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	292	$77boniarz.exe
Token: SeDebugPrivilege	292	$77boniarz.exe
Token: SeDebugPrivilege	1608	$77-Venom1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

$77boniarz.exe

pid process

292 $77boniarz.exe

pid	process
292	$77boniarz.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exeN̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exeN̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe$77-Venom1.exe$77boniarz.execmd.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 952	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	$77-Venom1.exe
PID 2008 wrote to memory of 952	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	$77-Venom1.exe
PID 2008 wrote to memory of 952	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	$77-Venom1.exe
PID 2008 wrote to memory of 952	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	$77-Venom1.exe
PID 2008 wrote to memory of 1568	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 2008 wrote to memory of 1568	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 2008 wrote to memory of 1568	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 2008 wrote to memory of 1568	2008	f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 1568 wrote to memory of 1680	1568	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 1568 wrote to memory of 1680	1568	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 1568 wrote to memory of 1680	1568	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
PID 1680 wrote to memory of 1400	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 1400	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 1400	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 1908	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 1908	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 1908	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 984	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 984	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 1680 wrote to memory of 984	1680	N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe	cmd.exe
PID 952 wrote to memory of 1768	952	$77-Venom1.exe	schtasks.exe
PID 952 wrote to memory of 1768	952	$77-Venom1.exe	schtasks.exe
PID 952 wrote to memory of 1768	952	$77-Venom1.exe	schtasks.exe
PID 952 wrote to memory of 1768	952	$77-Venom1.exe	schtasks.exe
PID 952 wrote to memory of 292	952	$77-Venom1.exe	$77boniarz.exe
PID 952 wrote to memory of 292	952	$77-Venom1.exe	$77boniarz.exe
PID 952 wrote to memory of 292	952	$77-Venom1.exe	$77boniarz.exe
PID 952 wrote to memory of 292	952	$77-Venom1.exe	$77boniarz.exe
PID 952 wrote to memory of 1580	952	$77-Venom1.exe	powershell.exe
PID 952 wrote to memory of 1580	952	$77-Venom1.exe	powershell.exe
PID 952 wrote to memory of 1580	952	$77-Venom1.exe	powershell.exe
PID 952 wrote to memory of 1580	952	$77-Venom1.exe	powershell.exe
PID 292 wrote to memory of 912	292	$77boniarz.exe	schtasks.exe
PID 292 wrote to memory of 912	292	$77boniarz.exe	schtasks.exe
PID 292 wrote to memory of 912	292	$77boniarz.exe	schtasks.exe
PID 292 wrote to memory of 912	292	$77boniarz.exe	schtasks.exe
PID 292 wrote to memory of 1060	292	$77boniarz.exe	cmd.exe
PID 292 wrote to memory of 1060	292	$77boniarz.exe	cmd.exe
PID 292 wrote to memory of 1060	292	$77boniarz.exe	cmd.exe
PID 292 wrote to memory of 1060	292	$77boniarz.exe	cmd.exe
PID 292 wrote to memory of 1156	292	$77boniarz.exe	WerFault.exe
PID 292 wrote to memory of 1156	292	$77boniarz.exe	WerFault.exe
PID 292 wrote to memory of 1156	292	$77boniarz.exe	WerFault.exe
PID 292 wrote to memory of 1156	292	$77boniarz.exe	WerFault.exe
PID 1060 wrote to memory of 1016	1060	cmd.exe	chcp.com
PID 1060 wrote to memory of 1016	1060	cmd.exe	chcp.com
PID 1060 wrote to memory of 1016	1060	cmd.exe	chcp.com
PID 1060 wrote to memory of 1016	1060	cmd.exe	chcp.com
PID 1060 wrote to memory of 1928	1060	cmd.exe	PING.EXE
PID 1060 wrote to memory of 1928	1060	cmd.exe	PING.EXE
PID 1060 wrote to memory of 1928	1060	cmd.exe	PING.EXE
PID 1060 wrote to memory of 1928	1060	cmd.exe	PING.EXE
PID 952 wrote to memory of 1560	952	$77-Venom1.exe	cmd.exe
PID 952 wrote to memory of 1560	952	$77-Venom1.exe	cmd.exe
PID 952 wrote to memory of 1560	952	$77-Venom1.exe	cmd.exe
PID 952 wrote to memory of 1560	952	$77-Venom1.exe	cmd.exe
PID 1560 wrote to memory of 584	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 584	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 584	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 584	1560	cmd.exe	cmd.exe
PID 952 wrote to memory of 652	952	$77-Venom1.exe	cmd.exe
PID 952 wrote to memory of 652	952	$77-Venom1.exe	cmd.exe
PID 952 wrote to memory of 652	952	$77-Venom1.exe	cmd.exe
PID 952 wrote to memory of 652	952	$77-Venom1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe
"C:\Users\Admin\AppData\Local\Temp\f700dbb00b021ec7aae45730deae300139cc3e644d6375d7d9d2a6d2330bb0d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Roaming\$77-Venom1.exe
  "C:\Users\Admin\AppData\Roaming\$77-Venom1.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Drops file in System32 directory
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$77-Venom1.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1768
- - C:\Windows\SysWOW64\System32\$77boniarz.exe
    "C:\Windows\SysWOW64\System32\$77boniarz.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:292
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Windows\SysWOW64\System32\$77boniarz.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\D11G3gEyQpnn.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1016
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:1928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 292 -s 1512
      4⤵
      Loads dropped DLL
      Program crash
      PID:1156
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      Deletes itself
      PID:584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\OhQHhbXvZD6I.bat" "
    3⤵
    PID:652
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:268
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1840
  - - C:\Users\Admin\AppData\Roaming\$77-Venom1.exe
      "C:\Users\Admin\AppData\Roaming\$77-Venom1.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1608
- C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
  "C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe
    "C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D11G3gEyQpnn.bat

Filesize
202B

MD5
b0d316084328d76df3456aebfdb95634

SHA1
f0a4418938421495e1ccb95a3fb1bca9d75de7b2

SHA256
5827b2eeb6114e0984e4701a3693fb3c8b7c66120cdd10e9fcf0d37c94bc68c4

SHA512
bdedbe9df1a9ab88e5fc3cad6bb2a0aef612d5016eec7b0fc2afbb8806d1353e4f605df1f707a852cdafe97a280abe6631cc138b87d0debb5b16effe1b07199e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\VCRUNTIME140.dll

Filesize
85KB

MD5
89a24c66e7a522f1e0016b1d0b4316dc

SHA1
5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

SHA256
3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

SHA512
e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_bz2.pyd

Filesize
92KB

MD5
cf77513525fc652bad6c7f85e192e94b

SHA1
23ec3bb9cdc356500ec192cac16906864d5e9a81

SHA256
8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41

SHA512
dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_cffi_backend.cp37-win_amd64.pyd

Filesize
177KB

MD5
638ddf468c9180ab79ce37e54e0f1717

SHA1
baaa5cb24a035e5730d2854414e9c6aa5e1b7429

SHA256
8216efa1065e43efc1f530465db043824df5d8d26119f532fdd2006d1333104c

SHA512
58051afcc909abb61eafe4251b3b2fb62f54d329b057b9c01493abaf168fb1099497e36c6805b2a00b7adc3af83dc1cb0f10de32a164b6f288bd07465889e6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_ctypes.pyd

Filesize
129KB

MD5
5e869eebb6169ce66225eb6725d5be4a

SHA1
747887da0d7ab152e1d54608c430e78192d5a788

SHA256
430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173

SHA512
feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_elementtree.pyd

Filesize
203KB

MD5
7d0c4ab57fdc1bd30c0e8e42ccc2aa35

SHA1
81bff07b6b5dd843e2227a3e8054500cfec65983

SHA256
ee8c4a8fe8eaa918a4fee353d46f4191bd161582098b400c33220847d84797db

SHA512
56ae9f10de02e7c777673814128d0252b47d001d2edc74bff9d85d7b0b6538b6f4d3d163e301dfb31429ec1eeefee550a72d6e424f20e10eb63c28db0e69fbbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_hashlib.pyd

Filesize
38KB

MD5
b32cb9615a9bada55e8f20dcea2fbf48

SHA1
a9c6e2d44b07b31c898a6d83b7093bf90915062d

SHA256
ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5

SHA512
5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_lzma.pyd

Filesize
172KB

MD5
5fbb728a3b3abbdd830033586183a206

SHA1
066fde2fa80485c4f22e0552a4d433584d672a54

SHA256
f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b

SHA512
31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_pytransform.dll

Filesize
699KB

MD5
6aecb4a764836d156e4d6f6ea7cbaa9d

SHA1
42e2386843550b36bee70e46ccc8ce5c8628c50a

SHA256
8414c81dd8bc12f80dbce1126f3bd83df136d886589ea4bc89c05bb494df2eab

SHA512
42968102be12601883f3cd116cfc1f3750930b685bde128f52abd18d3db9255ce56a4527af2a286360d6f7ae2e7acb4b96414ce1d8a7f13ca7f094dbcdb21481

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_queue.pyd

Filesize
27KB

MD5
c0a70188685e44e73576e3cd63fc1f68

SHA1
36f88ca5c1dda929b932d656368515e851aeb175

SHA256
e499824d58570c3130ba8ef1ac2d503e71f916c634b2708cc22e95c223f83d0a

SHA512
b9168bf1b98da4a9dfd7b1b040e1214fd69e8dfc2019774890291703ab48075c791cc27af5d735220bd25c47643f098820563dc537748471765aff164b00a4aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_socket.pyd

Filesize
75KB

MD5
8ea18d0eeae9044c278d2ea7a1dbae36

SHA1
de210842da8cb1cb14318789575d65117d14e728

SHA256
9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2

SHA512
d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\_ssl.pyd

Filesize
118KB

MD5
5a393bb4f3ae499541356e57a766eb6a

SHA1
908f68f4ea1a754fd31edb662332cf0df238cf9a

SHA256
b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047

SHA512
958584fd4efaa5dd301cbcecbfc8927f9d2caec9e2826b2af9257c5eefb4b0b81dbbadbd3c1d867f56705c854284666f98d428dc2377ccc49f8e1f9bbbed158f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\base_library.zip

Filesize
770KB

MD5
27df8e4748250e4bdd96ae749747ebe5

SHA1
9da539439693db7562a3f18317e7391d7959f1fd

SHA256
1bea0559d3916c4b9745b9a572bbae8b7ed9662692a7fd567dcf0f7bf49fe76f

SHA512
d70c0b5eacd688eae8fc144e6a1ea90240912db34b085985c17b7c7fa924ff592082637c495cf84e03ce0a52250cfd26bd72a4a83f755fb8807d135b56090ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\certifi\cacert.pem

Filesize
275KB

MD5
c760591283d5a4a987ad646b35de3717

SHA1
5d10cbd25ac1c7ced5bfb3d6f185fa150f6ea134

SHA256
1a14f6e1fd11efff72e1863f8645f090eec1b616614460c210c3b7e3c13d4b5e

SHA512
c192ae381008eaf180782e6e40cd51834e0233e98942bd071768308e179f58f3530e6e883f245a2630c86923dbeb68b624c5ec2167040d749813fedc37a6d1e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\ciso8601.cp37-win_amd64.pyd

Filesize
15KB

MD5
7b85a3c245b5268bf879497c7c8d937e

SHA1
ed9b39526be00e1612ff7d598712afdf85c3de09

SHA256
550d0f688557128c519274feebaf2b0f0f3f750c1c5574a5ff20b583b6ec973d

SHA512
1311df2c82dcadffbdcb0b82eb74e75f88e1eb1380041c0f3b5f421b77b9c99c63e41a344e60d54335af09cfb792d2c023a641d216e0ab32f5536ad32cfbbb71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\cryptography\hazmat\bindings\_openssl.pyd

Filesize
3.0MB

MD5
dce261ac7fbeb14ebfd5a6450010f005

SHA1
f7b28bffff8d9455b18865281d1b18b1286e82ab

SHA256
49eb7c8feea0f263ce4e89963ec24cff1dd58059abe6b9d81591130ec06e9014

SHA512
df1fac60feec898fa388e0e92a776ecafe38fc35ca7cd710f1ea8f5cb94dff987a20fa2aaa38d3dbe3a6495070247d1855f97edac29cdbeeb2a8684947e16f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\lxml\_elementpath.cp37-win_amd64.pyd

Filesize
152KB

MD5
c48139175e3b46d47d4070fd66af1e6a

SHA1
98515232312c05c5e1cb45152a3cac9cc3bae73a

SHA256
406b7eddd3dfc1e21046dc2043bd7f8ede96e258ad4c282f558ca6798145d86d

SHA512
9438a4ae5d6dfb9a928a20d964bbe16851b7e51dafa4d1e63426c3a7e177360a544006aa1ae5e715801afe32db8a8715e32e3824ee19cdd9d7f57a16a54fcf8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\lxml\etree.cp37-win_amd64.pyd

Filesize
3.8MB

MD5
ee01bd81a9ce7bc6ceaef0198a7ab105

SHA1
4a2d69075b8c3b01c84341ae1b88b92e9879a9a1

SHA256
276b2cdb4e3e25d369f1f234070231a9c2c5a3bdef50c12590129b6c32b5ef02

SHA512
31d0600af1874f05f7901921a81af050e57215c4ee01dcfb6f00d1948de7c4d71cbbf21ce7030b4ef6575036273e3a3309fb968e267a0f52b9f954391c0e42fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\psutil\_psutil_windows.cp37-win_amd64.pyd

Filesize
71KB

MD5
ded86acf3b30979a039a43e02a983aa5

SHA1
7192d12bab4c10407438180684e47587931cdaf9

SHA256
326b4ddd7dd6a677620edd6a610701cb19a6b5040a887da0fb8a33b88972abe3

SHA512
a28d43cba28f2ffdf07d0861a993aa942b4e6f70f771cc2c38081123f7c89a879f1ea3c8770472c81b7e3dacb1c6d2d9726ba3cd485dc7c9ee2e8bbb89f525b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\pyexpat.pyd

Filesize
198KB

MD5
6500aa010c8b50ffd1544f08af03fa4f

SHA1
a03f9f70d4ecc565f0fae26ef690d63e3711a20a

SHA256
752cf6804aac09480bf1e839a26285ec2668405010ed7ffd2021596e49b94dec

SHA512
f5f0521039c816408a5dd8b7394f9db5250e6dc14c0328898f1bed5de1e8a26338a678896f20aafa13c56b903b787f274d3dec467808787d00c74350863175d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\python3.DLL

Filesize
57KB

MD5
274853e19235d411a751a750c54b9893

SHA1
97bd15688b549cd5dbf49597af508c72679385af

SHA256
d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b

SHA512
580fa23cbe71ae4970a608c8d1ab88fe3f7562ed18398c73b14d5a3e008ea77df3e38abf97c12512786391ee403f675a219fbf5afe5c8cea004941b1d1d02a48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\python37.dll

Filesize
3.6MB

MD5
c4709f84e6cf6e082b80c80b87abe551

SHA1
c0c55b229722f7f2010d34e26857df640182f796

SHA256
ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3

SHA512
e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\pytransform\_pytransform.dll

Filesize
699KB

MD5
6aecb4a764836d156e4d6f6ea7cbaa9d

SHA1
42e2386843550b36bee70e46ccc8ce5c8628c50a

SHA256
8414c81dd8bc12f80dbce1126f3bd83df136d886589ea4bc89c05bb494df2eab

SHA512
42968102be12601883f3cd116cfc1f3750930b685bde128f52abd18d3db9255ce56a4527af2a286360d6f7ae2e7acb4b96414ce1d8a7f13ca7f094dbcdb21481

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\pytransform\license.lic

Filesize
220B

MD5
07f5c26752645e153c4608c0d47e795a

SHA1
d0d7f64fa20d4c8737bfa36fb7c4a7ba984595cc

SHA256
8ec2186bc15e07927127e0a7ac74540f3d52fb8f7c9e1458abbdc410cdfc44d8

SHA512
3e2859c84669d67ac4924affd5fc573feff5a160f923d85166dcf579840ab3d8160f6f2353d09ceb0df221baaeb71cea874b1cb41200eb76c9ef88715e8258bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\pytransform\pytransform.key

Filesize
476B

MD5
11ea5c2e72dff7a54b49fab8f6837c46

SHA1
62a4581a21e8a537f2a12e1f22545c7fe1748373

SHA256
3f6bb878d240419e164d50df6f27d1639e758a7d56a8359d7eb276bf60cf83ba

SHA512
469d5e7228eaf46bd996a34c7a4dbeada88020c96f935c4d513c3a6469d62256aab33bfdb72a16cd22d40a32d95f9dee4bc72937488f5cdc548cb7481fbe83bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\select.pyd

Filesize
26KB

MD5
fb4a0d7abaeaa76676846ad0f08fefa5

SHA1
755fd998215511506edd2c5c52807b46ca9393b2

SHA256
65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429

SHA512
f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15682\unicodedata.pyd

Filesize
1.0MB

MD5
4d3d8e16e98558ff9dac8fc7061e2759

SHA1
c918ab67b580f955b6361f9900930da38cec7c91

SHA256
016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095

SHA512
0dfabfad969da806bc9c6c664cdf31647d89951832ff7e4e5eeed81f1de9263ed71bddeff76ebb8e47d6248ad4f832cb8ad456f11e401c3481674bd60283991a

Download Submit
C:\Users\Admin\AppData\Roaming\$77-Venom1.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
C:\Users\Admin\AppData\Roaming\$77-Venom1.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

Filesize
11.0MB

MD5
b83d97ae5231f9fbb7048ed60a58f313

SHA1
70918914e73abd5ff37e6a22f44b917516818018

SHA256
120b5481b6b2e44038e338222f5a44e74d90b0a9870ffce30f7dc421e275ee35

SHA512
0b18267e75ac9549df64e36a8e6aa3b64c856eac54cfb440859cb53c4d604c55ae850f1b9b56f57a2c668ed7179c6f06a50d3d2928a42f087a305302cbd4e730

Download Submit
C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

Filesize
11.0MB

MD5
b83d97ae5231f9fbb7048ed60a58f313

SHA1
70918914e73abd5ff37e6a22f44b917516818018

SHA256
120b5481b6b2e44038e338222f5a44e74d90b0a9870ffce30f7dc421e275ee35

SHA512
0b18267e75ac9549df64e36a8e6aa3b64c856eac54cfb440859cb53c4d604c55ae850f1b9b56f57a2c668ed7179c6f06a50d3d2928a42f087a305302cbd4e730

Download Submit
C:\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

Filesize
11.0MB

MD5
b83d97ae5231f9fbb7048ed60a58f313

SHA1
70918914e73abd5ff37e6a22f44b917516818018

SHA256
120b5481b6b2e44038e338222f5a44e74d90b0a9870ffce30f7dc421e275ee35

SHA512
0b18267e75ac9549df64e36a8e6aa3b64c856eac54cfb440859cb53c4d604c55ae850f1b9b56f57a2c668ed7179c6f06a50d3d2928a42f087a305302cbd4e730

Download Submit
C:\Windows\SysWOW64\System32\$77boniarz.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
C:\Windows\SysWOW64\System32\$77boniarz.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\VCRUNTIME140.dll

Filesize
85KB

MD5
89a24c66e7a522f1e0016b1d0b4316dc

SHA1
5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

SHA256
3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

SHA512
e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_bz2.pyd

Filesize
92KB

MD5
cf77513525fc652bad6c7f85e192e94b

SHA1
23ec3bb9cdc356500ec192cac16906864d5e9a81

SHA256
8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41

SHA512
dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_cffi_backend.cp37-win_amd64.pyd

Filesize
177KB

MD5
638ddf468c9180ab79ce37e54e0f1717

SHA1
baaa5cb24a035e5730d2854414e9c6aa5e1b7429

SHA256
8216efa1065e43efc1f530465db043824df5d8d26119f532fdd2006d1333104c

SHA512
58051afcc909abb61eafe4251b3b2fb62f54d329b057b9c01493abaf168fb1099497e36c6805b2a00b7adc3af83dc1cb0f10de32a164b6f288bd07465889e6a3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_ctypes.pyd

Filesize
129KB

MD5
5e869eebb6169ce66225eb6725d5be4a

SHA1
747887da0d7ab152e1d54608c430e78192d5a788

SHA256
430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173

SHA512
feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_elementtree.pyd

Filesize
203KB

MD5
7d0c4ab57fdc1bd30c0e8e42ccc2aa35

SHA1
81bff07b6b5dd843e2227a3e8054500cfec65983

SHA256
ee8c4a8fe8eaa918a4fee353d46f4191bd161582098b400c33220847d84797db

SHA512
56ae9f10de02e7c777673814128d0252b47d001d2edc74bff9d85d7b0b6538b6f4d3d163e301dfb31429ec1eeefee550a72d6e424f20e10eb63c28db0e69fbbe

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_hashlib.pyd

Filesize
38KB

MD5
b32cb9615a9bada55e8f20dcea2fbf48

SHA1
a9c6e2d44b07b31c898a6d83b7093bf90915062d

SHA256
ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5

SHA512
5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_lzma.pyd

Filesize
172KB

MD5
5fbb728a3b3abbdd830033586183a206

SHA1
066fde2fa80485c4f22e0552a4d433584d672a54

SHA256
f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b

SHA512
31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_pytransform.dll

Filesize
699KB

MD5
6aecb4a764836d156e4d6f6ea7cbaa9d

SHA1
42e2386843550b36bee70e46ccc8ce5c8628c50a

SHA256
8414c81dd8bc12f80dbce1126f3bd83df136d886589ea4bc89c05bb494df2eab

SHA512
42968102be12601883f3cd116cfc1f3750930b685bde128f52abd18d3db9255ce56a4527af2a286360d6f7ae2e7acb4b96414ce1d8a7f13ca7f094dbcdb21481

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_queue.pyd

Filesize
27KB

MD5
c0a70188685e44e73576e3cd63fc1f68

SHA1
36f88ca5c1dda929b932d656368515e851aeb175

SHA256
e499824d58570c3130ba8ef1ac2d503e71f916c634b2708cc22e95c223f83d0a

SHA512
b9168bf1b98da4a9dfd7b1b040e1214fd69e8dfc2019774890291703ab48075c791cc27af5d735220bd25c47643f098820563dc537748471765aff164b00a4aa

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_socket.pyd

Filesize
75KB

MD5
8ea18d0eeae9044c278d2ea7a1dbae36

SHA1
de210842da8cb1cb14318789575d65117d14e728

SHA256
9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2

SHA512
d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\_ssl.pyd

Filesize
118KB

MD5
5a393bb4f3ae499541356e57a766eb6a

SHA1
908f68f4ea1a754fd31edb662332cf0df238cf9a

SHA256
b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047

SHA512
958584fd4efaa5dd301cbcecbfc8927f9d2caec9e2826b2af9257c5eefb4b0b81dbbadbd3c1d867f56705c854284666f98d428dc2377ccc49f8e1f9bbbed158f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\ciso8601.cp37-win_amd64.pyd

Filesize
15KB

MD5
7b85a3c245b5268bf879497c7c8d937e

SHA1
ed9b39526be00e1612ff7d598712afdf85c3de09

SHA256
550d0f688557128c519274feebaf2b0f0f3f750c1c5574a5ff20b583b6ec973d

SHA512
1311df2c82dcadffbdcb0b82eb74e75f88e1eb1380041c0f3b5f421b77b9c99c63e41a344e60d54335af09cfb792d2c023a641d216e0ab32f5536ad32cfbbb71

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\cryptography\hazmat\bindings\_openssl.pyd

Filesize
3.0MB

MD5
dce261ac7fbeb14ebfd5a6450010f005

SHA1
f7b28bffff8d9455b18865281d1b18b1286e82ab

SHA256
49eb7c8feea0f263ce4e89963ec24cff1dd58059abe6b9d81591130ec06e9014

SHA512
df1fac60feec898fa388e0e92a776ecafe38fc35ca7cd710f1ea8f5cb94dff987a20fa2aaa38d3dbe3a6495070247d1855f97edac29cdbeeb2a8684947e16f92

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\lxml\_elementpath.cp37-win_amd64.pyd

Filesize
152KB

MD5
c48139175e3b46d47d4070fd66af1e6a

SHA1
98515232312c05c5e1cb45152a3cac9cc3bae73a

SHA256
406b7eddd3dfc1e21046dc2043bd7f8ede96e258ad4c282f558ca6798145d86d

SHA512
9438a4ae5d6dfb9a928a20d964bbe16851b7e51dafa4d1e63426c3a7e177360a544006aa1ae5e715801afe32db8a8715e32e3824ee19cdd9d7f57a16a54fcf8d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\lxml\etree.cp37-win_amd64.pyd

Filesize
3.8MB

MD5
ee01bd81a9ce7bc6ceaef0198a7ab105

SHA1
4a2d69075b8c3b01c84341ae1b88b92e9879a9a1

SHA256
276b2cdb4e3e25d369f1f234070231a9c2c5a3bdef50c12590129b6c32b5ef02

SHA512
31d0600af1874f05f7901921a81af050e57215c4ee01dcfb6f00d1948de7c4d71cbbf21ce7030b4ef6575036273e3a3309fb968e267a0f52b9f954391c0e42fb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\psutil\_psutil_windows.cp37-win_amd64.pyd

Filesize
71KB

MD5
ded86acf3b30979a039a43e02a983aa5

SHA1
7192d12bab4c10407438180684e47587931cdaf9

SHA256
326b4ddd7dd6a677620edd6a610701cb19a6b5040a887da0fb8a33b88972abe3

SHA512
a28d43cba28f2ffdf07d0861a993aa942b4e6f70f771cc2c38081123f7c89a879f1ea3c8770472c81b7e3dacb1c6d2d9726ba3cd485dc7c9ee2e8bbb89f525b9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\pyexpat.pyd

Filesize
198KB

MD5
6500aa010c8b50ffd1544f08af03fa4f

SHA1
a03f9f70d4ecc565f0fae26ef690d63e3711a20a

SHA256
752cf6804aac09480bf1e839a26285ec2668405010ed7ffd2021596e49b94dec

SHA512
f5f0521039c816408a5dd8b7394f9db5250e6dc14c0328898f1bed5de1e8a26338a678896f20aafa13c56b903b787f274d3dec467808787d00c74350863175d1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\python3.dll

Filesize
57KB

MD5
274853e19235d411a751a750c54b9893

SHA1
97bd15688b549cd5dbf49597af508c72679385af

SHA256
d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b

SHA512
580fa23cbe71ae4970a608c8d1ab88fe3f7562ed18398c73b14d5a3e008ea77df3e38abf97c12512786391ee403f675a219fbf5afe5c8cea004941b1d1d02a48

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\python37.dll

Filesize
3.6MB

MD5
c4709f84e6cf6e082b80c80b87abe551

SHA1
c0c55b229722f7f2010d34e26857df640182f796

SHA256
ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3

SHA512
e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\select.pyd

Filesize
26KB

MD5
fb4a0d7abaeaa76676846ad0f08fefa5

SHA1
755fd998215511506edd2c5c52807b46ca9393b2

SHA256
65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429

SHA512
f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\unicodedata.pyd

Filesize
1.0MB

MD5
4d3d8e16e98558ff9dac8fc7061e2759

SHA1
c918ab67b580f955b6361f9900930da38cec7c91

SHA256
016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095

SHA512
0dfabfad969da806bc9c6c664cdf31647d89951832ff7e4e5eeed81f1de9263ed71bddeff76ebb8e47d6248ad4f832cb8ad456f11e401c3481674bd60283991a

Download Submit
\Users\Admin\AppData\Roaming\$77-Venom1.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
\Users\Admin\AppData\Roaming\N̶o̵E̶r̴r̸o̴r̸s̸A̷I̵O̶.exe

Filesize
11.0MB

MD5
b83d97ae5231f9fbb7048ed60a58f313

SHA1
70918914e73abd5ff37e6a22f44b917516818018

SHA256
120b5481b6b2e44038e338222f5a44e74d90b0a9870ffce30f7dc421e275ee35

SHA512
0b18267e75ac9549df64e36a8e6aa3b64c856eac54cfb440859cb53c4d604c55ae850f1b9b56f57a2c668ed7179c6f06a50d3d2928a42f087a305302cbd4e730

Download Submit
\Windows\SysWOW64\System32\$77boniarz.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
\Windows\SysWOW64\System32\$77boniarz.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
\Windows\SysWOW64\System32\$77boniarz.exe

Filesize
534KB

MD5
cba4d5ced47c498956334732c6838712

SHA1
a5733409c7f5b1da12a424c60fcdfb52b5b43c04

SHA256
d5f9e206ce64feb557521cf31e8e53a885f989ef581f012873823d83cd45a289

SHA512
3b38ecbb0a2d30201e7b41a0f16508e4121fbe5cfa4a40dab9ab9fadd49fc10e800d22b17bdadeb7919d45a4b719efb6c04d69ef6d292e8bc21f4647cc5d38e4

Download Submit
memory/268-144-0x0000000000000000-mapping.dmp

Download
memory/292-128-0x00000000011B0000-0x000000000123C000-memory.dmp

Filesize
560KB

Download
memory/292-125-0x0000000000000000-mapping.dmp

Download
memory/584-142-0x0000000000000000-mapping.dmp

Download
memory/652-143-0x0000000000000000-mapping.dmp

Download
memory/912-132-0x0000000000000000-mapping.dmp

Download
memory/952-56-0x0000000000000000-mapping.dmp

Download
memory/952-60-0x0000000000A00000-0x0000000000A8C000-memory.dmp

Filesize
560KB

Download
memory/984-122-0x0000000000000000-mapping.dmp

Download
memory/1016-137-0x0000000000000000-mapping.dmp

Download
memory/1060-134-0x0000000000000000-mapping.dmp

Download
memory/1156-136-0x0000000000000000-mapping.dmp

Download
memory/1400-118-0x0000000000000000-mapping.dmp

Download
memory/1560-141-0x0000000000000000-mapping.dmp

Download
memory/1568-62-0x0000000000000000-mapping.dmp

Download
memory/1580-133-0x000000006F040000-0x000000006F5EB000-memory.dmp

Filesize
5.7MB

Download
memory/1580-129-0x0000000000000000-mapping.dmp

Download
memory/1608-146-0x0000000000000000-mapping.dmp

Download
memory/1608-147-0x00000000002D0000-0x000000000035C000-memory.dmp

Filesize
560KB

Download
memory/1680-67-0x0000000000000000-mapping.dmp

Download
memory/1768-123-0x0000000000000000-mapping.dmp

Download
memory/1840-145-0x0000000000000000-mapping.dmp

Download
memory/1908-121-0x0000000000000000-mapping.dmp

Download
memory/1928-140-0x0000000000000000-mapping.dmp

Download
memory/2008-59-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2008-66-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2008-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download