Malware Analysis Report

2025-08-10 17:44

Sample ID 230315-ce27zach2t
Target service.exe
SHA256 4d19771fb289f892626b1b04c120f53d69492ec87df2bfd6809dd6fce8662c3c
Tags
asyncrat default evasion rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d19771fb289f892626b1b04c120f53d69492ec87df2bfd6809dd6fce8662c3c

Threat Level: Known bad

The file service.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default evasion rat

AsyncRat

Async RAT payload

Downloads MZ/PE file

Sets file to hidden

Blocklisted process makes network request

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Creates scheduled task(s)

Delays execution with timeout.exe

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Views/modifies file attributes

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-15 02:00

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-15 02:00

Reported

2023-03-15 02:02

Platform

win7-20230220-en

Max time kernel

31s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\service.exe"

Signatures

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -nologo -command .\service.ps1

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs

MD5 e04e55d2e6cc3d920631fdc5d6dcc1ce
SHA1 2c4dbcff71f8678623a7c197440ec281804dc5a5
SHA256 f641a99ec7e549970c81d724766f2a60ff031a5ec92aa6fc84228c82eeb4b4eb
SHA512 9511fe4dc599187f4539b8cda476550c54e86cbfcaca339a5db12e980ec322bf488d7458bf76089aa1d845f164f7ddb8adea017923d9a4930b9e821b7a4ae998

C:\Users\Admin\AppData\Local\Temp\RarSFX0\service.ps1

MD5 eb9c76ab230c2b8527d504429d7aca20
SHA1 ca4fc2fcb5023fa8398fc5a0c15e7ad23a61e8cb
SHA256 f985277690d6c85a064bc5d494d20d0774fb5017eaf7874685378c538bd49dbf
SHA512 f791797d8301242f2334767153ae7133193cee75538ce38b9d5fa5b60388428a8808c22eb08dd070f6f7e3ce556cf1f04883285eaa44ddf8aba1bd67886429c2

memory/1640-64-0x0000000002620000-0x0000000002660000-memory.dmp

memory/1640-65-0x0000000002620000-0x0000000002660000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-15 02:00

Reported

2023-03-15 02:02

Platform

win10v2004-20230221-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\service.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\csrss.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2748 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\WScript.exe
PID 2748 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\WScript.exe
PID 2748 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\WScript.exe
PID 1648 wrote to memory of 1228 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1648 wrote to memory of 1228 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1648 wrote to memory of 1228 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1228 wrote to memory of 4456 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\attrib.exe
PID 1228 wrote to memory of 4456 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\attrib.exe
PID 1228 wrote to memory of 4456 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\attrib.exe
PID 1228 wrote to memory of 4432 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe
PID 1228 wrote to memory of 4432 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe
PID 1228 wrote to memory of 4432 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe
PID 4432 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe C:\Users\Admin\AppData\Local\Temp\csrss.exe
PID 4432 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe C:\Users\Admin\AppData\Local\Temp\csrss.exe
PID 4432 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
PID 4432 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe
PID 3464 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe C:\Windows\System32\cmd.exe
PID 3464 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe C:\Windows\System32\cmd.exe
PID 3464 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe C:\Windows\system32\cmd.exe
PID 3464 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\csrss.exe C:\Windows\system32\cmd.exe
PID 1472 wrote to memory of 3560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 1472 wrote to memory of 3560 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4780 wrote to memory of 4440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 4780 wrote to memory of 4440 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 4780 wrote to memory of 5108 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\csrss.exe
PID 4780 wrote to memory of 5108 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\csrss.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -nologo -command .\service.ps1

C:\Windows\SysWOW64\attrib.exe

"C:\Windows\system32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe

C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe

"C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe"

C:\Users\Admin\AppData\Local\Temp\csrss.exe

"C:\Users\Admin\AppData\Local\Temp\csrss.exe"

C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

"C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE479.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "csrss" /tr '"C:\Users\Admin\AppData\Roaming\csrss.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\csrss.exe

"C:\Users\Admin\AppData\Roaming\csrss.exe"

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
US 8.8.8.8:53 142.145.190.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:443 pastebin.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
IE 20.54.89.15:443 tcp
US 8.8.8.8:53 75.239.32.23.in-addr.arpa udp
IE 20.50.80.209:443 tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 3.67.15.169:16394 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.77.109.52.in-addr.arpa udp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 209.197.3.8:80 tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:16394 7.tcp.eu.ngrok.io tcp
DE 3.124.67.191:15121 7.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 191.67.124.3.in-addr.arpa udp
DE 3.124.67.191:15121 7.tcp.eu.ngrok.io tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs

MD5 e04e55d2e6cc3d920631fdc5d6dcc1ce
SHA1 2c4dbcff71f8678623a7c197440ec281804dc5a5
SHA256 f641a99ec7e549970c81d724766f2a60ff031a5ec92aa6fc84228c82eeb4b4eb
SHA512 9511fe4dc599187f4539b8cda476550c54e86cbfcaca339a5db12e980ec322bf488d7458bf76089aa1d845f164f7ddb8adea017923d9a4930b9e821b7a4ae998

memory/1228-140-0x0000000002790000-0x00000000027C6000-memory.dmp

memory/1228-141-0x00000000051C0000-0x00000000057E8000-memory.dmp

memory/1228-142-0x0000000002710000-0x0000000002720000-memory.dmp

memory/1228-143-0x0000000002710000-0x0000000002720000-memory.dmp

memory/1228-144-0x00000000050E0000-0x0000000005102000-memory.dmp

memory/1228-145-0x00000000059E0000-0x0000000005A46000-memory.dmp

memory/1228-146-0x0000000005A50000-0x0000000005AB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tyvsq00u.vpv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1228-156-0x0000000006090000-0x00000000060AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\service.ps1

MD5 eb9c76ab230c2b8527d504429d7aca20
SHA1 ca4fc2fcb5023fa8398fc5a0c15e7ad23a61e8cb
SHA256 f985277690d6c85a064bc5d494d20d0774fb5017eaf7874685378c538bd49dbf
SHA512 f791797d8301242f2334767153ae7133193cee75538ce38b9d5fa5b60388428a8808c22eb08dd070f6f7e3ce556cf1f04883285eaa44ddf8aba1bd67886429c2

memory/1228-158-0x0000000007070000-0x0000000007106000-memory.dmp

memory/1228-160-0x00000000065C0000-0x00000000065DA000-memory.dmp

memory/1228-161-0x0000000006610000-0x0000000006632000-memory.dmp

memory/1228-159-0x0000000002710000-0x0000000002720000-memory.dmp

memory/1228-162-0x0000000007710000-0x0000000007CB4000-memory.dmp

memory/1228-163-0x0000000008340000-0x00000000089BA000-memory.dmp

memory/1228-164-0x00000000073C0000-0x00000000073F2000-memory.dmp

memory/1228-165-0x000000006F490000-0x000000006F4DC000-memory.dmp

memory/1228-175-0x00000000080D0000-0x00000000080EE000-memory.dmp

memory/1228-176-0x0000000008200000-0x000000000820A000-memory.dmp

memory/1228-177-0x000000007F030000-0x000000007F040000-memory.dmp

memory/1228-178-0x00000000082C0000-0x00000000082CE000-memory.dmp

memory/1228-179-0x0000000002710000-0x0000000002720000-memory.dmp

memory/1228-180-0x0000000008310000-0x000000000832A000-memory.dmp

memory/1228-181-0x0000000002710000-0x0000000002720000-memory.dmp

memory/1228-182-0x0000000008300000-0x0000000008308000-memory.dmp

memory/1228-183-0x0000000002710000-0x0000000002720000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe

MD5 83a24ea1847f5cbb5508785abb5126ea
SHA1 63930e7171d1fc94fd4ec745392b3a1136cb0496
SHA256 246b30f2dc863cc247d9ad8bff17e1ec92f2282810f47f42634c0bb7883ba268
SHA512 fb6fbeb92bf4fee54f46e4dd75703cc85ebec3e57594fd7cb14874c096c2783ad896c863ba34c594f368d5c16df6a264e50dbb06d674c565d426dd2ddfe3890e

C:\Users\Admin\AppData\Local\Temp\tmp7DD0.exe

MD5 83a24ea1847f5cbb5508785abb5126ea
SHA1 63930e7171d1fc94fd4ec745392b3a1136cb0496
SHA256 246b30f2dc863cc247d9ad8bff17e1ec92f2282810f47f42634c0bb7883ba268
SHA512 fb6fbeb92bf4fee54f46e4dd75703cc85ebec3e57594fd7cb14874c096c2783ad896c863ba34c594f368d5c16df6a264e50dbb06d674c565d426dd2ddfe3890e

memory/4432-189-0x0000000000400000-0x000000000064E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss.exe

MD5 4e8ed7a82d6919108934eaa3fcd3ed9f
SHA1 f74a1c9fc02c8374ec0ee68438ae309f1f61ff41
SHA256 c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364
SHA512 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

C:\Users\Admin\AppData\Local\Temp\csrss.exe

MD5 4e8ed7a82d6919108934eaa3fcd3ed9f
SHA1 f74a1c9fc02c8374ec0ee68438ae309f1f61ff41
SHA256 c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364
SHA512 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

C:\Users\Admin\AppData\Local\Temp\csrss.exe

MD5 4e8ed7a82d6919108934eaa3fcd3ed9f
SHA1 f74a1c9fc02c8374ec0ee68438ae309f1f61ff41
SHA256 c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364
SHA512 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

memory/3464-269-0x0000000000C20000-0x0000000000C36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

MD5 ec801a7d4b72a288ec6c207bb9ff0131
SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

MD5 ec801a7d4b72a288ec6c207bb9ff0131
SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

C:\Users\Admin\AppData\Local\Temp\Extreme Injector v3.exe

MD5 ec801a7d4b72a288ec6c207bb9ff0131
SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac

memory/2768-328-0x00000000007C0000-0x00000000009A6000-memory.dmp

memory/2768-329-0x000000001CB70000-0x000000001CB80000-memory.dmp

memory/2768-330-0x000000001F350000-0x000000001F362000-memory.dmp

memory/2768-331-0x000000001F3B0000-0x000000001F3EC000-memory.dmp

memory/2768-333-0x000000001CB70000-0x000000001CB80000-memory.dmp

memory/2768-334-0x000000001CB70000-0x000000001CB80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE479.tmp.bat

MD5 b72a4ad50c4c34797a4dd18d888ab0eb
SHA1 de0c2af2871c59edc145b23f3154623c7be36e72
SHA256 414f31ba089ad5fc2a71d549d284fdc005a13b789dcc72d2d25b09ca9118bb53
SHA512 ea271d70752e86b70aa933a1c00253593eaf0b686415c894462390fb9364969f0719290f97fa3d5d02651cda5b15f7999a88c0b16ef54984535db21fd48100ea

memory/2768-340-0x000000001CB70000-0x000000001CB80000-memory.dmp

memory/2768-341-0x000000001CB70000-0x000000001CB80000-memory.dmp

C:\Users\Admin\AppData\Roaming\csrss.exe

MD5 4e8ed7a82d6919108934eaa3fcd3ed9f
SHA1 f74a1c9fc02c8374ec0ee68438ae309f1f61ff41
SHA256 c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364
SHA512 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

C:\Users\Admin\AppData\Roaming\csrss.exe

MD5 4e8ed7a82d6919108934eaa3fcd3ed9f
SHA1 f74a1c9fc02c8374ec0ee68438ae309f1f61ff41
SHA256 c933e7ccae64ffe87abb6f685c4d82ba2de7c9ff56523136e42d56b82b48b364
SHA512 2fc905d288a820d08d30b5ba64989406a89a2694af191e900bdde1e55c42ddce66cb5de9f562f8018c115029e5b210dc7b51204c2dccb73d561f5bbd996dfdad

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

memory/2768-346-0x000000001CB70000-0x000000001CB80000-memory.dmp