Resubmissions
11/11/2023, 21:54
231111-1sgeesbg5t 811/11/2023, 21:52
231111-1rakgsbg3y 711/11/2023, 21:24
231111-z81mkabf5v 711/11/2023, 21:20
231111-z62f3scd27 711/11/2023, 21:19
231111-z6csqacd25 711/11/2023, 21:18
231111-z5pqwscc99 711/11/2023, 21:13
231111-z22laabf3w 911/11/2023, 21:10
231111-z1cwjacc82 711/11/2023, 20:08
231111-ywskracb37 7Analysis
-
max time kernel
35s -
max time network
1218s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2023, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
888Rat.exe
Resource
win10v2004-20231023-en
General
-
Target
888Rat.exe
-
Size
93.6MB
-
MD5
553951bbbde6c6001ade88f3a06a9b9a
-
SHA1
28cd84b4533433cc925123f106e4efbbddd3c2ca
-
SHA256
4870376811dd3c5eabe924c793079629d13a7813bf1a3014b5333b132be50365
-
SHA512
e9cf57ca2cd87fa2b3c05c0003ae11fc51d4139072d028ba52d665de57fffcb9c279cbe19ede001cc56ac464212ab8f6cbb8e7023c7ca567835a7b540a58521d
-
SSDEEP
1572864:ST0EdFgdUIGfkS0H4HHDXLYrXatfLllR3Rbop0+xXlMSyCXsRuG0CPb0V+8VM5km:ST0I1IGfr0H4HbLYrXajRPcl0issnM4s
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation SERVERS.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888Rat.exe Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation 888RAT.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation SERVERS.EXE Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Process not Found Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation Process not Found -
Executes dropped EXE 16 IoCs
pid Process 4988 SERVERS.EXE 2932 SERVERS.EXE 4636 SERVERS.EXE 3144 888RAT.EXE 1068 SERVERS.EXE 5160 SERVERS.EXE 5300 SERVERS.EXE 5492 888RAT.EXE 5736 888RAT.EXE 5860 Process not Found 6032 Process not Found 3596 Process not Found 5152 888RAT.EXE 5292 Process not Found 5624 Process not Found 5916 SERVERS.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GeForce = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SERVERS.EXE\"" SERVERS.EXE -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5620 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1114462139-3090196418-29517368-1000\{64A9B5B4-77EA-4DB8-BB7F-8B7256C69486} msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1952 msedge.exe 1952 msedge.exe 4636 SERVERS.EXE 4636 SERVERS.EXE 4636 SERVERS.EXE 4636 SERVERS.EXE 4636 SERVERS.EXE 4636 SERVERS.EXE 6104 msedge.exe 6104 msedge.exe 5968 Process not Found 5968 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4636 SERVERS.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4636 SERVERS.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1948 2348 888Rat.exe 104 PID 2348 wrote to memory of 1948 2348 888Rat.exe 104 PID 2348 wrote to memory of 1948 2348 888Rat.exe 104 PID 2348 wrote to memory of 4988 2348 888Rat.exe 105 PID 2348 wrote to memory of 4988 2348 888Rat.exe 105 PID 1948 wrote to memory of 1428 1948 888RAT.EXE 107 PID 1948 wrote to memory of 1428 1948 888RAT.EXE 107 PID 1948 wrote to memory of 1428 1948 888RAT.EXE 107 PID 1948 wrote to memory of 2932 1948 888RAT.EXE 108 PID 1948 wrote to memory of 2932 1948 888RAT.EXE 108 PID 1428 wrote to memory of 2612 1428 888RAT.EXE 109 PID 1428 wrote to memory of 2612 1428 888RAT.EXE 109 PID 1428 wrote to memory of 2612 1428 888RAT.EXE 109 PID 1428 wrote to memory of 4636 1428 888RAT.EXE 110 PID 1428 wrote to memory of 4636 1428 888RAT.EXE 110 PID 2612 wrote to memory of 3388 2612 888RAT.EXE 111 PID 2612 wrote to memory of 3388 2612 888RAT.EXE 111 PID 2612 wrote to memory of 3388 2612 888RAT.EXE 111 PID 2612 wrote to memory of 3144 2612 888RAT.EXE 173 PID 2612 wrote to memory of 3144 2612 888RAT.EXE 173 PID 3388 wrote to memory of 852 3388 888RAT.EXE 116 PID 3388 wrote to memory of 852 3388 888RAT.EXE 116 PID 3388 wrote to memory of 852 3388 888RAT.EXE 116 PID 3388 wrote to memory of 1068 3388 888RAT.EXE 115 PID 3388 wrote to memory of 1068 3388 888RAT.EXE 115 PID 852 wrote to memory of 5144 852 888RAT.EXE 383 PID 852 wrote to memory of 5144 852 888RAT.EXE 383 PID 852 wrote to memory of 5144 852 888RAT.EXE 383 PID 852 wrote to memory of 5160 852 888RAT.EXE 610 PID 852 wrote to memory of 5160 852 888RAT.EXE 610 PID 5144 wrote to memory of 5264 5144 888RAT.EXE 119 PID 5144 wrote to memory of 5264 5144 888RAT.EXE 119 PID 5144 wrote to memory of 5264 5144 888RAT.EXE 119 PID 5144 wrote to memory of 5300 5144 888RAT.EXE 120 PID 5144 wrote to memory of 5300 5144 888RAT.EXE 120 PID 5264 wrote to memory of 5456 5264 888RAT.EXE 1070 PID 5264 wrote to memory of 5456 5264 888RAT.EXE 1070 PID 5264 wrote to memory of 5456 5264 888RAT.EXE 1070 PID 5264 wrote to memory of 5492 5264 888RAT.EXE 1002 PID 5264 wrote to memory of 5492 5264 888RAT.EXE 1002 PID 4636 wrote to memory of 5620 4636 SERVERS.EXE 124 PID 4636 wrote to memory of 5620 4636 SERVERS.EXE 124 PID 5456 wrote to memory of 5696 5456 SERVERS.EXE 1627 PID 5456 wrote to memory of 5696 5456 SERVERS.EXE 1627 PID 5456 wrote to memory of 5696 5456 SERVERS.EXE 1627 PID 5456 wrote to memory of 5736 5456 Process not Found 439 PID 5456 wrote to memory of 5736 5456 Process not Found 439 PID 5696 wrote to memory of 5832 5696 Process not Found 1672 PID 5696 wrote to memory of 5832 5696 Process not Found 1672 PID 5696 wrote to memory of 5832 5696 Process not Found 1672 PID 5696 wrote to memory of 5860 5696 Process not Found 1186 PID 5696 wrote to memory of 5860 5696 Process not Found 1186 PID 5832 wrote to memory of 5996 5832 Process not Found 652 PID 5832 wrote to memory of 5996 5832 Process not Found 652 PID 5832 wrote to memory of 5996 5832 Process not Found 652 PID 5832 wrote to memory of 6032 5832 Process not Found 1637 PID 5832 wrote to memory of 6032 5832 Process not Found 1637 PID 5996 wrote to memory of 2184 5996 msedge.exe 1449 PID 5996 wrote to memory of 2184 5996 msedge.exe 1449 PID 5996 wrote to memory of 2184 5996 msedge.exe 1449 PID 5996 wrote to memory of 3596 5996 msedge.exe 1965 PID 5996 wrote to memory of 3596 5996 msedge.exe 1965 PID 2184 wrote to memory of 5288 2184 Process not Found 464 PID 2184 wrote to memory of 5288 2184 Process not Found 464 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd42dc46f8,0x7ffd42dc4708,0x7ffd42dc47181⤵PID:2244
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8874358696462584763,1713473030595277534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:21⤵PID:4752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8874358696462584763,1713473030595277534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8874358696462584763,1713473030595277534,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:81⤵PID:800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8874358696462584763,1713473030595277534,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:11⤵PID:2812
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2524
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8874358696462584763,1713473030595277534,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:11⤵PID:2776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\888Rat.exe"C:\Users\Admin\AppData\Local\Temp\888Rat.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"6⤵
- Executes dropped EXE
PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"7⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"9⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"10⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"11⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"12⤵PID:6032
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"12⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"13⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"14⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"15⤵PID:5292
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"15⤵
- Checks computer location settings
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"16⤵
- Checks computer location settings
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"17⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"18⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"19⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"20⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"21⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"22⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"23⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"24⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"25⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"26⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"27⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"28⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"29⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"30⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"31⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"32⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"33⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"34⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"35⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"36⤵PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"36⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"37⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"38⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"39⤵PID:5168
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"39⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"40⤵PID:768
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"40⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"41⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"42⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"43⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"44⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"45⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"46⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"47⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"48⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"49⤵PID:5596
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"49⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"50⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"51⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"52⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"53⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"54⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"55⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"56⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"57⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"58⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"59⤵PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"59⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"60⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"61⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"62⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"63⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"64⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"65⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"66⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"67⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"68⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"69⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"70⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"71⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"72⤵PID:6044
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"72⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"73⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"74⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"75⤵
- Executes dropped EXE
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"76⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"77⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"78⤵PID:5280
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"78⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"79⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"80⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"81⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"82⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"83⤵PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"83⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"84⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"85⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"86⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"87⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"88⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"89⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"90⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"91⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"92⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"93⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"94⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"95⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"96⤵PID:5444
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"96⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"97⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"98⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"C:\Users\Admin\AppData\Local\Temp\SERVERS.EXE"99⤵PID:848
-
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"99⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"100⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"101⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"102⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"103⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"104⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"105⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"106⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"107⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"108⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"109⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"110⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"111⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"112⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"113⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"114⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"115⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"116⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"117⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"118⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"119⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"120⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"121⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"C:\Users\Admin\AppData\Local\Temp\888RAT.EXE"122⤵PID:5776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-