blacknet | e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97cb3fda3cff430377a866d6b437de8f.exe
Size 220KB
Sample240212-2ly7bsfb88
SHA256 e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
MD5 97cb3fda3cff430377a866d6b437de8f
SHA1 2359c8459c1e1dd133c2842b51d2982e63016f92
SHA512 e192d3afaa093b5b11643aafefa8192cfeb79e5f284e6c757532fd3e2a4a93970f5f8d54b0e983b4c406ced46aee04a99c186f31ff321f9292c51587603c630f
SSDEEP 3072:alaJEgEXbfa9K4Em8wNBiXMhDJv7WehI2135eDRCyqTp0FUSVBOHfHAXTRsPCgfr:BEg4S9KqiSJvthI25ebqqBOKTRsaj2e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blacknet bot evasion persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

http://furyx.de/panel

Mutex

BN[c1916af6f3a468e5b6f5c7f6b9c78982]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
true

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321b-19.dat	family_blacknet
behavioral2/memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000600000002321b-19.dat	disable_win_def
behavioral2/memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	furz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	furz.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	97cb3fda3cff430377a866d6b437de8f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	UacTest.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	furz.exe

Executes dropped EXE 5 IoCs

pid	Process
4844	furz.exe
5112	UacTest.exe
2324	Inpwdja.exe
2440	Mnrjvryib.exe
2320	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	97cb3fda3cff430377a866d6b437de8f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Windows\\Microsoft\\MyClient\\WindowsUpdate.exe"	furz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File opened for modification	C:\Windows\Microsoft\MyClient\WindowsUpdate.exe	furz.exe
File created	C:\Windows\Microsoft\MyClient\svchosts.exe	WindowsUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2336	schtasks.exe
1612	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4952	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	97cb3fda3cff430377a866d6b437de8f.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4764	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4608	PING.EXE
4052	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5060	97cb3fda3cff430377a866d6b437de8f.exe
5060	97cb3fda3cff430377a866d6b437de8f.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
3208	powershell.exe
3208	powershell.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe
4844	furz.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	97cb3fda3cff430377a866d6b437de8f.exe
Token: SeDebugPrivilege	4844	furz.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2320	WindowsUpdate.exe
Token: SeDebugPrivilege	2024	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4844	furz.exe
4844	furz.exe
4844	furz.exe
2320	WindowsUpdate.exe
2320	WindowsUpdate.exe
2320	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 2616 wrote to memory of 5060	2616	97cb3fda3cff430377a866d6b437de8f.exe	87
PID 5060 wrote to memory of 4844	5060	97cb3fda3cff430377a866d6b437de8f.exe	88
PID 5060 wrote to memory of 4844	5060	97cb3fda3cff430377a866d6b437de8f.exe	88
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	89
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	89
PID 5060 wrote to memory of 5112	5060	97cb3fda3cff430377a866d6b437de8f.exe	89
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	90
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	90
PID 5060 wrote to memory of 1992	5060	97cb3fda3cff430377a866d6b437de8f.exe	90
PID 1992 wrote to memory of 4608	1992	cmd.exe	92
PID 1992 wrote to memory of 4608	1992	cmd.exe	92
PID 1992 wrote to memory of 4608	1992	cmd.exe	92
PID 1992 wrote to memory of 4052	1992	cmd.exe	93
PID 1992 wrote to memory of 4052	1992	cmd.exe	93
PID 1992 wrote to memory of 4052	1992	cmd.exe	93
PID 5112 wrote to memory of 2324	5112	UacTest.exe	94
PID 5112 wrote to memory of 2324	5112	UacTest.exe	94
PID 5112 wrote to memory of 2324	5112	UacTest.exe	94
PID 5112 wrote to memory of 2440	5112	UacTest.exe	95
PID 5112 wrote to memory of 2440	5112	UacTest.exe	95
PID 5112 wrote to memory of 2440	5112	UacTest.exe	95
PID 2324 wrote to memory of 1236	2324	Inpwdja.exe	98
PID 2324 wrote to memory of 1236	2324	Inpwdja.exe	98
PID 2440 wrote to memory of 4000	2440	Mnrjvryib.exe	99
PID 2440 wrote to memory of 4000	2440	Mnrjvryib.exe	99
PID 1236 wrote to memory of 2572	1236	cmd.exe	100
PID 1236 wrote to memory of 2572	1236	cmd.exe	100
PID 2572 wrote to memory of 4764	2572	cmd.exe	101
PID 2572 wrote to memory of 4764	2572	cmd.exe	101
PID 4000 wrote to memory of 4952	4000	cmd.exe	102
PID 4000 wrote to memory of 4952	4000	cmd.exe	102
PID 4844 wrote to memory of 3208	4844	furz.exe	104
PID 4844 wrote to memory of 3208	4844	furz.exe	104
PID 4844 wrote to memory of 1336	4844	furz.exe	106
PID 4844 wrote to memory of 1336	4844	furz.exe	106
PID 4844 wrote to memory of 2320	4844	furz.exe	108
PID 4844 wrote to memory of 2320	4844	furz.exe	108
PID 4844 wrote to memory of 2336	4844	furz.exe	109
PID 4844 wrote to memory of 2336	4844	furz.exe	109
PID 2320 wrote to memory of 2024	2320	WindowsUpdate.exe	111
PID 2320 wrote to memory of 2024	2320	WindowsUpdate.exe	111
PID 2320 wrote to memory of 4396	2320	WindowsUpdate.exe	116
PID 2320 wrote to memory of 4396	2320	WindowsUpdate.exe	116
PID 2320 wrote to memory of 1612	2320	WindowsUpdate.exe	120
PID 2320 wrote to memory of 1612	2320	WindowsUpdate.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe
  "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\furz.exe
    "C:\Users\Admin\AppData\Local\Temp\furz.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3208
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /delete /tn "WindowsUpdate.exe" /f
      4⤵
      PID:1336
  - - C:\Windows\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /delete /tn "WindowsUpdate.exe" /f
        5⤵
        
        PID:4396
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1612
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2336
- - C:\Users\Admin\AppData\Local\Temp\UacTest.exe
    "C:\Users\Admin\AppData\Local\Temp\UacTest.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
      "C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5081.tmp\5082.tmp\5083.bat C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
      "C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\50A0.tmp\50A1.tmp\50A2.bat C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4000
      - C:\Windows\system32\taskkill.exe
        
        Taskkill /IM cmd.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 100
      4⤵
      Runs ping.exe
      PID:4608
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 900
      4⤵
      Runs ping.exe
      PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

97cb3fda3cff430377a866d6b437de8f.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\97cb3fda3cff430377a866d6b437de8f.exe.log
Size 507B
SHA256 f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
MD5 76ffb2f33cb32ade8fc862a67599e9d8
SHA1 920cc4ab75b36d2f9f6e979b74db568973c49130
SHA512 f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
MD5 SHA1 SHA512

Submit Download

5083.bat

Path C:\Users\Admin\AppData\Local\Temp\5081.tmp\5082.tmp\5083.bat
Size 187B
SHA256 0848f1ac65974856844e59ff3b8d492c88acf43f0fd64505d5bf3fd4e43d9da6
MD5 befbbfdadeef80e445fdd152a121a6d1
SHA1 67019f2a12662f2ff92dc7977769b0debdbf564e
SHA512 867c4ee6cb22ba7ba0d5aa9c16d321f36013588b6057e3f3f0e6de670481ab1f7d46c1553b9410ff753de7e923d1b774db0c8297091fd9c852bdc96fee43ee32
MD5 SHA1 SHA512

Submit Download

50A2.bat

Path C:\Users\Admin\AppData\Local\Temp\50A0.tmp\50A1.tmp\50A2.bat
Size 34B
SHA256 a9bf329ec3514d7d5698851137d508b763b1a627747b1ce40ddd5c524538459c
MD5 4f4ecd10fc86be6be730390c06be67c8
SHA1 4c59c25907109fd48d8d94caaa8b8266ffa3c7c3
SHA512 b4e89c807071e770b9327693032c8d1ebc06811dfeccfe0892e00deb449b75cb5d921ed2f7ae53d3fae00837bd6eed3fcb0bfc7168cad0f0c44997e51e4365f9
MD5 SHA1 SHA512

Submit Download

Inpwdja.exe

Path C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
Size 88KB
SHA256 dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77
MD5 d1082e6ae11fecd45ebe0f2b3d32230d
SHA1 c070a8395ccb984f5bcd8f22629ffa1b41ea14c1
SHA512 d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3
SSDEEP 1536:zj7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfFwUFOR:z/FfHgTWmCRkGbKGLeNTBfFPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mnrjvryib.exe

Path C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
Size 88KB
SHA256 46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a
MD5 5303046dacbdfcb013ff016a72311e22
SHA1 deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009
SHA512 261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b
SSDEEP 1536:Uk7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfpw7OF:UaFfHgTWmCRkGbKGLeNTBfpb
MD5 SHA1 SHA512 SSDEEP

Submit Download

UacTest.exe

Path C:\Users\Admin\AppData\Local\Temp\UacTest.exe
Size 140KB
SHA256 6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4
MD5 7c011f0ea2387f0124c959e3f663cb4d
SHA1 12e668079661c557963236786bb821af4628ee1b
SHA512 f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e
SSDEEP 3072:eZoJSyDny67mOTY68lRVsQsBi17S5odcxRVsQZLn+gt+Ta:euJSe1Y68lnsQuUcxnsQZL/+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_skdg1fri.p14.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skdg1fri.p14.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

furz.exe

Path C:\Users\Admin\AppData\Local\Temp\furz.exe
Size 117KB
SHA256 b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
MD5 b72d429d1d690165c7b0de4a074c4a58
SHA1 f0704d227482a80f2f90dab79ed4acd9770fe565
SHA512 f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c
SSDEEP 3072:qwS9xonGdoFlC5w/oV9RRKyfKW63beFEKyBFfa1:5CeSKyRPfKWybi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2024-180-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/2024-182-0x000002D3814E0000-0x000002D3814F0000-memory.dmp

Download

memory/2024-194-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/2024-181-0x000002D3814E0000-0x000002D3814F0000-memory.dmp

Download

memory/2320-199-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/2320-175-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Download

memory/2320-196-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Download

memory/2320-197-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Download

memory/2320-195-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Download

memory/2320-170-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/2320-176-0x000000001B9D0000-0x000000001B9E0000-memory.dmp

Download

memory/2616-12-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/2616-5-0x0000000005860000-0x00000000058FC000-memory.dmp

Download

memory/2616-4-0x00000000056E0000-0x0000000005772000-memory.dmp

Download

memory/2616-3-0x0000000005D70000-0x0000000006314000-memory.dmp

Download

memory/2616-7-0x0000000005670000-0x000000000567A000-memory.dmp

Download

memory/2616-2-0x0000000005780000-0x0000000005790000-memory.dmp

Download

memory/2616-1-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/2616-0-0x0000000000CA0000-0x0000000000CDE000-memory.dmp

Download

memory/3208-135-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/3208-146-0x00000289B9280000-0x00000289B92A2000-memory.dmp

Download

memory/3208-147-0x00000289A0410000-0x00000289A0420000-memory.dmp

Download

memory/3208-136-0x00000289A0410000-0x00000289A0420000-memory.dmp

Download

memory/3208-150-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/4844-174-0x000000001EFB0000-0x000000001F0B0000-memory.dmp

Download

memory/4844-178-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/4844-152-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/4844-154-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/4844-169-0x000000001EFB0000-0x000000001F0B0000-memory.dmp

Download

memory/4844-102-0x0000000000920000-0x0000000000942000-memory.dmp

Download

memory/4844-171-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/4844-173-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/4844-151-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/4844-106-0x00007FFDAC330000-0x00007FFDACDF1000-memory.dmp

Download

memory/4844-108-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/4844-153-0x0000000002A10000-0x0000000002A20000-memory.dmp

Download

memory/5060-110-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/5060-14-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/5060-13-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/5060-11-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/5060-8-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/5112-109-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download

memory/5112-111-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Download

memory/5112-107-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5112-112-0x0000000005050000-0x000000000505A000-memory.dmp

Download

memory/5112-128-0x0000000074DD0000-0x0000000075580000-memory.dmp

Download