Malware Analysis Report

2025-01-22 13:58

Sample ID 240305-px5f9sfg99
Target Dbug.rar
SHA256 854e1c26121698ba6b70584de483d601fe52d508195765618cb136d1da56141d
Tags
njrat xworm hacked evasion persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

854e1c26121698ba6b70584de483d601fe52d508195765618cb136d1da56141d

Threat Level: Known bad

The file Dbug.rar was found to be: Known bad.

Malicious Activity Summary

njrat xworm hacked evasion persistence rat trojan upx

Detect Xworm Payload

Xworm

njRAT/Bladabindi

Sets file to hidden

Drops startup file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

UPX packed file

Looks up external IP address via web service

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Program crash

Unsigned PE

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Modifies registry class

Delays execution with timeout.exe

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-05 12:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

149s

Max time network

154s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\svchost\\$77svchost.exe\"" C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Fluxus V7.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2212 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2212 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 3068 wrote to memory of 3060 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe
PID 3068 wrote to memory of 3060 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe
PID 3068 wrote to memory of 3060 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe
PID 3060 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3060 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3060 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3060 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 3060 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 3060 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2728 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2728 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2728 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2728 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2728 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2728 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2444 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2444 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2444 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2444 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2444 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2444 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 1376 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 1376 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 1376 wrote to memory of 1452 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 1376 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1376 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1376 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1376 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1376 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 1376 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 1376 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 1252 wrote to memory of 2072 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 1252 wrote to memory of 2072 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 1252 wrote to memory of 2072 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 1376 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1376 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1376 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1376 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2996 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2996 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2996 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2996 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2996 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2996 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2080 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2080 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2080 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2080 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2080 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2080 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2716 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2716 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2716 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2716 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2716 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2716 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2304 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2304 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2304 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1452 wrote to memory of 2876 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 1452 wrote to memory of 2876 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dbug.rar"

C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\system32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 1040

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {B3C43431-EFA2-48BA-B244-86B465CB064B} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBFC6.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp

Files

C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe

MD5 a50ad7aa97bb981a248432afd04e8312
SHA1 a9db907d2f1f1dabe75ffe274f68e4bb4837b3ca
SHA256 1b7aa3d5ab6299f49daaace1333302b7f411bb5f77de45a4115a5b3c1868e86e
SHA512 e33eb059cdadf9c4af30527b76e24d5f13da3cc72c90a27d7cf5b23d31e83161badf16be5798bebc596de56b3885b512a65b4f05abc632621f16dc96524ee296

C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe

MD5 1d02ae6be4d95cdda63fbd3c23dd0189
SHA1 612bcea25f40f74e5e57fadf7d0b0e35b23953a8
SHA256 ec2c636cef30dd46669e2d908e33a6ec514335661fd06f12d5f5803cc8658822
SHA512 d67967a04ab448054a6c0a40267a7d137c59ea1ef8fa0651b9fc48be2c2d5bf592b4fc36c1ff12001de825a9fbeefcec46aca46e80af5026e36e20bada01e18f

C:\Users\Admin\AppData\Local\Temp\7zOCFB6B016\BandeeraRAT By Donbas.exe

MD5 b7d891b445c289dbcbfd958a65457574
SHA1 fd4b7d274da18dfc85c0cce80b0d36f6136ef01c
SHA256 c5794a94401e98eb0c4783aa8df938f4ff907c6b83dfe48b18fa90fc1f563a56
SHA512 57e3dfee093ff106e74140637d78e51c93e89cc70db94eb9dd15bc9a00907d1175ab4633d14b3ec1bc4fadb21f77ae5577f35f07ba8ef023fe869d784ac1fe46

memory/3060-35-0x0000000000190000-0x000000000101A000-memory.dmp

memory/3060-36-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/3060-37-0x000000001C000000-0x000000001C080000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 0bddc5462d9e5cf9ceb8d2b1adb2fdc0
SHA1 fb2b8205ae5b43e651fb7404d70f6cd162c8e607
SHA256 3ceeeed7f391aa1e627f937e8483ebf71c5a977353c276ce80279bee939eebff
SHA512 7524cfc0098404670219942f5be953b492838ca3f8519d6a8fd37f35a1656f413430dec9559e8186efef6efce763b53f2be12aac4756a938c320088e3cefd8e1

memory/2728-43-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2728-46-0x0000000001040000-0x000000000135E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 a87a17331f6610f77137ca835927cbe7
SHA1 982cef32f4ccf4ab35a6776839111acaa3f54c17
SHA256 8db966da42e7938ee71580f84b89b0396082d5d99e2d55e9e67bb45cd899dc17
SHA512 81d2af5582c86206aa1dbae2fdfaab79e347671abe625d56eff6ecc1234c4d1dcab89e08787c12adbb05998513bd47b0e00eaf1f508566434a29b08431f061e2

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 c8aba90a9845c9c7a06aec6e6093fbc7
SHA1 2a765365ae1ac0ef3743b1a8a2a254584a9b3998
SHA256 6b6b54e9e6c99fb97aa4e81eef3252dfb5bdba8cc5121310c164d9b49e07894c
SHA512 e134faba91c1fe816cdda8ea6c4b785dd1f7729917e8d024dab2c1e81d8f782a5f05ac09e062f730b7cf1f7d80130a1c4d8cf24d86e6df5e30d7ad496d07235a

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 5a40bec5f2a9e9913b18def1defeb143
SHA1 85222ec9bc250da1aa19f95e43b261e4cd5b4255
SHA256 4fc8856502a9fb1ebd78e3a74f82b4ad299275514d7299b85a32fecfc6c6347d
SHA512 6adfe1c2977fc33060c95579755f72f88b20eac83eb2f9e8c0942f0690610d5f78ec141fe953dbc38483f1df342cf87bb2ba96eb97074ede88b5e5aadd0ccda7

memory/2444-52-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2444-51-0x0000000001140000-0x0000000001CA2000-memory.dmp

memory/3060-50-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2728-53-0x0000000000D90000-0x0000000000E10000-memory.dmp

\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/2444-63-0x000000001BD00000-0x000000001BD80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 0096d448f5a9f606759a376737152c50
SHA1 936272c8689b9ab1fd8e9d711edc93ed48cae6c8
SHA256 0013c2252cdea661377b0b173e31711b999fa216191e8a517ea140371c34cb20
SHA512 9fd69eecb589e651ad39f353795bd590eacd15749d92a3d5f39f30d80ca423075396b69bfc9ac7f650f618e6a5a9f3aa09c793bde96a61cc7fb6a246a6632f2f

memory/2616-76-0x0000000000CC0000-0x0000000000CD8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 9e01da220c66ce59052db44372670a6e
SHA1 db6d993d8d6f2cacb1949f503b9a6688211694cb
SHA256 b8f0ba4bc20879138c6f7dc735c7d277e62603344fc9c730c5035dfd4e72ba98
SHA512 fddd0300fad2b32428bfbdff32acfbc20e05362c054caf356f1afda3d265164c2ac348246c229209d2531da73a3384398eaa9705b8d225472a4d47886281d798

memory/1376-79-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 dad2fa066360f2af879331252689b5da
SHA1 53155ac22db7d454b39763c4b412a075f78f8750
SHA256 d277e8fd74929526c473df982b239a0a85938ff71da91201952bb4aa3ec9624f
SHA512 0b99fb833301a7321821fccb4a1963b1191b4c6c75872740e0e109356149cdb9b39984eadf0c93ad5925fc4058276b0e2bfeac492061092c8074d338e5e45265

C:\ProgramData\Cheat.exe

MD5 e690076cd7c2d67e7c4f5334c2e416d3
SHA1 4a13a18cf4389ffa285f00b9786349b5bee94815
SHA256 7afb64fdd59a6cffae0161734be2eb59c02d32901ff4dcfe368591e70c4ccb4b
SHA512 2e7c213b481106dced9a6ab1d9635a4eb92e63139c8db9fba36d08b6d8bb9a2c1688066f467ccb2efe5bffda6b84551debed19b27b4eeb33f7819fa5604442da

memory/1452-92-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

C:\ProgramData\Built.exe

MD5 68a065be0c0fa739d2b63d07bce47351
SHA1 8388481ba2dd8dcf9ebfd809cacee188324de447
SHA256 07d62c0546ad035f824655574abb48c28a4116e3cb139259e07bf9faafe04dcd
SHA512 0c1723adb043c5bf426a9c708dd1cbe6a1d9855c5e3eefd3a4a004519a70ec35d6c1d121f9ca647dfe80e6b67cdba41e9a24f72e335677f2ff148fa4b348fc12

memory/2672-100-0x00000000012D0000-0x00000000012E6000-memory.dmp

C:\ProgramData\Built.exe

MD5 b4ca61fac9e499c6104e415e52227de8
SHA1 ccf4811c90aa3db76a02fe5945f898df7182b434
SHA256 0332afbffafbb7d8dc61e6eb3439806e88d4baddffe021e7da2f344ee6bf1956
SHA512 15eb46a6032457cd2fc4303bb11068fa85f6a4cc90f67f8d5ccca7fd8141e950c925dd68801d161fe11e89ddffc4c7da4a38848cc61b2e6ba7fa7613a4acfde3

\Users\Admin\AppData\Local\Temp\_MEI12522\python311.dll

MD5 f84e5ca2fcb5d1528e45ff7ec4192f0f
SHA1 b9a7d067ac5e6c31e5c9027bac660014b2ddf873
SHA256 f35ff641b832b1230c10fc21f8e8f93356a390aac466026b445160df9612b07e
SHA512 f22f4f6d40c5a0930d91a3dc28840c3e5756ace7340c2e475cbdc077c292ffbabeca64b55af5b4ca684d6a3e04b2ff533d5599a7d9e1fb2e9a15bfc2f601fb27

C:\Users\Admin\AppData\Local\Temp\_MEI12522\python311.dll

MD5 ec90a2ecad4d5f731f46632078f634f4
SHA1 9e44851fe4d1668cc7eec8ddba9b61b813b43920
SHA256 f43dd87d1450e9d889076192881391e7ac2df903b654246118d66cf37032b77f
SHA512 4d18011334f93836265ffaafea7bdb3f88032f18ee81908f229749b3f330898e9c112c4138280c7aeb65e64650649886cece4c02777e9e2884403350e49d8f9a

C:\ProgramData\Built.exe

MD5 cecba5c49cf788f758edc0dd3e98712b
SHA1 accdfc9c1649ae8db723ff2198c56ba720888a1e
SHA256 ea4b99953f36ebbbdd368ec4f0a6ba3046139a273a1686c33b1f88c7337f4717
SHA512 cdd6db7c702b8591d6359dedf9c69606009bfac9be444276da1be940757773d5c92c2cfd15e22aecdec7c93cdc6607945298ccca5496487eb3e6d55f08bb2f3f

\ProgramData\Built.exe

MD5 06cf16a875080d88a6a53d2f1af743c1
SHA1 ff4c75eac6ec7ca6e9ca588917f67939e80bfcf2
SHA256 ed4319cc7521cde77fb3bbf5dcff8e4d1ce6099707143caacbba699e8a59bfe6
SHA512 19d0d386a1dcd218d7af18a07589b255c01b8dc591f8af46d87c102f5b0bbfae9756affd9bee24560faf536bc8b1a4aba4f3f6c0c36743c44215671bb9a81a8f

memory/1452-93-0x0000000000280000-0x0000000000290000-memory.dmp

memory/2444-91-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2996-130-0x0000000000490000-0x0000000000510000-memory.dmp

C:\ProgramData\Fluxus V7.exe

MD5 ccf9c7461690998b4793139892e2a4e3
SHA1 230c81147bcd1bae02ea001c883e0ddeb66f00b5
SHA256 8440b7c21e204ef842cc7559a25cc987112ba42ac58c08808d688c06ce8d526b
SHA512 55c973b138f9a5c49f5ca060f711f7916ac9bf7f03c82942f6e8c1dad819eb63b5efa4af403b2fa59a1fa0cfeb8b299f5685f9c4069bd78cb2500377ce57ce2e

C:\ProgramData\Fluxus V7.exe

MD5 9ff7b983bf1ab0cfdc9ce308f13f4e0d
SHA1 a7a1a989baa7608d4471d1af1ab7d8d3faedd3dc
SHA256 bbb1b56a5d64b034e2dabb3f9f7cf1843864b55e8f069583805f78ba99ee5097
SHA512 eec35247e21bed6ae45ed1d449a890f7c91edb7ea374079ec9e04e8d6c68bc81a0bbc2fa8abf6d464fbcefec977a897471e7be44e88c377840357b48714f76dd

memory/2304-140-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2080-139-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2996-142-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/1376-141-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2672-143-0x0000000004E70000-0x0000000004EB0000-memory.dmp

C:\Windows.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/2072-133-0x000007FEF1FA0000-0x000007FEF258E000-memory.dmp

memory/1636-138-0x0000000074310000-0x00000000749FE000-memory.dmp

memory/1636-137-0x0000000000DC0000-0x00000000011B4000-memory.dmp

memory/2716-146-0x00000000022D0000-0x0000000002350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 971c5f44d65855391c619c5580ed0f0b
SHA1 985cafb2523d5bfa0060b59103c2778199d25ed9
SHA256 a3acde2ea268fd43fb49c750a14dd14fd02a4ce03fa2e37cf5cea62229f5a867
SHA512 1325dd7f9337659da0622c79302b7e1647b0011c38e140d4d2497c8737cfcd042ee4dcb4954a9c7db4a88e64640a5ad3cdbcebdc6a6e692645cd391e7ac4232c

memory/2672-129-0x0000000074310000-0x00000000749FE000-memory.dmp

memory/1376-78-0x0000000000150000-0x0000000000CBE000-memory.dmp

memory/2616-77-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

memory/2716-67-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2728-66-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2996-62-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2716-61-0x000000013FFB0000-0x000000013FFBE000-memory.dmp

memory/2716-147-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 0dbd4baf39e92ab7b13312ee36e1e2ec
SHA1 f25fec308e8a098f864977b419be1b5656dc21ef
SHA256 cb7142d6e8740090134aee5de7ca69da492a59d3c0177f60980f84be98256be7
SHA512 797db567f412982fa79edaa627e5500c830e6d67985292168789f369b2429c31efca17f61e53fdfcab89df09ad403d7788c0487af0dd6ea3db244c2b5dfc4657

memory/1636-152-0x0000000000440000-0x000000000044A000-memory.dmp

memory/2616-154-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/1636-155-0x0000000000440000-0x000000000044A000-memory.dmp

memory/2080-153-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2080-149-0x000000001B4E0000-0x000000001B560000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 0ec26763887898eed5d2cbb822ea9153
SHA1 b49297fd5aa67052e54456c6ce3939eb5a1d0053
SHA256 c8e05e1a99c6c08dc67723a9c4ac1416c529e4cfdae1402cfe44229314a3c70e
SHA512 051fafb322b4c638fb1705890ab3cefd3d9c552ebbd9cc39e028040361dc526e732ffd76258c405b5bb3e6cfbb0fb7c81a520e8bdd3a55eb2d34c866c65fb25e

memory/1452-157-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/1028-158-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2304-160-0x000000001BC10000-0x000000001BC90000-memory.dmp

memory/2672-161-0x0000000074310000-0x00000000749FE000-memory.dmp

memory/1772-159-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/1452-163-0x000000001B060000-0x000000001B0E0000-memory.dmp

memory/1636-162-0x0000000074310000-0x00000000749FE000-memory.dmp

memory/1028-164-0x0000000000260000-0x00000000002E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 43477a8135d96d4dfe8b411098477f99
SHA1 61e69ff8dbc99ada9edebfca9baeecc32ce04e40
SHA256 e7b54daa6f0d4323565034d16717dd56e02b08e0a07f3cc35cf825e3d8aafe99
SHA512 4fa990fd6f7c6524f12ce6a413f75fa71c6f090c8054cf1151a64c9d6875e2fcb3df578084d8debc1818aa1a48a7d366a91580f3b884a03b990b5deb66c23965

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 53bce16e5981d76e3ef7a283055cbd43
SHA1 ce62ed0c3a9624c4f090e87a59060f84ec84c433
SHA256 244754e659ea51a502aa6d39183291ef8c227c6f19bf9c5b5b70fd60d8a7fbd7
SHA512 0c1c2a731409500b594acaf8b2418078bcd6f1b50ff05bcb8cea46a23db5049628b190e4ddc31c37b2eee53b3770d4ea0b0472c61feb7d8db6e590f876a5cfeb

memory/1028-174-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2564-173-0x000000001B790000-0x000000001BA72000-memory.dmp

memory/2564-175-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

memory/2032-176-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/1772-177-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2304-172-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 37f3a7b60e83d74dbf0f7af979c611c4
SHA1 1174087ceb0f01d45756acbd4d55940013afae01
SHA256 753a2b4eadb97d95b0bf411c49fd74fea49b9c62138df9c579c23cd6e3ad8350
SHA512 fdeced6f05e21da11ba1449b92a33f610ac39e6563225fa0b8693456f8901a5b4fdd91d9b0b14cf7ce29bd6859576df1af6d47af4fa4a529a5f0dedc42e1e345

\ProgramData\Fluxus V7.exe

MD5 0d7a6a2fca0e37d6c93c65ff9d869631
SHA1 1422305312a590d53dcf21f840d2c63ea9e28376
SHA256 d0266cb8c67a3f12a1bfd3fbe675414f422ed9cd0397e959e36740c069799ada
SHA512 fd7b360415514a92f86f6e5b2339929740a1e6de2765d674fef980ad05382a5cae6aae4cf598eaa6473a6462cbfd3ba16181c92b27c38732e0674fa09ff93a63

\ProgramData\Fluxus V7.exe

MD5 292c4bf591996fca4d9117ea8849d09d
SHA1 7cf2a6b6960e8b72af8ce6e587174835d9c1fbed
SHA256 f67a66ce70286fd2102f43405bd5d0aa98cb7b3248f352cc91d5bfebf8cc9edb
SHA512 025e1051c774cbbd81c96e901792f20e8d096f8e42632bd6ebbf40ddea5570328aed5b3f872fc9f8fe4f2c25972b098e17d6a36ee90ca9c63f41af699ebd69f7

\ProgramData\Fluxus V7.exe

MD5 11010758612d10963790faa362a42f40
SHA1 caae18178d71c99f19d3911aca74631cded57d3d
SHA256 d7cc90901cfae06db0ec8bc842b47d7bc34c426b7412fdb1f583eaa9451836ec
SHA512 0c9144c36f86750a8caae949b4be03a0d98dfb2e8826e7fa43aa03f6a748a9e167f53cf90c36d375e3206e7529b72d805268dbd03b647d5aa67192b25848350f

memory/2672-186-0x0000000004E70000-0x0000000004EB0000-memory.dmp

memory/2564-185-0x0000000001F50000-0x0000000001FD0000-memory.dmp

memory/2564-184-0x000007FEEE1F0000-0x000007FEEEB8D000-memory.dmp

memory/2564-179-0x0000000001F50000-0x0000000001FD0000-memory.dmp

memory/2564-188-0x0000000001F50000-0x0000000001FD0000-memory.dmp

memory/2564-190-0x000007FEEE1F0000-0x000007FEEEB8D000-memory.dmp

memory/2564-189-0x0000000001F50000-0x0000000001FD0000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 cd9929756a412d01f4fe9b4dfc00bfa8
SHA1 7cb313415fb1c77f801683caed130d8beacc1431
SHA256 23cb4dd1b50522e198008dfce89a770fd77e98c48f7159036ef98c522a67520e
SHA512 c26fef3642bc7db0a5f2fc3fb980e26f1bfeb0e24bc432a2a600a6437671704c0f6a545090a2654f27d3d74c6aaa9933ea89f495852c5f6854d08d463c33abe2

memory/2976-197-0x000000001B690000-0x000000001B972000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DJ30SW73IAYIX0QD3CXE.temp

MD5 9011ae444cb6250b03b51083e806c460
SHA1 26d4869da2f493272a512c0dbfe28cef2afd16d6
SHA256 f875d5e9ceb64228daaf0f53c8e26bfe3fa5f719a233c66ba576cc60a7fc7e60
SHA512 da68beb9d8fc3334bf9a30ae9f6e996b9edb46420710e854d4e26d9f9d7c03beff4194a94fccb6ce973d61ac20ba25ad2418142f9ddf2d13d064a0a23cd86459

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 8831035a5e92f0698781b54fea8478b3
SHA1 97a4cb65808bb6a575fea03f268a193fb05b48dd
SHA256 a5e5d8d6dacd72a5c386e59934689593ccf29c95213a36ccbf31f4acad3b9018
SHA512 37ac36187bb02cdc846a2209e69e35c4ee274913b7120826fa2b55a4324aeb4e2a87a4d623d7c1d4f5aa1e5752f2aa68150b50a03368839064f1d54c9ab5c681

C:\Users\Admin\AppData\Local\Temp\Windows.exe

MD5 9039d8682cfb80d475173aca762d6eb1
SHA1 ccceb355c402ca6853e00736284997ab4c9f8293
SHA256 40852a365e436a8676c4ceba74b2f4788f366ce3f1fe744d7659ade2359ff2ed
SHA512 6c78ec74553843c66bf34a2acff58bd5ce0200f10f00e8c50b0ee54d6d095ce7fa3a7711513446344617f8b9e58838ef282b1ffbbf6f268ad58e93143ab6ed98

memory/2716-199-0x00000000022D0000-0x0000000002350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 65490afedd92eb17b5c2aa510e6a2f41
SHA1 61df6144169a0a17debf10b09526bd4c921d2e6d
SHA256 6efcdeabc9b662f4a26e3dcc706912ff19540463bec004b5e76aeba0aeee2e31
SHA512 fb71faf6afda0e3779881c88df2e15362bd1289d77e63db963eb6eb635efce5eecfb05c14f15fab2abb5c88e86884ec5bdae8e113af2450961ea7fb42584711f

memory/2128-187-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

memory/2564-178-0x000007FEEE1F0000-0x000007FEEEB8D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 36b8755d1ce7b58628002932514725bc
SHA1 084c8d5ee2432d6ea4bd8c5a2fa6207dd2973490
SHA256 a70612da20e7a3168de80aeb5be9194bbfaa819fe31e5dcd84297b6e4a9cd034
SHA512 1ee4ce4f7d73a0917a33f601038d8bebff672934544dd8990410269d0865fbfcd35f570c02debe286abd953d6b7f755e04640b45c485911548261b951002b9f5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 baecdb38f5f223cea18aa53a6df3576c
SHA1 b4592fea1233f7cf667a10da01bcc0dd1fe52855
SHA256 616c4cb4126b2d94bd9e12e97f62244000cbbdf5198372f93f1d27ff3ef620e2
SHA512 420e62dd366ff9ec5e6b50057be09d0ce2a611acca4f796f1b6bf6c46b21c9db315dcbc64cad5ca1c7a33efe83667c658fc84ff73fceb6974fcae7e7053198e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\TarA220.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 6d6472d7e9c66c7b78d35c27299435b6
SHA1 e15fa2f6c3a47b92732aaae69756671a463070c6
SHA256 283604f6686f92e7853d093b762646ef3bdf4dcf2fc907fa079ef550fffaa224
SHA512 191eb27d2bc05c173c6a2521cd68747f8bcf9ac5af9836cf2a89b294d7ddca2c7e9f4bb0b861fafa66ee37728fa9da5ec943c13f5db4ae8da433caa7235b9cce

C:\Users\Admin\AppData\Local\Temp\tmpBFC6.tmp.bat

MD5 daa5e92ea53ce4992f05065e15d699f4
SHA1 90d8cbd2202463dbb7a2b2094d48c9e10e4af255
SHA256 2e85f2019682a92b00ffdb5abca14fc2e6de5825f43d0e5075076f2aaf0849a2
SHA512 e57640701b39134ce655783f2c53c27dc9359e1254f4a6bfd13f4f2620593bf3c44f0ecb13a05845be028aa55b704203cd9bca28ae2fa53311d8a2b26a616d9d

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

118s

Max time network

158s

Command Line

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DD15611-DAEE-11EE-85CA-FA8378BF1C4A} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415804555" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000509d47b567881aace2a256ff482299d1858c7d469547055973934b3b85de669b000000000e8000000002000020000000142077ec24344b7d97bb7d759f2bf44ab56895c2e5ee25e249faddd2411d332120000000676c43c8753594c4ce13511310b8903fc449bda2b8134aebba57d041518e778d400000008889f75bfe7aac14a24bc4b12e09ca950c347e5e6b23d3cbdc4fb994b2542a250fcade85f442f2b7348d783c2529da57c2d28bd317198379fceef02be33af7b8 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f069bdf2fa6eda01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000026285a7eb1a33e56641f56abb0ceaa16cca1f571b19c10994da0918033375614000000000e8000000002000020000000a344e74962ba33963c35bde47e408677933401fe72a5b9f851d9cc727abace3d90000000c859a00c790c205ac4e256266c0021358904361f2f1e272966682af79f3098c41af66722474ae22d039c8c96b0d1942646be9e13c7414c90d4a787db2097d5ca2578281c283d6c4352db007ba9ae187620f2ee2d158843aa80a49381b3e63db49c40dfff14f485e2ccd34405813c76a508d769d947dc64aa18af74b5e9131fb49df213a204ae52ef203bfde9ece2873840000000043304e180a48f60a4360c41add33b09bfff13e023204b71666d9bde75851c46c9350259ad0e30e862b075985fc69791c9e185a8e1c7b4f9d5d1a9b3556582e4 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1212 wrote to memory of 1608 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1212 wrote to memory of 1608 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1212 wrote to memory of 1608 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1212 wrote to memory of 1608 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1608 wrote to memory of 3004 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1608 wrote to memory of 3004 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1608 wrote to memory of 3004 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 1608 wrote to memory of 3004 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 3004 wrote to memory of 2768 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3004 wrote to memory of 2768 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3004 wrote to memory of 2768 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 3004 wrote to memory of 2768 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab99E2.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar9B52.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fae53db07eb436c8ced18335720f4ec3
SHA1 ee35b7f347ea5d004292f3596d838ecd87402ecb
SHA256 c9e91b8482d1d6b562b493c4edc84c03f6507b23788286dc17d81e289cd7bec4
SHA512 67af7d362d2e7101547e0fa392f3bbcd3c64a0539684067d26268fbb746f2259d4362d4b81fb111d7900b16d42d2c1e8f9810d1f1e69e6c3e0eb0ac29d3c980c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba864c1239af4e46d7cba84673d6b4a1
SHA1 0d087e74d036f0b5571ee1940dc5f71857eda5d1
SHA256 dfc697f09f74928be8dd5d58d3ed0cf6ac285765e6866499c44d90b85cab5c31
SHA512 705ed72203df4aceebf963851bbd88a45f4340883b8a08b252c204a0459237c77ef48887bb2b21faf155c5f5ec7aa7605e18fd390267c9b0b6887810a6239a71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c31431910f87773a9f990b9f0ee0ead6
SHA1 efd3d1df79aa49e1ef64544122b2c2b291f3ca8d
SHA256 b95308fc73fa6ab52c7d7346f9371f6b5f4414c95d170a11819e81d5eb0f30b4
SHA512 4f817c0e83b3698a5151abd1a790b7d4f54ceb26bfaa62228cc5434f9d72de515b3f0cd6ece92d112e49d6f3d32598f8d8d9225a02de5c939419519d5719877d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b926ebf5d5d432e8c93c571cef05b705
SHA1 fe0f9c7ce12eb17c8fbb6e3d4fef40ddf63e9e14
SHA256 dc9d92c3ad6c515754c45704d2d3e31ba6bdf7379e8d7878dec3512729f3383c
SHA512 0ddec9201ae3668f4c6708606f621652cb0d4296b6049b1a18984a7e7710261ee62690521ede3a478e4553894a91ab69217dc79e8982d54069194ea20074e7e4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f2a93e5ad773772c145c61d96c2d39b8
SHA1 48bde8847d22c366101c28def4c534f4c2fd8680
SHA256 1ce5227af826cd27ee1b321c11a121c30c1749281f7b6a486701cbefe6878064
SHA512 9ded09aa8f6b367ab64eb4b6b020a8c5f98c27a84ab09c3af26481a77b850a43f8b8d53c50f56b6279dbf8619d0161dfcfe884d8a637946f7546103b626fc03d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fedac9f54a08b377a90d9950c0c3bbd9
SHA1 3b3627ee66f8baaa27b0ef1e2602243fc6e5dd94
SHA256 7e1da1bc9d8df98093fa733fda3bf592e2adcd19ccbd9449ce826ad8b618bb3d
SHA512 1628e1ebc75254b2eba45bf2262d0c825bccbf2a6d40416646589041209f8475a3a974b158c852ceaa1204167ea06bdb69f701462cde425f8d0512c7560344d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a1de2b0f5047a643571b0e36e58a2ea
SHA1 2f101d132ce0d9c2e71744b86e01529a4f472355
SHA256 254c4b7d56c81a70de2c536b56cc62fb60e89cc5f3d5a2ba391ba41441aaac27
SHA512 732c8ada76d2f17e4d4f98b5e50bab1a071cebccfa16349792129d61083d140e98b40201db22d101395ac5688553f310b420fe9013dbaa11b9f3519fda0f49bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c03365e2b1c321612873b4cc616b585d
SHA1 e6cc95fd9471635027b3caf1ca0fdaa0ea1c49ee
SHA256 7e9d54ef09721ece7e40c8fff61d3f9829222a900791a9bbe390edecd8cac7a6
SHA512 7dac64dbccd0e4ae2d6c041b39521b7f26754044aba13cfe25872b673e3bdb425bf8c2e7f9e9135b7ae7cd243bf076fad60a5e789c5725eafa3c1a3cc1bdb58a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f5e333352a7c31860dfbe7462d4dc3de
SHA1 29f9b967fbc7289cb368404bcbdc4bb137f57853
SHA256 a4de63732111b4dcd35a9b5940a026aaeed205ab03d9ae5ce985626771def52e
SHA512 b8150d5701f013b6a5e46489ea2e481abacd98b6738c45e903df6e213458fb23fab837b87caa54dfd604f1b3185927641de8b52b6bc1d1e316c5bca2b0bc02a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d075fc9f0478e788b996329b014f27fe
SHA1 8ca92a29cdba7abf0de1903f049f1c881b5749f9
SHA256 472316453a8254f22cc3b13c9b4f92131f041fd70cab9ce9b3b709f9ec689658
SHA512 0ac1d31f49ffc97238d858a812659592ebb3a24aaa8d6bab692eeeb93e61a416231eee7dfe0b20290810b87084424499f488bb07b6ca2ebfdd2e9f84e69bab15

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08de73e98215a6a9a15336b42aeae4fc
SHA1 7ec1b2e84f9eabcee27bfda6885f92ecc18a4feb
SHA256 d7ef823384c71ed5d6a6dff52fd0278c7dcbc1854c21f3ad3aa85b1b4eb6948f
SHA512 22baf9b4e370092ed42b8a29fa26e7a4c7cba2af75a9106094193558a48b39fb46a5419ffa171ed652a76033f3d00fc55c6d1ea916f517ad68f46feac86dad2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7f61e9a0009ceecf284d531a4d92ad7
SHA1 4ae134dca4a647a07d4473ca0cbe0f13a0db95a5
SHA256 5468320e55588dbd021f5253f4022218630c4f6ddc12ff4251557e16c84445a1
SHA512 6b76be4cfe36246b53e05d2b07ec0bb77f78c8c86ccd8ac736d1c0064a951333fd00ebb4649ca8a90e7b8fcc6561ddf664ae537504eb488c3a2d570eb2e9a0c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4696b53dccc6eb4c9cef30de7d5e7132
SHA1 7638fccd1893ad4fdaad51f400b28746155e3d2c
SHA256 9849c9b9e6dab0531a2d1c82e1fb3f6d3dea4f88ba9b78fc88a5c4f8bc3f89f3
SHA512 f32e47fa030bc5299b9a64ee6389f4833f3739fa2dbe3a40b6654ef91baa8808914ceafc961e4f28d0b2393caf0d4818a0ab8c856f56c36e3d7f51fdfc53ab31

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240215-en

Max time kernel

120s

Max time network

127s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 559a34ed5b34d1c7e61d93c3ccc32467
SHA1 f0cc52db29bc9dfcda253fce70012c61e3f1f7f8
SHA256 3b262db1931c57cd987bb69bada2e626d81c7bea3da8148762ac8bade2d4c629
SHA512 1d1a8d785c4b515c7b29d23d6c103bca4011b2b6d904de15f1adefa1bf74c23a8645e49ff123fdc87938186163e23ae77b048a8b48001c7acffbb73781c2ac0f

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:48

Platform

win10v2004-20240226-en

Max time kernel

161s

Max time network

203s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 175.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

171s

Max time network

128s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 047cd8d9e24990c735d2ef5bff4a27a1
SHA1 02136ecb06419e4527d5071fa25f6f7e2a28a8a5
SHA256 a085ece180b0fee4099291dca2c3e4cb7c69351fb0f6c84e05e9cb8294f17dec
SHA512 2307814846cf935063cb60a5edab57384c194a2f9f1782082c688e8c62151f237dff008a4701348b843549e341142ca2ad1526d3e7c4b55dc016dfc7183fe1e2

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:48

Platform

win10v2004-20240226-en

Max time kernel

223s

Max time network

263s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

162s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
NL 104.99.233.127:80 www.microsoft.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
NL 104.99.233.127:80 www.microsoft.com tcp
US 8.8.8.8:53 127.233.99.104.in-addr.arpa udp
US 8.8.8.8:53 81.171.91.138.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 224.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240220-en

Max time kernel

119s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 3131b1a87a568bf1fc44e6956a1cb92e
SHA1 bab286310898948965968b6219a371d565198cb2
SHA256 3f0a6107bc31f56ee79247a78e4f0ded6e44486792d3a6e62eef3456973a42e7
SHA512 e8f69ad4a1a56a11b0da7db697f0f3dca9e4ff48251ac1ba05973d17b35b41cf522c11cb83e706f2bc1edd8cc7cede31cc6dd79d9ddaff39447d478cc415cf20

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\svchost\\$77svchost.exe\"" C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Fluxus V7.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2992 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2992 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2992 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2992 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2992 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2992 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2852 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2852 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2852 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2852 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2852 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2852 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2604 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Windows\system32\conhost.exe
PID 2604 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Windows\system32\conhost.exe
PID 2604 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Windows\system32\conhost.exe
PID 2604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2684 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2684 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2684 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2684 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2684 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2684 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2684 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2684 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2684 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2684 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2684 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2748 wrote to memory of 2772 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2748 wrote to memory of 2772 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2748 wrote to memory of 2772 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 2708 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2708 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2708 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2708 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2708 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2708 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3044 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3044 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3044 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3044 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3044 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3044 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1800 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1800 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1800 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1800 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1800 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1800 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2844 wrote to memory of 2432 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2844 wrote to memory of 2432 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2844 wrote to memory of 2432 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2484 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2484 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2484 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1732 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1732 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1732 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1592 wrote to memory of 3004 N/A C:\ProgramData\Fluxus V7.exe C:\Windows\SysWOW64\WerFault.exe
PID 1592 wrote to memory of 3004 N/A C:\ProgramData\Fluxus V7.exe C:\Windows\SysWOW64\WerFault.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\system32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "681499311200411598301852664-2133502696-219692774-450432561-9475361961636011999"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp818F.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {D6EDC81B-2D4C-4C6E-8674-9D40FDC2EEB6} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 tcp

Files

memory/2992-1-0x0000000000C50000-0x0000000001ADA000-memory.dmp

memory/2992-0-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2992-2-0x000000001C0F0000-0x000000001C170000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b869e32cdac575ca23d73e7f9f046e6b
SHA1 2bc4ce47bb37e3ffb4faabc1015d2608a8fa96c1
SHA256 4dc95e267ff2a5054ca354035113f16be23c06e374343b6db43b5a084b71b8e3
SHA512 d6913b3460d947043313d65458768d2fb5bb24d38da236ca88a00f61f63829e164681a22c41c3780e25001827a7219eac73b47dc26eed5ad46705c0b079c7e80

memory/2852-11-0x0000000000260000-0x000000000057E000-memory.dmp

memory/2852-10-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 26cc80724113365ba984d2ed8f96e3fe
SHA1 e5488cbce197bb3778611be7a114c144032e5db4
SHA256 6f7c77604b9fc3d135037eb893ee0ac8642f8e1675a7e36f84c0377b9f879422
SHA512 10fa323f3b69b9dc5d3576ce19a79161d57492276e7a07f81e16d03f10148f5da307e1455834b7f099d636150bc0fd16dcd6e11503f89c9bb4275926b12db86e

memory/2992-15-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 786671999a5e6060fff197ef87243729
SHA1 3897b6e85fc15397f8de912c670211466878a0a6
SHA256 292f0aa2efc08f1576541f70e0974fce3b836d51be214e578e0132652aedce4d
SHA512 f759695caff23ec927e49e18b24fd4839156c2bc29ca59bbd12d3359ede2abf862f6e0647bf9464b6a5718406fe8ff3b5500b2e275fe1e2cc6930030786ed597

memory/2604-16-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2604-17-0x0000000000DC0000-0x0000000001922000-memory.dmp

memory/2852-18-0x000000001B4B0000-0x000000001B530000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 f3fab10b5840c7a2113e7981ee13a219
SHA1 552394bbd4bb09b9c2e256d4946a0fa6582ba5e1
SHA256 ad8248ab0ebe63050f53e5f61d778eda4b94986e352593233d322345ece821c7
SHA512 6748483d2cac8e186322c1a35a48a4bccd229d63c0c5d6733075a103d586be49f0d7bf8dad6bcaeb9f9ca0638f1e1f81c97bf471c60534eda4c8e8fc3347f431

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/3044-26-0x000000013F450000-0x000000013F45E000-memory.dmp

memory/2708-27-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2852-28-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/3044-29-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2604-30-0x0000000002DA0000-0x0000000002E20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

memory/2684-41-0x0000000000A30000-0x000000000159E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 21c69dbe3c97139eb2f451678e9498f1
SHA1 5013972cc46b30d2b2b3b8b3e5ad866118f90da1
SHA256 cb4c33b4aa50002f34dd2f4cde7d9d1f398999e97a40b98e319f0600f63cf0a9
SHA512 b9a007e848724e346216eb9c46082c2095b1d7223dde63beb61fe030e02631e01b7d077cafcde0f5ba6e369eff57bf53a80fd61891440d48d527d54aa60a26ca

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 73b7cfcba45352122af9a41f874acbf4
SHA1 cfeedfbb9e471e2180403ff0097b551cfcd783aa
SHA256 52efae0fbff03b9e890b35c47d5768776dc1fcbb76eb856dbad2d1fb2a44df2b
SHA512 cc43adb67e6c9c8ab589aae53163b22da2c303f185550f68534d0e9084cde28c61016f81567efc9b0a4a0d0b83663f2397cf2b64ba8e5d748307c1253dc0aef8

memory/2684-42-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2604-45-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2484-44-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2484-43-0x0000000001110000-0x0000000001128000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/2844-57-0x0000000000AF0000-0x0000000000B00000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

memory/2844-61-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2940-60-0x0000000001000000-0x0000000001016000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI27482\python311.dll

MD5 72b1ec9c8d3f4fdbf2bbf3490ceeb31b
SHA1 5b1811cc257b768ec8580ca69c2448240efa8002
SHA256 cfbea563501e1f7865cad968b81b38589e6ad8e2c5eb92161bdce94f22dbba8a
SHA512 e0cde9f337de52b1eea4dc0ba14bf07a4c2f3b3ee7088545bd6297710e9cc834fdf763b466476b7b202fe8c82f9ed1220f388f65570c5d98001663b5e9e7b6c4

C:\ProgramData\Fluxus V7.exe

MD5 dcf2bbf609334627bfa0e4894d7a5daa
SHA1 586495dc4071e19a6ede6b6f0027978350c64a1a
SHA256 63ee11cc8aec0d24454635d86cd879eaa296e1e9f0f9ee5e985c19149981e44f
SHA512 815c21e8376f38aba1a18bcabfab2d08b1d605b8cf1c5a740fe34f57a860f3c98137877aa67fbca585a5091621fb8f77963500d4ff846321f3853df2c8cf8741

\Users\Admin\AppData\Local\Temp\_MEI27482\python311.dll

MD5 6bd233085242e387ac20acb4365df93f
SHA1 84c1cae99d14c76f139f7581f202292a00712057
SHA256 7d04c5a9d2159fd9cee628be6b84817433260035a18456e55ade36e4480d0cc9
SHA512 f5289c269b77fdc2b70fb7c961078052e75dc5df6c4e45cb5ce1efc55f27124cb66a9af5789dae38ce7da05adabde9bdb13e2eaa45200803323bb8b28164f946

memory/1592-98-0x0000000000970000-0x0000000000D64000-memory.dmp

memory/2684-97-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

C:\ProgramData\Built.exe

MD5 01df6f982ce0c56c695b81c08543b78d
SHA1 c7a249a6860be1ff626cad1ed61fa39db206e274
SHA256 208026c638a99d5b6b98cf3cd81ecf8740af7634f255f1edf09bc7f91f93c907
SHA512 4e2b5d1c5a4b52231d3c0ac76449a984f153e3c4b55343e0dd59439d6905060d250a7b29094a68824394e50c50bb220b5903bd18ade0c7a481d9fd2fe031d449

memory/2940-99-0x0000000074A50000-0x000000007513E000-memory.dmp

memory/1592-103-0x0000000074A50000-0x000000007513E000-memory.dmp

memory/2772-100-0x000007FEF2480000-0x000007FEF2A6E000-memory.dmp

\ProgramData\Built.exe

MD5 efbb09116c7c3327716af24dc5a92234
SHA1 d5450ef96b0b01beb08d52638d8477c77f0eb988
SHA256 b75c2024590809af9babdf8396c4a9b9f074c6599dd386c82454e6ddcb94e664
SHA512 96c1ee6be8c673cb86f63740340f2ca26588fbd4e3682503977639adc981bf51035d131684bcc647f4ad60b9be027507be90319ac1f81a46e92489b92b7326e4

C:\ProgramData\Fluxus V7.exe

MD5 51bdb4d90ada2ef761fe7ebed246e79d
SHA1 f876555d188e91323e641576c5d201fb0e9ee61c
SHA256 6e311e80dbaa7b39addaf25b87f8e2d6e0ba87486238c114effedade97cf6df9
SHA512 f1a5ff7a3bde039e513d5d42b9880298a75a87d181c7a4724746664ca367be04dcb6a75f0848bfc10bb13ab117954bdd67dc1aa7766c44b446fb0ed9a501c00a

C:\ProgramData\Built.exe

MD5 5fa46c75598ccbb22ec14fad6ee1b3b0
SHA1 13ae346ea98cd5f3207c9f84aaa76dbedcf03303
SHA256 735b94ca7811e049186e2d98124c1449f7969c75d7264db82edaafd185762e05
SHA512 3fb8655b664e6c399ae6fdb0accdc0fee7b2b87ccce6a7cd8daf43d5d84737d5ad102929b39d35d8f1fcd1f2bdd4035d6c3cd7de604dc964ba0e40afd06fba71

C:\ProgramData\Built.exe

MD5 1d2b8a6cf1d6c25327b9ced193f4e382
SHA1 4b24e6bf1e1a420f8bfc1b5aedee1d8c761550a6
SHA256 c1d848c65b70147062cdb240009be756457a3064099d03509e051bb48806698b
SHA512 4888b1654976112208a6c5cb0fc49b55a2d998a95a6bdd77259d23d66fc819bbce0367510db15e364f161b87a9f709e4c72801b7c6c0d1cd82a4c4fffc84f567

\ProgramData\Built.exe

MD5 b9cd5513c8cfe0371b1bde1313ffd83d
SHA1 f82aea79259ca03b6a60640e624c762eae78865c
SHA256 d0c906b0e910c2af7cb6c660106bd0ea6793e71b97b3a864148e8b57b35d9072
SHA512 f208ffc6cc4fcac1d08e1572018fd65e9bd630bdd431719ca0301a0507fcaf99cf88d0395b323677456997b6dcc44f113cbe164c8fde63b785e2604d8084e9c7

memory/2940-104-0x0000000004C40000-0x0000000004C80000-memory.dmp

memory/2708-105-0x000000001B570000-0x000000001B5F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 6616c7e180fd99e7ea4821a4ccf63b60
SHA1 eb1b0f389590948c026de0ecfbec3fcf749f69c8
SHA256 6690c2e13c821bd67091a545e679f2895e089cb5119df75cb1ca615869d6ecc2
SHA512 6c7fc6345d55fec8f4911b12f5c8819d917a225ad9c9f762e73ad02dc67b9e8f7d76da89faafb2ba61762406f371bb5181b000ed74f0eb9d85ff0f505f6c96c5

\ProgramData\Built.exe

MD5 d6e33dfdff11b5fbb5f0d14b1d281d00
SHA1 1e99d6de137c23660527e2605a09d647158cdf83
SHA256 3f21535009cf059a08ea9fc62a278d01e5534f2fc5916fb24d5a224fbad556ee
SHA512 ae6704aef2c0198f3b1cc9f942b799ea612f89d476f2799c24763f53230a8e3e8263cdb4d771576b9c124c7e5a4a0fef7afc855ddfe763fde9cebd03f3ed95aa

memory/2708-110-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/1732-111-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/1800-112-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/3044-114-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/1592-116-0x00000000003C0000-0x00000000003CA000-memory.dmp

memory/1592-115-0x0000000004C50000-0x0000000004C90000-memory.dmp

memory/1592-113-0x00000000003C0000-0x00000000003CA000-memory.dmp

memory/2484-117-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/3044-118-0x00000000024D0000-0x0000000002550000-memory.dmp

memory/1800-119-0x000000001A940000-0x000000001A9C0000-memory.dmp

memory/2844-124-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2940-125-0x0000000074A50000-0x000000007513E000-memory.dmp

memory/1144-126-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/1800-123-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/1796-127-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 4b1ae410b73f696f1e7c32af0a0a4cb9
SHA1 f9c91eb61815d9633790baab442a1e6f3271369c
SHA256 d18276500bc98b4fde7933efba09d66755871f128cb259eb4f406ee7a4b27fb5
SHA512 e8590759e48c5e9a12dd578ae7884c0123d0b2181b16cbef8900c50a368caa2077c2bc49ec2120d9b59678e81ec6955912d1429bc26dcf8c27e58e0d7f1154e3

memory/2844-129-0x000000001B2D0000-0x000000001B350000-memory.dmp

memory/1732-136-0x000000001BC60000-0x000000001BCE0000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 304cbaaf5d07f69e410e4b8b2e57890f
SHA1 f01d208bdf8d75578f19c1808bf21b7c12b6bec2
SHA256 c702c681bb11d23530bfbbda1c7649d178cdc9f26baa350d176c5a74e30e1ee9
SHA512 3161d8d5851052a630b00485dd3db4ad5d72fceed2084d8e3502e8ea251a12d2d643e2e6ebbc06ad02331c7337e74c5ad02ac16996b7d5bd10bc7f14825f3d6e

memory/2152-142-0x0000000001D90000-0x0000000001D98000-memory.dmp

memory/2152-141-0x0000000002DC0000-0x0000000002E40000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 61661328c579fe59020a238550e29ce7
SHA1 3f906c1fba54b2c0f55caa64671211cfb37274f4
SHA256 1f8ee64c76bf41cd9328f1363e28e754a00c2d0419407c1e970ef9681f2e3f92
SHA512 7b63d398daea4d966b5ebd75e29ec2dfc51840420bffae3c38b191ff03ec454f00588589d98a49cd851d200d7c3b49f60ad7f1b7f253a99588e071de50dbdea3

\ProgramData\Fluxus V7.exe

MD5 4d22d82dbe0fd1eabd4632e79ec2a7a4
SHA1 f0d8fa050ac67e4733de05d6949f3773bd5165e9
SHA256 8ad5b63996e6eb19eeb28164b74c8857531851d4a53a2ba1f5d5004f9ba1e2b1
SHA512 faa0c2eae224c3ae493102cb7e81f6745672d1eba9c274a5ee4b7d59a7ff7cb06c623c643f39ca912a1ba3964b91ab87c440ec9f42240803ce194e714be173a4

\ProgramData\Fluxus V7.exe

MD5 400f5dad5beebccbdf280ab3eab83c76
SHA1 3b9ae94b1e2afa520373ad68af9f818fa413344d
SHA256 ba5349d8f419c41a5b59cc640efa5e14175ac7eb488b0cd49744ad2aebb677af
SHA512 48d9780cc0978433a42ede966b8dc5401df75b762781259500a41cc7b8c5ef152f28d7db1b4aa8de93ef69f6a28d7e9c94276208f76f97a0cbba1615e1cbf9a5

memory/2152-135-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

memory/2152-143-0x000007FEEE4F0000-0x000007FEEEE8D000-memory.dmp

memory/2152-144-0x0000000002DC0000-0x0000000002E40000-memory.dmp

memory/1592-134-0x0000000074A50000-0x000000007513E000-memory.dmp

\ProgramData\Fluxus V7.exe

MD5 fc55c9af61f6274583f37c78ba3c5056
SHA1 bb0d091b6d53a0f393ed36ba61f7041f1e1ede9d
SHA256 e3674241135c62fae20d17d808d2b2fcae9d9052654312812860eef582246fae
SHA512 0e0e0d713abde63bfb3d4c5169ec1ee3f117d847f2d3b5b7740882c9f6d87c874340ba82596586b78ac86f822c94cde0ab9e300941d43a66b03cd5a52b87edfe

memory/2152-147-0x000007FEEE4F0000-0x000007FEEEE8D000-memory.dmp

memory/2152-146-0x0000000002DC4000-0x0000000002DC7000-memory.dmp

memory/2152-150-0x000007FEEE4F0000-0x000007FEEEE8D000-memory.dmp

memory/2940-149-0x0000000004C40000-0x0000000004C80000-memory.dmp

memory/2152-148-0x0000000002DCB000-0x0000000002E32000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 7eb3adbc7c3d4f3b92ed42f53edad831
SHA1 678608784098a0e7ecc4084fcdb2c8f022404c95
SHA256 e9b6310a6a715134017109034124c067e1b7ad383f2b2a606eea1a08618f0d05
SHA512 c11fae5a472f1c09fa3d16a668b4bcacb333251a148bfd1cd2464409799654ca998ee468c1cccfadce958594029a726bb17c83a1ad43c139b82b0bc52ce593f3

memory/1144-156-0x000000001B4D0000-0x000000001B550000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 250a260fef8533b76f6d990dd7e6bd29
SHA1 20e00fab8e43f5f8b1ca764943c5f9d1f09da993
SHA256 d67a58001321adb1b3f9e9f06dd4f3973246fb87b108942b4af04c61f9ae3784
SHA512 5b69651299b271a62b709e3966820c94a2e11a1344045d37b5e62d3724002d62692cb914d65c35f1197b4a3e4e4400987e6cb05bb882db3e22f73b51fe0d3100

memory/2760-163-0x000007FEEDB50000-0x000007FEEE4ED000-memory.dmp

memory/2760-161-0x000007FEEDB50000-0x000007FEEE4ED000-memory.dmp

memory/2564-165-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/1144-164-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

memory/2760-158-0x0000000002850000-0x0000000002858000-memory.dmp

memory/2760-157-0x000000001B590000-0x000000001B872000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 009e6e983e93c753e2cbfc0ffefe8106
SHA1 6a6e287a8876cb82cfc15d3b1bd0d0df08ea6e09
SHA256 2bf187e5bb0919761aab8556f7c1a18dd8e2ed9d4a422fada3927b916c8c1d3a
SHA512 379262bdc7740fd71d0b08b5bbcb1cb32e2290cb1c5ec3fc483e32817a708cf06332747599967f5083941e84cf915831c2fe1a01dc5444e730b913124f508dc4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar4C34.tmp

MD5 dc7171e87cee0f09cfca9b821058da0b
SHA1 eb9837d5b2aac73bb30f749cc0a1b58a365915be
SHA256 b539e4365b2cfae7ab39975f082a8c9cf0d099e6908219ce66e94b175f38fa45
SHA512 917454ee5fbb3d992ad15b7c341cdb651f8088a769597633108046cb8ac8402bc4e02d6dfb87004b3321e221abbc158e2a94b6de8d4962506f693f17147feba0

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 5ed32d66080a3d8c78ae29181392e7d4
SHA1 eb70b0fb20c2af78c91581c6cf840d6836981d99
SHA256 8d652953a9fef20f7be175cb22661a848236175b4d49a525fc70b8dc074f76d6
SHA512 88310ef2dae0c29cd71029408909d9188fd96286d93eeafd04f6d4e8de2308a41c09dd0ce61c4dae7c67cbd65b978d1b203d524ab4a5e4129b8210be390fe491

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 ba6ba08bbd3dfaf48f2b0014251a1990
SHA1 3572a788eb9773b4daa44a12ba0e38306cb8d54b
SHA256 28b3e0ca72af28f8d8c1f11febc2ecba6dfa4c2132d8f4f54226674bf6924dad
SHA512 747d9287d004b2617fb3cd49d4a7f026aab31c1c520f7838a0cc35887c83c9a879a12a533ffa33d53fd5165895d0dd5e4dce0409ffc160f27f03fe6dcb51ca9a

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 acabad468a272dd229658018abb3cb19
SHA1 582af40deebe9906143d78d0c308d05b7ec2070e
SHA256 871baf95c63ab79069587fab87a8fefc89756feffecd1fde311974424ed97a73
SHA512 401a2a281087ce8f70f5b0a6fd260ba3ecddcd7de212692e38a28bd05d2c992fe2dda0cf5e2927bc1af16f0551c1c8812897b6516cd706fbe096e3d1292535a9

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 73cb9032efa610544a68ce791015d572
SHA1 5e09f223ad1061ae7af69ab4aed24b01cabe897d
SHA256 4a7b8719bf42d2d4a44f37d629f597311598282654986c0061cd36cdb834fcd6
SHA512 91106e37cf6af46ac2810722fc8194fcb7d6d026b313321cdaca6d79a3892d61724d26787865137a0adf9e5fa4ca7c490b17a1964a6f6f507b43d4d323059a17

C:\Users\Admin\AppData\Local\Temp\tmp818F.tmp.bat

MD5 2be4af1b450f958dc1301befe9f28b08
SHA1 6f975e7e09f97a5d5a8a41bdbebbcad646cce14c
SHA256 7803cd2e46f3acd73f39f1d3257f1e469a61658dc0fabaef3af633a153bf2500
SHA512 c7941b8ada58fb9f1ecbb3c068f26c8694560ee03b460b9e0108c1446383d580bb8907e412ef86b6c8929d2cfe489eb4a8d4ef82fd49d9f26a9f3a6cefe46415

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

90s

Max time network

209s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\ProgramData\XClient.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\svchost\\$77svchost.exe\"" C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3804 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3804 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3804 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 3804 wrote to memory of 4792 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 4732 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4732 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4732 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4732 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4504 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4504 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Windows\system32\cmd.exe
PID 4504 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Windows\system32\cmd.exe
PID 4792 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 4792 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 4792 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 4792 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 3580 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3580 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3580 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3580 wrote to memory of 5064 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1660 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 1660 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 1280 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1280 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1280 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1280 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1660 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1660 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1660 wrote to memory of 2216 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 1660 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 1660 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 4632 wrote to memory of 2356 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 4632 wrote to memory of 2356 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 1660 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1660 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1660 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1612 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1612 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1612 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1612 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3556 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3556 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3556 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3556 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 644 wrote to memory of 468 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 644 wrote to memory of 468 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 3800 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3800 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 4156 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4156 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4156 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4156 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3800 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3800 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3800 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3800 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4944 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4944 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4944 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4944 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3800 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3800 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3800 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3800 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7CA8.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe 88f563b583105c49347b2780f91fcd5e 7m1DQ59+w0Se7mR3+3X1/w.0.1.0.0.0

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 13.107.246.64:443 tcp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 218.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 blank-bkjga.in udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
US 147.185.221.18:34511 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 16.43.107.13.in-addr.arpa udp
US 8.8.8.8:53 epsilonbot.xyz udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp

Files

memory/3804-0-0x00000000003D0000-0x000000000125A000-memory.dmp

memory/3804-1-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/3804-2-0x000000001BEB0000-0x000000001BEC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 33d9fdc522a576774e789976620a2c53
SHA1 7ec2eb1852299f5e51d25565d1637545a56d50b8
SHA256 62d68dcc771234626f17bbb743b31ea29c13bd6cee279d8eafdde29f7f392247
SHA512 66ef08877b90442d748d500e5624cb64cd051c5b02fc9d755059322a6ce17c8085411a494c6bb22c26a4c28e0c80c6130e82401a0aca3419645a9e297bc7187e

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 e763a61abd6b400c542818f071d4a62d
SHA1 fb749ef1e251e1a4e3b8c0ded6a4be5e71398f2b
SHA256 1865c2d07bd9b75d8aa06f8d7e3467885d0dd58a874c42fa4eda8862f87dedcf
SHA512 c2afbf62201b091316ccad7b2b573a05d9bd5067fd640b6435a09cd9cae3d524af956873cf1ca272ef1f159e30b3a1fd9366d7baf7b0d59944a9e59f519f86f9

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 d83d98ee739941ff869ce8f9d5a0bdf2
SHA1 069e5cc6195451c85c5666a210e0c00724ba2f1b
SHA256 99978c8128f2124beed80bb03e6f2058763f54a580d91125d802648eabd7233c
SHA512 eeb3693973138e1d052a2fb5c6189e4ff59f10a0729b445ad4f23ac8b9eb3b4cba7f136bfb3b2259cb717d218277ad63fa012a0fe04f850c2bcfda4d25f15098

memory/4732-18-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4732-17-0x0000000000420000-0x000000000073E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 5ab00b83f4cdd73b9e30f45260c09a2a
SHA1 9a9e4aea8b0e88aabff91c80f9859b1956287912
SHA256 23db86c70233efc3060f3df4ba6c0a9f8cf030b4c21a690f8136624c03a0ca02
SHA512 3025381c7e30c96cf59087d425b0f3102b78494e4ea8298045cb9f68df0ac8d1f845516133cce3f8139760d03139faa31ca4387a6f474f9e2b9b93e10d40a5ac

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 293506604dbd732025c496a02006cadb
SHA1 cd9050991eb72bff963dccb72cbd54192ca006d1
SHA256 06907792813443c0352ae1b8b16935b0aa956b824d43de698a384b5119b3a841
SHA512 8a3ad6f56923a34569595c3784f39d817f65c07511bbd61c7a5f73d680e79984995e7596f4ac81ac3ce31e2236fbef4e50825d15a92006a42464aa04fbd140cf

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 4f32233486af1f9f05662a54077f9abf
SHA1 6d7e0475d323609286cc41fe33a68a9b4a3d43a3
SHA256 fab4460476a186cc4922ad10fb8e0cd723f2a660cc40e1bf54acb061e74b6edf
SHA512 104cb9b5876d71e40c4b5a986aaf9eb091d9ef4e5969bf97a8576451e2d1f1148937ea54fc3aff17346a85d29f5f516e96d7e2ed3dd1f4506e8574630b7ef8f1

memory/4792-29-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/3804-28-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4792-30-0x00000000005F0000-0x0000000001152000-memory.dmp

memory/4732-31-0x0000000002850000-0x0000000002860000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/3556-45-0x0000000000610000-0x000000000061E000-memory.dmp

memory/4504-46-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4732-47-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 002ae23493c71a440b4044dab37c3edd
SHA1 54557f50c21c22a974f29029c6ee4aaf63b68e6c
SHA256 5236bfd0d000e70d0d1beee2cb5e76a46cb978a4437dc7725435789ad8d4969d
SHA512 002a6c8039e611ec17dee80ed11734b4ad9d2d61994d913650c788577dca7fca03dbd5a6e2889cbb2ab5914e90bb7a1b793b3853005102e1d06801d7c3d25378

memory/3556-48-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4792-49-0x00000000032D0000-0x00000000032E0000-memory.dmp

memory/4504-53-0x0000000003000000-0x0000000003010000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BanderaRAT.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/3580-57-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 a3f0d66c3ee2a60611ec9999bc003915
SHA1 679586e79ef6141325d812dcb172fb049f18e3b6
SHA256 74f0b06fd0e3a87009cdce609545d1c2e5a133871622687ea6014cad2f352959
SHA512 b814c9c7e4567d21f191f3eeb6de2c500bd4745ba2d03977d6f15814021c1290437b6bea266cf9f74226283ab2cd2bd252a36cb8ea98e19848b50033b2b32e09

memory/4504-58-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4368-59-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 fb9e251513ad4e7bd4dd2f7c21c92f64
SHA1 c64c89d07ced58ef758087ad3c985cc4972741e1
SHA256 e0aaa7c902b34c250928c2dfe81bec681dfceda4d0848d8a3e7f28ffa8b120eb
SHA512 e5942b70923f07ac5f86e54b6e0eaa1469e9f3bd8ad208275e47b566463ced081620929eba34e6f3cfccb2330aa19034befadd3983b2b44ae70064171afd6e73

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 d88e0973590ae181d98002eb5a6ac8c5
SHA1 9f35f392ea521a39b9bf97f1f1bbfc4b4b1a1ea1
SHA256 d69c2d935e4c41240830d1070273c03ef8137f893f27af07862e3168434717c6
SHA512 818a5307d8944489bf83db3574045575acb73e4876fc016637fe5388adf6dee1f5c4b81ab9263d5ba9a597789409b15444e0814022302293964585bf9bf5e1a7

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 ae7bf7afcd7786dfda2c5f287b39d836
SHA1 53a68ab92c0ae65bc1774ee8e9bdaef7d78d5cb1
SHA256 a01c970da3a17bb9a9ebba035819a35ea39d84c6fb2d9d7e14c11aac81289d7b
SHA512 fd3f8f1f57c60ae72e5b3d041e2653d7331ec4ece6963cb08b532598be8308090d2c9220ebe88206d9d1bc141e402ee898202232ed870a09c347cf91c42c0a20

memory/1660-72-0x00000000006F0000-0x000000000125E000-memory.dmp

memory/1660-71-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 f707d2212c640c52f8fb2f8fe4293eb0
SHA1 096cf2eda0512a77195a3daec1db7f160897f4f7
SHA256 4ed5e11042e1ee5fffd61ac229241d8ddf4bd5f95efd85fbcf68135a52ecdde5
SHA512 c9c1c81e23505dc1208389b20bd2d0096714747296c66304fd4a3080c040a8fc1a1e5f2e6247dfffbbe152d75c00bc939939b4c442a9726164101a85635aebc9

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

memory/1388-82-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/1388-83-0x0000000000ED0000-0x0000000000EE8000-memory.dmp

memory/4792-84-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/3580-85-0x000000001B540000-0x000000001B550000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 8eb6af6b57d93c74421f3b398d799c94
SHA1 61e277c4dc1586470390314830345b4ba87af155
SHA256 9b7de272ce252ef492150cc7266d5151ba4b67192a576a743e58bf7fa77d0b9d
SHA512 9ba732d1ff4ad7ee293dc6a26a4294cee1aef3742b780a60af6a5c8a08b63c688b925bfeb0e583836fc0d8e8c5f1198555e602f5e271d4689804da4a5827e64b

memory/1280-88-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/5064-89-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4368-91-0x000000001C040000-0x000000001C050000-memory.dmp

memory/3556-90-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/3580-92-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

C:\ProgramData\XClient.exe

MD5 f738f8c58e27d424830848ebda99a477
SHA1 1027ac2fc2c132d6813731278b44b41669ca2792
SHA256 d3c123744e066507576ce6fbda6325466f8f4103797afedee02775b0346a7fd5
SHA512 3b547ce9f842f874cc691503e8f272c12c9e8d866969a666b60f4a164e6d5f540d745ce7ba0da422c45a4a97201476fcc62a2a739fd694a74a41432568f8d917

memory/644-107-0x00000000007F0000-0x0000000000800000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 976a4aa871849b3c277c10bd94a8d5bc
SHA1 abdaf71f60ec71117424f1d74805b02fca40eb19
SHA256 5da677f3c146052e1faf3960b4867131a9241bb0e84718d70ce6eef459d0ac71
SHA512 eb8d83fa0dc253fc4719628bb46cb2c6323dda95696440528ae6f8835c66ec66fcf9b4331c7ce886b7be283313698dc50e8b7ced256af45b8587aea47de00c7c

memory/644-110-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4368-112-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/1280-113-0x000000001B930000-0x000000001B940000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 f76cb29c39a2e8adb205e7838ce51b39
SHA1 4bdf6d9b5920c9372d3bcc68d15f0fd4a48e307d
SHA256 082c924334a9060dde70d31f6e79a8a9ace251bacce3cb520c7386be6e4a4ba9
SHA512 bb9018d5f4901883603b4fbd0cf03212be73377387a10077cd01855331a51900d354c5f3253f0718c9bcb60981179c4c01142923945c855218c0adeaec578001

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ssbobr2.0.exe.log

MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

memory/1612-117-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/3800-118-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/1280-120-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/5064-123-0x00000000017C0000-0x00000000017D0000-memory.dmp

memory/1660-122-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/1388-124-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/5064-125-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/1388-129-0x000000001BB00000-0x000000001BB10000-memory.dmp

C:\ProgramData\Built.exe

MD5 3c13bd0a34c29860334a977df7555310
SHA1 83a8757625164c993c44246614d84ecce763414d
SHA256 c6e22359660b7bad4aaab88de7934a6dcc23e41c02544157df422b50504013cf
SHA512 692ff58f9708d6f4bf48ea093a244d34da9db8a4126a479e1040f1b3c0e16e5277acd5c9de6fe1bb2bf2272f283ecffeaa433c258dbac3170455ba9d3532bba9

C:\ProgramData\Built.exe

MD5 9ea643967331dfc823453658f8edd31b
SHA1 0c26207e222ad80c3e5d7398b78ae3bc8409c4bc
SHA256 ea6b4ecc63b2c1e8fa4510dc41e3457db73a12d2d3eaab971e935ab367b20438
SHA512 8d78c4092ed91475fe2d08d2bffbf44804687a30c72eb694bcd3693b57d408f7b0ab7c68829b79edfe026a123abb42407162025f6eeb44385e36bbec74263c82

C:\ProgramData\Built.exe

MD5 fc3c48347e3ebf0c06bb7f5e6d5a0d34
SHA1 edd1ad0a2c772f48ddf5e8c98a276821e20c0bda
SHA256 6abc3002de8d2e4ea6fc1490e3cc330340a2a9a0d02666f740d9386072b17871
SHA512 6569e0d40ad60aba946b6a93b3ea37677d765a95dbbd177770c169789009e56f45c8eaa8af9010f3b8cc5b74708bffd17c47c5428cb7a62ac7dbe3c326fe2c86

C:\ProgramData\Built.exe

MD5 9c973b5ed61e96bd9d8b71abf601e3fd
SHA1 1b0a05039b2307d07a7d300d1d9433041efbba33
SHA256 fda4f9fefcb1fa22ad8f5f635bf5c1ad903ba01799e7f94ab0711c1082e75abb
SHA512 2bbe619fec8f66b1bd3f4f462c67299c9dbeabaeea906a7e37360a1983c7574c0682ff82c072966ff5ccc9dc75f02ca37387cc4450d0cd0cbfcddb93bfcfe701

C:\Users\Admin\AppData\Local\Temp\_MEI46322\python311.dll

MD5 98a5f05be3d87ecdaf6a50782689253e
SHA1 f1cbf5e7fed2bd2bcf3d9238900e4c6df3ab003e
SHA256 f6a1843446c9c5c5c47c005a43b7a91b47b0e487c9beca022985f396c30fd35b
SHA512 69542dba672d66aecb66986771f1ed6d5432a0b158faee1c1b5b7c70d44e93b7c2bba8874de617d41e63aefbea5993819296a51a39ed07d089900009dd6d3a24

C:\ProgramData\Fluxus V7.exe

MD5 e5372335f670496d141afef756589f73
SHA1 d377c7f63ea264489842c9687530a942a533e83e
SHA256 f7041de0535a308cede0c65b3926a6fc30b15c5ec98d5f6a912095e3f2b0837b
SHA512 b43fa829906b745dc818b81b634a9fff058664246351ea98fb324f29ff76d5c09f1570b1325d5111ede0f059e248481671953e8fd0191e33185c861c4f72c289

C:\ProgramData\Fluxus V7.exe

MD5 baf4271ff3ab027cee7ba833a0baeefa
SHA1 f38612d6ec748e31d27d4677f2a848b4c22a6873
SHA256 555f83eddc7f92f1622b9ec06054d48cde2fec440b66c01dc60c20d042189589
SHA512 ec803b84e6bc6588100987fb5a1b127fcd29716994f704ab1bbb1ae4f1eef675744169c700d4c63bb5fc3431be6d189ca6dd37bfe56874419731e5e094ed6ef4

memory/1660-174-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/1612-175-0x000000001B120000-0x000000001B130000-memory.dmp

memory/3800-176-0x0000000002C70000-0x0000000002C80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 e5a7c31b060f60014845ad38ee29935a
SHA1 a0c9ee636a843bbde54fdd6f96b609f3831abcb1
SHA256 45fd8ac4b4ff2b16c4d2c429cae253bb37c893ab51859ecabc3059ab5994cce5
SHA512 bcb2c84ac063cbca260379d3fce46452778955d6e1092dae79f375c027cb2029e46a2c7bc6c11e45617e1e0a171bbdc5077043a378a09bf1ca6979379f947d07

C:\Users\Admin\AppData\Local\Temp\_MEI46322\python311.dll

MD5 2f82b04e8211f97bf9c085a5a0feab5e
SHA1 76da60e31291f5d80a11a8dcd19c018fbaa7afe6
SHA256 5b400852f8df100fc35b141c8a04373a5b17ace701c8b6772376440e6a079220
SHA512 054ee1047f59cf82ef274bddb721a5cfc6a581395449da8f91a0d750ea70fc4d62c96dc0a75d3d5a93a07f5aaba2c6aaefee2fecafa353c1389bb71125be8b92

memory/2356-182-0x00007FFBE6840000-0x00007FFBE6E2E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46322\VCRUNTIME140.dll

MD5 8bc2190ff987e48e6f310f8ed96248e9
SHA1 7b1cb074292b28025b6b1d67fa26439dbe36d5b8
SHA256 63d6e83b2edfbf85b8ffb2a5900d6443332fd0e09b1c34e4d8ac275acc346a2a
SHA512 e30ee1e2b2cd233499f9fb643774dda062210d63ee36f9ad68bb43d2b101da6bff7c57a272da058b0059efc42f000a40b4e473d1a07e1af00bc96d5dd9f21d05

memory/4380-184-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/644-186-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4156-189-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46322\base_library.zip

MD5 2d074540ef2664e9cfaa6dfe06c12ff8
SHA1 97db176ce30b3896ecb78f93862844d06b5a0681
SHA256 b56c3e9d0a70ccc2b40ea1a6a0b370a035d87e1753be36aa4038cca2cb72158e
SHA512 d9d8757b4d155365ceb7afe7e909d5c6a7752c2ccef6b00519ea78c6cba3474b4484e8f0eb46631b8de4abf4863fcc0b2145de4b8d6336c38c4bb75f2ea28799

C:\Users\Admin\AppData\Local\Temp\_MEI46322\VCRUNTIME140.dll

MD5 c2fbaed27aa951aaac18747b38079999
SHA1 51858e791058860dfa7100e38f09527d0c22e7eb
SHA256 eb5f8eb6c7ee1e7075cebb9155bac94df49e1ab65d636ee2715f2d292bbf74e1
SHA512 374d1aaf904149b0113abf7a737ec5da932ebb30de8c0a61c0953803b90f12fb6662f51ac9e96feeb03d2462161ba6a5ff402d19aef7fb24b9fbf71c83c5c413

memory/1612-183-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_ctypes.pyd

MD5 ee2d4cd284d6bad4f207195bf5de727f
SHA1 781344a403bbffa0afb080942cd9459d9b05a348
SHA256 2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512 a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_ctypes.pyd

MD5 8912cd264ac5d28dd526dc2e9fee7edc
SHA1 31607414834c9bb206015336a7620729bedb6e2b
SHA256 0878f6147793dfe979fe41f56b1167b8a32d1b4a4739878887000fe23e91040e
SHA512 70f3df8c2b0b35d392045f23211d499bef1012f258725c63a189a8c15c5c35d45918223eb9094b28ef2cbc9f6d2ca763b248abac3444769cb367fdb8c06d1072

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_ssl.pyd

MD5 bbb8b1038c606438d61b91d813b5c829
SHA1 863945f52f5755d36545e605d3a3e5a033dee343
SHA256 d0f7a4e9f69dc2cae543dcae18e48b261e90025b7d86795b77b8e8772b494415
SHA512 72ad4dd2d5316bc94974a0203202b7086326ad70a7ee582df5259d130d4dc0be1eb0491690f50745d05434c3bca58396f0ef40ff28988521b41e1281da613468

memory/2356-209-0x00007FFBEEC30000-0x00007FFBEEC54000-memory.dmp

memory/2356-210-0x00007FFBFF830000-0x00007FFBFF83F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_sqlite3.pyd

MD5 c9d6ffa3798bb5ae9f1b082d66901350
SHA1 25724fecf4369447e77283ece810def499318086
SHA256 410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec
SHA512 878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_socket.pyd

MD5 3ea95c5c76ea27ca44b7a55f6cfdcf53
SHA1 aace156795cfb6f418b6a68a254bb4adfc2afc56
SHA256 7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923
SHA512 916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_queue.pyd

MD5 8b3ba5fb207d27eb3632486b936396a3
SHA1 5ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA256 9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA512 18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_lzma.pyd

MD5 5eee7d45b8d89c291965a153d86592ee
SHA1 93562dcdb10bd93433c7275d991681b299f45660
SHA256 7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA512 0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_hashlib.pyd

MD5 6d2132108825afd85763fc3b8f612b11
SHA1 af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256 aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512 196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_decimal.pyd

MD5 918e513c376a52a1046c4d4aee87042d
SHA1 d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256 f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512 ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_bz2.pyd

MD5 07a5cbc6d54222c4c5c3406914f7a3e8
SHA1 1f28b54f5dd3e93b8f1520c9fde4e05e49a49459
SHA256 0483a8fb71e57213b002bf3154042aa902e849fe42facd9b2e93a9360df9e4e6
SHA512 aa363e2f1272517811a4c9238f9468d4b6a951c5b20b5e9e4742a90940d641b87be4807e00328746a2792b01a32a9a633e0b29ed5d39ea06c2dd6b8c89a70235

C:\Users\Admin\AppData\Local\Temp\_MEI46322\unicodedata.pyd

MD5 294ea1698919434a391c469c9a76e868
SHA1 d71d1e174620081d13ccabf076d05af96df293ae
SHA256 46a3d4501a44cef4e5bba870eaf0b42378e2838d59b828d036f2e17c7ee3021b
SHA512 b51a77d89464c3b18c8c7bd738fc3e874ebe1261e4cc276ed2e48e11e872f995f6948829fee97b533069c5d48798c2fa89fb9596ee7d8dc1dc2c90f1bccc6b47

C:\Users\Admin\AppData\Local\Temp\_MEI46322\sqlite3.dll

MD5 d75e632e41de473749bd704ebacff586
SHA1 503e05a16a34a10f815479f564517dfb6eb45919
SHA256 f6af296a45ba4f84091453f525acc426cc79e539f8071338033421e3ca5dbb96
SHA512 a0784a46014fe1ae2d9bcf9aa7539dc44ca34d38cbaf9a9051a6083b9dc3fa4b8992e1d4ca72c9595d836aff2b8026095cec130965772a53f3df39989250302e

C:\Users\Admin\AppData\Local\Temp\_MEI46322\select.pyd

MD5 2398a631bae547d1d33e91335e6d210b
SHA1 f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256 487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA512 6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

C:\Users\Admin\AppData\Local\Temp\_MEI46322\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI46322\rar.exe

MD5 25f1f99ef4d85e024edf31ec9ef1af78
SHA1 bd342fd072eeb09cdcd30e20f01f369dc8bd4aa6
SHA256 f739ea4ff913d56b7aee54b555f7a317dfc91302763842ac01cca66472fa47c2
SHA512 ae9ddbe4cd59ea2d139dff812645c019251cfa9a9575f4b4e9153313abca35ca0d5e0c86910b39d436f14c101c8ac8bdb1855c1ad1d40bfbe54570a212628893

C:\Users\Admin\AppData\Local\Temp\_MEI46322\libssl-3.dll

MD5 06c659e4020dd04201d79695d140f26b
SHA1 a8a4af4891caaa33f3227d44cf017a134225f0ae
SHA256 87d54f215488ae2707ffb044c9b38dcfe3228ea3d5d89ed21431e258b2eed1dd
SHA512 e4cf7b0ec6b0634ac9b264f378e69973a10fd18ffe074d1e9fc67404eebcc34e6612e318434af25b36bf76b2a8d0e52728f28d30839268604b929338421a3065

C:\Users\Admin\AppData\Local\Temp\_MEI46322\libcrypto-3.dll

MD5 4dd5134fd27a5351ca4e458fb1740348
SHA1 2b7233e78acc914367dc912f22870de8bff34d4b
SHA256 05c0ae7ac9b59cd58ff0968463fc8fb4af5daf77474434d3d0f0175854b1ea73
SHA512 af4536dff9b8371facf6d1596b1d11213427ae1c66b9a23262a3fe0da3ffabffa50915d5a80983816ed37a70423813120f47834586fbb8a4c75b4846901011bb

C:\Users\Admin\AppData\Local\Temp\_MEI46322\blank.aes

MD5 8aafff016c9f000ea251d8beaec45834
SHA1 cceea5d721b2113c886952f8e2da7ad9a5bb0a2f
SHA256 0ad924a10700827529810fa9f61dc9ed9873a2106620d3399286aabc414418da
SHA512 a2212421cd7ad508520678db95e10b0b1349fdd15bc458e46806a4a4790e8d0e6616609a64f7db43b7c837d97b3130e4a26c721f9f5b1431118cac969e210f0a

C:\Users\Admin\AppData\Local\Temp\_MEI46322\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/3800-215-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4156-216-0x000000001B9F0000-0x000000001BA00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_lzma.pyd

MD5 541494f253f297d6e24ec49e6d953ffe
SHA1 7c21f01fe84586ff5aaf0e702afe6271f7a686b5
SHA256 4d559fea6577424cbc5a731112f038053aeca806bfa7a1b6c9052bf314a3e861
SHA512 5906912b7d0edef8374a639ed2529bcb11a8466301e933cbb2d659fcaca548994f4353bf59b60ecf7ec869f0edf49bc8bb9136fdcecfb153a2d5bf719a6e125d

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 8a0cbe9a30137d4909e73356929ecb39
SHA1 be8b77c968c290bc10066a60fa84f69ff53b2226
SHA256 3e2d4066a33ac6ebf25115a055a79f69841a49d8a043605fb91b3b3d4097088d
SHA512 9fe325a7808bc75746f4b090407f83d695dff449e50e3feb5760d377c7237a1497daf7f2be58e6319241605648cf0e9f014d8e47f23e0e95eef3323fdb44c083

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_bz2.pyd

MD5 a7aab6a0a278f5fc96d1776c4e83f9f6
SHA1 2b853a3fbf9f1cee7581c30b8880a4309e08663f
SHA256 861d2e02818a0d2f36d75f7fdf12d61c09aa3fd6e5c6e075532930e4d894a6a6
SHA512 0b9af22c3bbdda87f7042edb7e0b89420b5865f18ea888b1dec22c46cb1400e0e2d2d2beb3acb7f125667788b700c55dfdcd862f1b0ca85bfd8400c469c4b28a

memory/4156-223-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/2356-226-0x00007FFBEEA60000-0x00007FFBEEA79000-memory.dmp

memory/4380-227-0x000000001CCC0000-0x000000001CCD0000-memory.dmp

memory/1388-225-0x000000001BB00000-0x000000001BB10000-memory.dmp

memory/5044-224-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/4944-221-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/2356-218-0x00007FFBEEC60000-0x00007FFBEEC8D000-memory.dmp

memory/4380-228-0x00007FFBEDBF0000-0x00007FFBEE6B1000-memory.dmp

memory/2356-230-0x00007FFBE9F60000-0x00007FFBE9F83000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_sqlite3.pyd

MD5 8e40e652c016160ffcf7c1726d5b412d
SHA1 f4177775405a6b1521377447da2738823d0a157f
SHA256 02586cd2163e5d8a362a2367bc96bea36daee7735d24520cd5ebaf7bd46ecaac
SHA512 2573b41b2d18322a1bcf9a580b0b38c492575125213b0397c95a59697a7b7c0e5efc39dc5212478bdf36a5cac2c5e83801fe139cdf4ea72d66b19f2066b9ac3a

memory/3800-231-0x0000000002C70000-0x0000000002C80000-memory.dmp

memory/4944-232-0x000000001B730000-0x000000001B740000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 3b05aa47d130d05181a566e82a34ad80
SHA1 042c9fa02db9c172d13ed6c81c9b3eae09a7125a
SHA256 a8fe1554b92e6e42d2e74ee85056a7320adbb0731447c2c732b40ea6409c3fe2
SHA512 dc18ebf24b9319864ab67426916c4c6a324c23770f0b278b04445fd97f663cd77134b86ecb3adce6c556780815f0625c4a11ad35100661f289f4eb3a1c07ad40

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 95fe9bca752d0976348bd8ebc10d4346
SHA1 f1ce0e67bf4fe8d50ebf37797ad1bd2fdda36431
SHA256 83761a8b3ffff822978ce8519a9da1a865746b170d23bc62a5b756fc0380dc0f
SHA512 c5926d19ee14fcd6cdde3aa35d0e1fd9673cf52dcf3d7323d73850210b9f0d724fd0591516f2bd622ff95876171655389274e5b75dd9018336f5e48dd8e94dbb

C:\Users\Admin\AppData\Local\Temp\_MEI46322\sqlite3.dll

MD5 0167d50dcd2f1aa01e54ec35024ba595
SHA1 cce9cb215969821f8bfd2d36cb885c5449745591
SHA256 9d33146053dff0907c0997f61df8e1b8498e9f064e938201bc1fae15edb7af0f
SHA512 afa09a230aed55fb8b58a3eb1573d0b90a99ddf6faa2058a43d560bc79a361292a2850d99a68daec1a527659bde2b7f260f97ad0c875bdbcbc1607600eee2126

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_socket.pyd

MD5 c56c0885cf0ef3d995d9b44d82fb3743
SHA1 acab2defcedf29a92d0f19afd8f982ec3b7acf02
SHA256 e36b61c14725f3c0c10b7275db249b4fb6605ad3e3ef047d7e1b4618bd8be4c3
SHA512 4183ce968c08ff3697c1ccd305f45485e4b8f86a81a415958f157aa1ddfdecf4ce14223d223a50ee0268d9d769b024869fdcdd0586f59b40934427f394afb5f5

C:\Users\Admin\AppData\Local\Temp\_MEI46322\_ssl.pyd

MD5 936919f3509b2a913bf9e05723bc7cd2
SHA1 6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256 efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA512 2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnrmxdas.bmy.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2356-263-0x00007FFBEEC30000-0x00007FFBEEC54000-memory.dmp

memory/2356-268-0x00007FFBE84C0000-0x00007FFBE8636000-memory.dmp

memory/2356-267-0x00007FFBE9F60000-0x00007FFBE9F83000-memory.dmp

memory/2356-262-0x00007FFBE6840000-0x00007FFBE6E2E000-memory.dmp

memory/2356-337-0x00007FFBE6840000-0x00007FFBE6E2E000-memory.dmp

memory/2356-340-0x00007FFBFF830000-0x00007FFBFF83F000-memory.dmp

memory/2356-338-0x00007FFBEEC30000-0x00007FFBEEC54000-memory.dmp

memory/2356-346-0x00007FFBE84C0000-0x00007FFBE8636000-memory.dmp

memory/2356-348-0x00007FFBE9F00000-0x00007FFBE9F19000-memory.dmp

memory/2356-349-0x00007FFC00050000-0x00007FFC0005D000-memory.dmp

memory/2356-353-0x00007FFBE83F0000-0x00007FFBE84BD000-memory.dmp

memory/2356-352-0x00007FFBE9D80000-0x00007FFBE9DB3000-memory.dmp

memory/2356-357-0x00007FFBE9260000-0x00007FFBE9274000-memory.dmp

memory/2356-359-0x00007FFBE50B0000-0x00007FFBE51CC000-memory.dmp

memory/2356-358-0x00007FFBFF4B0000-0x00007FFBFF4BD000-memory.dmp

memory/2356-355-0x00007FFBE3F60000-0x00007FFBE4482000-memory.dmp

memory/536-360-0x0000023DB2250000-0x0000023DB239E000-memory.dmp

memory/2356-344-0x00007FFBE9F60000-0x00007FFBE9F83000-memory.dmp

memory/2356-342-0x00007FFBEEA60000-0x00007FFBEEA79000-memory.dmp

memory/2356-341-0x00007FFBEEC60000-0x00007FFBEEC8D000-memory.dmp

memory/5304-365-0x00000244AF770000-0x00000244AF8BE000-memory.dmp

memory/536-366-0x0000023DB2250000-0x0000023DB239E000-memory.dmp

memory/5336-368-0x0000028E7AF40000-0x0000028E7B08E000-memory.dmp

memory/4812-367-0x000002B54F800000-0x000002B54F94E000-memory.dmp

memory/6140-392-0x00000238CCD70000-0x00000238CCEBE000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

119s

Max time network

130s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 733b74192cb8af00f221bca145a22087
SHA1 025cad1e7bd1b5825952ec8c4ac3969daecb7da9
SHA256 a8c72e262ab353dde616ba6bb7a053c8a8166377b85a5ebbd53b5998236be8f1
SHA512 7f2f6ca7ff1d1e041ec3611aa977560c6b728df520eb90276a64012df2677adf7b0a71f88a84324c428f881442501042b513cda5317248807827c80ef28976cf

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

161s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 800 wrote to memory of 1864 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 800 wrote to memory of 1864 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 800 wrote to memory of 1864 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 189.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 udp
GB 96.17.178.199:80 tcp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
GB 88.221.134.18:80 tcp
GB 96.17.178.199:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 184.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

118s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 1acdc3811c8f2961299c04bbd11c7f0d
SHA1 1cd41736862ac4dbd83ea7d5adabeb8e12ee358f
SHA256 ac1b4af034ce191ce7338737f50437863bb3ebbf8b1525177947840d5c74be23
SHA512 77c8f2e0e3ce9229b785feb43ac7cbcc12633c506ac5e5a15552cc44d5e9bfd9fbfc7d5e178057fe6d41b0f154797f8082b087c58696d1b282002974eb91898b

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

168s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

157s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 16.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

154s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3108 wrote to memory of 4736 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 3108 wrote to memory of 4736 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dbug.rar"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 203.33.253.131.in-addr.arpa udp

Files

memory/1020-0-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-1-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-2-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-6-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-8-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-7-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-9-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-10-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-11-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

memory/1020-12-0x000001C81B4E0000-0x000001C81B4E1000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

120s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
PL 93.184.221.240:80 tcp
US 8.8.8.8:53 udp
N/A 96.17.178.199:80 tcp
PL 93.184.221.240:80 tcp
N/A 96.17.178.199:80 tcp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 9bfc086beca793a1df5b6aff99537bac
SHA1 e35795e2eb3871dab553fa43fc832bbcbbc5eae8
SHA256 c4387162539460e158fca0df1e6681208771f0edb2f6fd1424036931be345c24
SHA512 7dbeadb9df04470837a0021f5e2051f06ca1e81017ef63d1be672e4577c5e56812dc60f66904877fefb7ce9eabfa8c86cab0f5b6b14ab36ad08c773e1aba33db

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

122s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2588 wrote to memory of 2932 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

167s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4792 wrote to memory of 1596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4792 wrote to memory of 1596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4792 wrote to memory of 1596 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp
GB 96.17.178.199:80 tcp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:49

Platform

win7-20240221-en

Max time kernel

240s

Max time network

283s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2856 wrote to memory of 2120 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

121s

Max time network

131s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 34b4aeb56e649eba4f2768fdaeb5b21a
SHA1 66d4a88e1c69df0e47e43d41499a9700576e6c1e
SHA256 8ee5057a2ebfd6a53f4f9c4e779266b9494607f4a5f2aea2ef97f7e32166a7d4
SHA512 92bd44187364829ad977698db0d5d4395744cf66eb1877f50a91ddcf9780b22953ecf75a3bc8407364d34a9ad861e9851f44073e0217628f2f576d79cbf0544e

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

104s

Max time network

156s

Command Line

"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Signatures

N/A

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/212-0-0x00007FFB8A7F0000-0x00007FFB8A800000-memory.dmp

memory/212-1-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp

memory/212-2-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp

memory/212-3-0x00007FFBC80A0000-0x00007FFBC8369000-memory.dmp

memory/212-4-0x00007FFB8A7F0000-0x00007FFB8A800000-memory.dmp

memory/212-5-0x00007FFBCA770000-0x00007FFBCA965000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

117s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 6a8d03459d723e059966f72445a19c70
SHA1 cfd275db43ff76d9c628b6a73b187fff8dca44b9
SHA256 b2e6d1b4025b5e1d7a705325bd73e7227a1cc2fa7448126c6d710507b95a9e55
SHA512 b6c0394928bbe8621697ef7770fe6661bfc72de8f2d1cae09630f60c443b8cd247598a47226237745376bd36daf1b1221bdb79bc9819db672f57918cf98e7bd8

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

158s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

122s

Max time network

130s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 f65e263db1a3d62a26df7e00ba1e13c5
SHA1 73be6bea65d493b1720c4dc33b861ba01e4f4bd2
SHA256 1e143c799ea0ce952c6f177f0f2171337fe7bab0c24b86fa6da0b2b5560d0ffa
SHA512 4d11809fba4dc1d9515fb514c19216d930280dfe95e1a2a625cfb33ee82e86a57b60ab1a3b6d34b228d0dc7764a096f036ef0eab555949d609f8db25b2119482

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

155s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

173s

Max time network

200s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 13.107.253.64:443 tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 16.43.107.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-05 12:43

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

177s

Max time network

184s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 213.80.50.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A