Malware Analysis Report

2025-01-22 13:55

Sample ID 240305-pxqm4sfg79
Target Dbug.rar
SHA256 854e1c26121698ba6b70584de483d601fe52d508195765618cb136d1da56141d
Tags
njrat xworm hacked evasion persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

854e1c26121698ba6b70584de483d601fe52d508195765618cb136d1da56141d

Threat Level: Known bad

The file Dbug.rar was found to be: Known bad.

Malicious Activity Summary

njrat xworm hacked evasion persistence rat trojan upx

njRAT/Bladabindi

Detect Xworm Payload

Xworm

Sets file to hidden

Checks computer location settings

Drops startup file

Executes dropped EXE

UPX packed file

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Program crash

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Delays execution with timeout.exe

Enumerates processes with tasklist

Modifies system certificate store

Uses Task Scheduler COM API

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-05 12:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

160s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 77.239.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

127s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 8.192.122.92.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

118s

Max time network

121s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 4cd5607167d11bb79987c552f0fec1ed
SHA1 210f4070a99abad6c16fc47b13427f466cc04e91
SHA256 27a7eb2eafd60755e3ebd5191d5ade606ac7fe3ac36c67c261e16b06388ae273
SHA512 de51f8c947faf12051c0bad1ae2ec401844e02696fd4a8b6d8acf0e2eefc4c27104a859e302e7317e122b4b98040cde9beca45c1c1faa89e2483532746312597

Analysis: behavioral23

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

118s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 01f40f524dea40e99f450d438ef10b13
SHA1 adf69ec154f1df25137b08df128a0ce2c2f62d27
SHA256 169289818de77b95a895491da456f93f348a3641e05b54b3b79deec678faf2ac
SHA512 3c85186228b2b82aa4da30b1f8ba28c322d49c54f0816a7284b8c4ab2973b514deec2bbeef7049a98647fdf9e3bbff88351d333f65150c89e8ecd8d42874587f

Analysis: behavioral28

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

161s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3112,i,1786399861560734457,5606877702857066305,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
GB 172.217.16.234:443 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

117s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 c541fa3fb46c61fa97a4fa580e553a41
SHA1 d836cb7f79d20ee82d016d01e85761706208963d
SHA256 75ff563c4fb1e888e6fd81cfc944220094a5481e9e595ef64a5f1342ecfd8cbd
SHA512 6b957f82f5095bbc0c40bcaf8659e9d16200f30c163ab063e8c6b69e977705926d0a6ed3a2fc8a03a39cb2952197ef04785c55e28188e574ac7878ab0446a839

Analysis: behavioral20

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

162s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
GB 96.17.178.174:80 tcp
US 8.8.8.8:53 udp
GB 96.17.178.174:80 tcp
PL 93.184.221.240:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
GB 96.17.178.174:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 50.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\ProgramData\Cheat.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\ProgramData\XClient.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 740 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 740 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 740 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 740 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 3136 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3136 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3136 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3136 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3444 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Windows\System32\Conhost.exe
PID 3444 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Windows\System32\Conhost.exe
PID 3444 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 3444 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 4388 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 4388 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 4388 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4388 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4388 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4388 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 4388 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 3736 wrote to memory of 4860 N/A C:\ProgramData\Built.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3736 wrote to memory of 4860 N/A C:\ProgramData\Built.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4388 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 4388 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 4388 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 1476 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1476 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1476 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1476 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4860 wrote to memory of 4128 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 4128 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 1924 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 1924 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 4032 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 4032 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 1256 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 4860 wrote to memory of 1256 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 3120 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 3120 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 4032 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4032 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3120 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3120 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1256 wrote to memory of 1168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1256 wrote to memory of 1168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1924 wrote to memory of 3948 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1924 wrote to memory of 3948 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4128 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4128 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4408 wrote to memory of 2188 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 4408 wrote to memory of 2188 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 872 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 872 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 872 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 872 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2252 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2252 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 1836 wrote to memory of 4736 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 1836 wrote to memory of 4736 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 1836 wrote to memory of 4736 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 628 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 628 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 628 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 628 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1836 wrote to memory of 3396 N/A C:\ProgramData\Cheat.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA96F.tmp.bat""

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 blank-jpuf0.in udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:34511 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 127.0.0.1:34511 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp

Files

memory/740-0-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/740-1-0x0000000000FD0000-0x0000000001E5A000-memory.dmp

memory/740-2-0x0000000003FC0000-0x0000000003FD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 5b9df761d41adf1cdba899dc47d41409
SHA1 29cda43ca20253b030f3c4de93b6c36d0076ca84
SHA256 ab96b5c9aae354a05ee803c841b5250420e92e5f5f4054058e8b956878e53656
SHA512 510b6ffb57df41a14ba2fad373a6f3d13efd57365fb29a3752d88ba6aefc3a5b06663c946304b9532816701c560220808c531f7e92ca15380d64cf509dc0a948

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b869e32cdac575ca23d73e7f9f046e6b
SHA1 2bc4ce47bb37e3ffb4faabc1015d2608a8fa96c1
SHA256 4dc95e267ff2a5054ca354035113f16be23c06e374343b6db43b5a084b71b8e3
SHA512 d6913b3460d947043313d65458768d2fb5bb24d38da236ca88a00f61f63829e164681a22c41c3780e25001827a7219eac73b47dc26eed5ad46705c0b079c7e80

memory/3136-22-0x0000000000BB0000-0x0000000000ECE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 bf19964d6a4aa665aed01f772e434ce2
SHA1 666178f9b4cda688fd954654096d0974f6b43e51
SHA256 b20c477447e3dcbf331248bbd71fcb0f17569372ce11380f916621af6fe2b3ac
SHA512 5632a056ebac9fc2e5fb5fac32c20d5e689d1d14ee01e77dcbf2004b69427ebf5d0b828977eb475e00fb69b6260a98a7137a587d75b252e72ffe116976b3c822

memory/3136-23-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 28674efb344f088e8b946bc1cbf1c4b3
SHA1 766c135ca183af322cf4c906df733c1e9b3d9b98
SHA256 5fb658dba94d03c485c42b7aaf9fd40a79e7d44a4229661862829c13ac3ed78e
SHA512 c2238936836639a7574a4346ecbdea05f78414558fb723ea6d1e44c9e6e2d2444c27c29b7df84bbc4dc8c3fa463d2cddb574e5a4d797dd4c337efbd4c0dcfa0c

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 1462fadd51a4a061ab8a89c25b6bc377
SHA1 95185a86768c7ffe9c91f1f3ea901f688ce8f30c
SHA256 3ebe0893dda072de37f83150eb1c45b90ca48b6608397d445bc0b60b467c6ede
SHA512 353f6e1d4770cef3462dc5a75f524c1185d17708af6e17d8c0e7e71b9cd0e49a9f3609f14a959fbd25635d3154327dfab63857d1c20c2e6b7784cb4b9b90c2e2

memory/740-28-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/3444-29-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/3444-30-0x0000000000380000-0x0000000000EE2000-memory.dmp

memory/3136-31-0x000000001BBC0000-0x000000001BBD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/3120-45-0x0000000000600000-0x000000000060E000-memory.dmp

memory/1476-46-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 51e25b14c5c33f9a38b0f3dd1b44123f
SHA1 d7159d880890a1e566b1981ee74f4380372f300c
SHA256 155fb36b07b64df1cdfa485f9aa82d834bb027362a9cd4b5713879aa78262bde
SHA512 bcaf64ef1a86e6968b6cbd053155331babb5c316537ec1788cb7bc6edfc97f36b85defcfad66d96ffcac4dc4d6ec76b74b9a78a52207d05c25933fb90e1d73e0

memory/3136-47-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/3120-48-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/3444-49-0x000000001BBA0000-0x000000001BBB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 4b9f3e1c2b3e1d6c4564f9cb445993a2
SHA1 bcdc7f548fc17856e420300e01cac3b4c2e50231
SHA256 9889f16af4b514dfebbf2f83a8690f4c755ac83d2766748d73eda4aa201cdb46
SHA512 63f50d105de024f273475cab8e3a92de17e43f62b72cd9339c60dd2f9dec81ad6876413535cbe1fe231858cbe205ecc28db49c3b7774c7ffb7182a24734ea3d2

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

memory/4388-74-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/3444-75-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/4388-76-0x00000000003F0000-0x0000000000F5E000-memory.dmp

memory/4560-73-0x0000000000570000-0x0000000000588000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 5abfc190054d0fd01b0f64e753ccd564
SHA1 ff3b26714ff7f317a7afa3108c986913f7eebd20
SHA256 cdb4d6400639422c6cb67069e1da0fd2dd7efda196c17b25ec1abaeae3d0c5d3
SHA512 4b9ebccab773d59aed7d8ee18fb802dce6fe6159ad52ef3a0b3602317e3edaa0be484a009f91b1752ebd0c68e2b3f68f5bee683fe4d05bf2e318bc3ae381480e

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 b28e4f9e9892c9ddb6436872e9f0ddd7
SHA1 4e20c8d6382c12abc2c62e51bdba2922bbfefd10
SHA256 9ef90c2cd67ee660869a94768f170a90857b61568c57595701afc8d77f4c5a4d
SHA512 6476e357b5eaf9fcf8389512fe1dd1eb97d315f4c1d694f99709c6eb39b3a15730edc44b3e87967f74a0d72f1a093a725e94856a24acf5214c50152a113a3176

memory/4560-77-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

C:\ProgramData\Cheat.exe

MD5 e611cfa86998255904ba4d1f47dba0ce
SHA1 08c88e710cd67ccd2b2cb4c1b7ae1f05c9585d7a
SHA256 3198368becdb58d636b0a08ce73679d39548bdd43e998bf751c56fd3a188d1d2
SHA512 aa1583808c62f10bc40be2a4b37db08c54aba711ac67f0eb86852551d7b2cce4a6c8fb5bf7ca31b0c73c56f558227e62dd4969e6bb29ef9e610ace6b18c3d77e

memory/4408-95-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

memory/4408-96-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 5dcfcb53209375431f9ae6f51e241887
SHA1 84a91be3a92e97c5e410109e9296c2829c959eba
SHA256 057b8614f0c73eb1a61cafd5e59dfc07746e1d63f7385c4492761b170e3a2360
SHA512 dcba93f8acdd560f20b4b40807a73699d4ba612e922dbb77a4dba02e5fcad0904297f7e6f83e4ea635c5491e3821ec3a28d6fcc20818949f98e32329d7a8c22d

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

C:\ProgramData\Built.exe

MD5 b51bca6621f3a55fd40ffed7a45774cb
SHA1 3d49941ed3025c250441c806d555387993473655
SHA256 e944120f4f25aad758dab36c5172169ffed40090efdc61b2b9fe514e00ccbd87
SHA512 4fd54470ddaac88ccf70287db17dc669b2c240f8d3919974e4e93f0c16a09e8df3f7c0817a60ce8f737711927fe29039c75bd6bb68224ed8c01a800aab38a50a

C:\ProgramData\Built.exe

MD5 4642a7193e10111aaaddd6c57d0b3e23
SHA1 16b5a31ae0773a37cbd145bb1855997a92b8d714
SHA256 c29641881259c953a2281ab7b721e8911e9f1e5161d4e886fd6f9d89217a9c66
SHA512 fb20ac6910660a7ef811365cd5e8a8c4adc641b1482bacb8cca9885602a708912c13cc09ec2c7062a984eeb25cf4e654609d0ba2e1ef01697f8880dcf1ad67d2

memory/1836-133-0x0000000000C40000-0x0000000000C56000-memory.dmp

memory/1836-134-0x0000000074700000-0x0000000074EB0000-memory.dmp

C:\ProgramData\Built.exe

MD5 599951924a26ba927bea842732615cbe
SHA1 b61c7790835c3ca16157adc120b864216f6f082c
SHA256 766e2a267086584f9eaa233fce9f94f9150eab6bf555f7f004f925152b5bfc03
SHA512 d2966131fac9cbb226eb643392993d7e2a329ef63162df98b5f76e9058620973de814b034de6427c7064192374788359aecec9dd1dde99cfa0d4536e90033f6a

C:\ProgramData\Fluxus V7.exe

MD5 507ee90b7c206a9eb5ee2506cbdf3d9c
SHA1 cb1b0e167e20eca8e673a1ea40280e2071a841cf
SHA256 fef053110e94a17ab70c35a3fe1f080ca43a7764d0222ae1d20396e4068e70da
SHA512 61d960eb29950b80986ee6450d4b3ecaa7eb8a9126e42dc3f218c3a950403d725fdc76e1d6c2768626befa943470fef73cf70cbeadb7a7bc4fe0c425b3c34254

C:\Users\Admin\AppData\Local\Temp\_MEI37362\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/1836-148-0x0000000005650000-0x00000000056EC000-memory.dmp

memory/4860-153-0x00007FF97BB10000-0x00007FF97C0FE000-memory.dmp

C:\ProgramData\Fluxus V7.exe

MD5 b71612ed0779a94fe38427d8d7370fbd
SHA1 1350537254e5f19468e718e0e6f38f92094ed642
SHA256 146316e28cf37eea152c6dddc5445d7e31a7a98eb234871440438a1a1f648588
SHA512 ac910ce494990212ab9b9472b94ff0ece75b581d173c54227b4c6433a987e34129e998bb90430010ce5d342eaca429e62f4268931b51f0dad8e2fd05f71fd6f8

memory/4388-154-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/1836-156-0x0000000005CB0000-0x0000000006254000-memory.dmp

memory/1768-155-0x0000000000030000-0x0000000000424000-memory.dmp

memory/1768-157-0x0000000074700000-0x0000000074EB0000-memory.dmp

C:\ProgramData\Fluxus V7.exe

MD5 751b24081d502de4ed9c08770f5b553d
SHA1 6b4d5e60465c037d753954c1dd97175a235f309d
SHA256 924441fef314999678c5391c9806100ba7c28a90fd0ec9d949f1e7c3478b477c
SHA512 bcfd27e95573f7d993303c640c0a9c21f0f96aac7c5bbc761577c99cc4c3a1bbd8534a2f01ac461ac41ee0e566438e11721cd550f865b234d3c6cd33ca65e29c

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_ctypes.pyd

MD5 ee2d4cd284d6bad4f207195bf5de727f
SHA1 781344a403bbffa0afb080942cd9459d9b05a348
SHA256 2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512 a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

C:\Users\Admin\AppData\Local\Temp\_MEI37362\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_ssl.pyd

MD5 936919f3509b2a913bf9e05723bc7cd2
SHA1 6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256 efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA512 2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_sqlite3.pyd

MD5 c9d6ffa3798bb5ae9f1b082d66901350
SHA1 25724fecf4369447e77283ece810def499318086
SHA256 410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec
SHA512 878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_socket.pyd

MD5 3ea95c5c76ea27ca44b7a55f6cfdcf53
SHA1 aace156795cfb6f418b6a68a254bb4adfc2afc56
SHA256 7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923
SHA512 916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_queue.pyd

MD5 8b3ba5fb207d27eb3632486b936396a3
SHA1 5ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA256 9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA512 18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_lzma.pyd

MD5 5eee7d45b8d89c291965a153d86592ee
SHA1 93562dcdb10bd93433c7275d991681b299f45660
SHA256 7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA512 0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

memory/1476-181-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/1476-182-0x00000000034A0000-0x00000000034B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_lzma.pyd

MD5 3bc5b4fc2d1c7039bbbeaa58d880578c
SHA1 f7bcb159bd77c26c4dacc74c5e724761035e54fe
SHA256 7f0b6a8f620acc8256c6d97bf011cd58cb6b59bda9aa4a47646e3f887102b147
SHA512 020f81746ede445435b2bc4abd76e7b5f8ca25d093e27093dea6104e15ad160907e23844c7faeb3f82fc41b8b1d6dd934e1631dae329bc6bc9f338c012f40203

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_hashlib.pyd

MD5 6d2132108825afd85763fc3b8f612b11
SHA1 af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256 aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512 196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_decimal.pyd

MD5 918e513c376a52a1046c4d4aee87042d
SHA1 d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256 f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512 ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

C:\Users\Admin\AppData\Local\Temp\_MEI37362\_bz2.pyd

MD5 341a6188f375c6702de4f9d0e1de8c08
SHA1 204a508ca6a13eb030ed7953595e9b79b9b9ba3b
SHA256 7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e
SHA512 5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

C:\Users\Admin\AppData\Local\Temp\_MEI37362\unicodedata.pyd

MD5 76d88d7ed232afd1677980f3666f11fa
SHA1 2540b5b865a98df534ee399b579e8c583c9e8d90
SHA256 956b21adfaff605855083671b83eda36a773405bb37eaf6bc2fa279972c430be
SHA512 2c1ac463ef54f87cbfd21399f19975fd43eb1675f0e6a21da7280b86d7b06b4e9d736af4c5c901f66fa248de0c1bc2cffa1e83ecbe87c330b705b6768f40ad43

C:\Users\Admin\AppData\Local\Temp\_MEI37362\sqlite3.dll

MD5 7899a81e47efc9cc4c571d40ff40dc13
SHA1 4a7ec39f645dfd08103482ebddbc467b1664a7ee
SHA256 352eaf1836723ec36875ca6f2bff51f397fb67b64aafd91968b0df67a8b81216
SHA512 a1e4be0a4df1a13245cf6c641b11b4970cc785d729b808dc5a10142db3a08f5127627d3c24dc28992870ff1e4f116918fee3e51a40307fd8a743406fdae73cc2

C:\Users\Admin\AppData\Local\Temp\_MEI37362\sqlite3.dll

MD5 d660602ac8c36d140ce2cd121302be55
SHA1 e0d63270f6f2fc3b56efedb0b7541bd8a784651e
SHA256 87a98893cb03d2c2387efdf3e1ba78807c30277a54ab936d33bd19bb46f70084
SHA512 fb4c1c3c9fe4bc6dedd4d9e8612b0da3866ec2aecb9ce9139624681506f2ca86a121bb9aa73a4402a87b644f9fa5e14d75d68b866aa041b1aad186caa40c519f

memory/1768-193-0x00000000050E0000-0x0000000005172000-memory.dmp

memory/4860-203-0x00007FF97DEA0000-0x00007FF97E016000-memory.dmp

memory/4860-206-0x00007FF97BAB0000-0x00007FF97BAE3000-memory.dmp

memory/4860-205-0x00007FF98EB90000-0x00007FF98EB9D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37362\unicodedata.pyd

MD5 b864d863b56f4656e46b28be40301f91
SHA1 86f6b62fc9c0c454c561beb8ad2373b4946945b3
SHA256 d85df3534c3eaeb2287c23d4341b4a63bf7382e4db0c90506a75168e459f1f52
SHA512 5c9dc8bd8caf4ce9af4455f8180c661d65d58285817a86b773097ccc3d287e75fc23ae62ba60c87350e0a68679ec2392d849fd0c7c945e34bd2c707f26677aac

memory/1768-212-0x0000000009A60000-0x0000000009A68000-memory.dmp

memory/872-213-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/4860-214-0x00007FF97B4B0000-0x00007FF97B9D2000-memory.dmp

memory/4860-216-0x00007FF97E050000-0x00007FF97E07D000-memory.dmp

memory/4860-215-0x00007FF98B5B0000-0x00007FF98B5D4000-memory.dmp

memory/4860-217-0x00007FF97E600000-0x00007FF97E619000-memory.dmp

memory/1768-221-0x0000000005BC0000-0x0000000005BCE000-memory.dmp

memory/4860-222-0x00007FF97BAF0000-0x00007FF97BB09000-memory.dmp

memory/1768-219-0x0000000005BF0000-0x0000000005C28000-memory.dmp

memory/4860-225-0x00007FF98E6C0000-0x00007FF98E6CD000-memory.dmp

memory/1768-227-0x000000000AEE0000-0x000000000B508000-memory.dmp

memory/3120-229-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/4560-230-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

memory/1768-231-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

memory/1768-228-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

memory/4860-226-0x00007FF97B370000-0x00007FF97B48C000-memory.dmp

memory/4860-224-0x00007FF97B490000-0x00007FF97B4A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e1qniuwa.55b.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1768-242-0x000000000AE50000-0x000000000AE6A000-memory.dmp

memory/1768-243-0x000000000B510000-0x000000000B546000-memory.dmp

memory/872-244-0x000000001BFC0000-0x000000001BFD0000-memory.dmp

memory/4320-245-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/2252-223-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/3120-220-0x0000000000F50000-0x0000000000F60000-memory.dmp

memory/4860-218-0x00007FF97E020000-0x00007FF97E043000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 0bddc5462d9e5cf9ceb8d2b1adb2fdc0
SHA1 fb2b8205ae5b43e651fb7404d70f6cd162c8e607
SHA256 3ceeeed7f391aa1e627f937e8483ebf71c5a977353c276ce80279bee939eebff
SHA512 7524cfc0098404670219942f5be953b492838ca3f8519d6a8fd37f35a1656f413430dec9559e8186efef6efce763b53f2be12aac4756a938c320088e3cefd8e1

memory/4860-286-0x00007FF97BB10000-0x00007FF97C0FE000-memory.dmp

memory/4860-289-0x00007FF98F2A0000-0x00007FF98F2AF000-memory.dmp

memory/4860-288-0x00007FF98B5B0000-0x00007FF98B5D4000-memory.dmp

memory/1476-207-0x00007FF97FFB0000-0x00007FF980A71000-memory.dmp

memory/4860-208-0x00007FF97B9E0000-0x00007FF97BAAD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 c453dab7702f21ea1c43a8a2c3995d5d
SHA1 73275f534a17798f4ffb02f52715057fffc27d10
SHA256 fba0aafbee84b5910cf21931ac4e2f6eb836ad079094fe148776cb683af2c511
SHA512 38cb4e5577ea59d5ac25d40a90f43680d5798182f2dc127188848e0e7631cc1d3c1f6d25473f1410482cfc5b6f631550fd2c0c1963619c63ec63d3e486e36463

C:\Users\Admin\AppData\Local\Temp\_MEI37362\select.pyd

MD5 2398a631bae547d1d33e91335e6d210b
SHA1 f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256 487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA512 6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

C:\Users\Admin\AppData\Local\Temp\_MEI37362\libcrypto-3.dll

MD5 c64991c19f837ce510e6413309e8cd32
SHA1 36774efd15cc9327289142679ae0282f48de8452
SHA256 9ba4b9c855d258abffc691e9f3e5b31bbbbac7915381f24b7dcc92a11a72fe14
SHA512 bc4b00e24afbc72d4c8745d9a0598796c280fac161848c0024dec23596713411d74ee19293cb692efd1119b9e7b3af2cf45d59e9aaf7dfb4f28625f6878a6a75

C:\Users\Admin\AppData\Local\Temp\_MEI37362\libcrypto-3.dll

MD5 a9b7faa26b0330930d2c1d9d7ded335f
SHA1 8e9ef0086e3f7f57ccd74aa68a2ac7f59e031f86
SHA256 946e84c45aec0bf187950715ae45e520e6262042662c35178546526d03d55d1f
SHA512 24bef7b419f8179d26c822b8376f2284a1df5ec6734112cc2eff36bdeb6f7f11f1c3c3c67be215937a4568a5b8b9168fdcd64e1be8489757e05080988f4fb21a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BanderaRAT.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

C:\Users\Admin\AppData\Local\Temp\_MEI37362\libssl-3.dll

MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

memory/1836-194-0x00000000057E0000-0x00000000057F0000-memory.dmp

memory/1768-192-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

memory/4860-189-0x00007FF98F2A0000-0x00007FF98F2AF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI37362\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI37362\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI37362\libcrypto-3.dll

MD5 13f91f3d2227798f32a6365714915625
SHA1 d09ca8ae4b2410a17ea97223c962c638d0f1e7ee
SHA256 5bdd0fd7cb0d6c11f3872591fc3a71e0aa602877b5599474f5ff04ba5a46108b
SHA512 9e7f8796549e37d048c07cbaf041f8f82fcdbe412c54dab8fbeed0a31579f8ec950503c834bc8f567c6b5b1e3dec825fa5303e2a8d76f8e76566c4936e79a006

C:\Users\Admin\AppData\Local\Temp\_MEI37362\blank.aes

MD5 291948ee8e8927f3a74e829695ff9b43
SHA1 2d28ac4941f4095b8ac4340e4b626af45da15625
SHA256 035ba985560ab044aa1c4c413dc1b5706031a6143cd38606e57b5da145aaac6a
SHA512 924ec1ba39ef26332855871222945b5d5197a7782387175e764558ec410f1f0dab9f8479575e582479e645c3af23d9264141b61846458489e335d308d6024906

C:\Users\Admin\AppData\Local\Temp\_MEI37362\base_library.zip

MD5 9d84222015f5e2d8afb5ec74d6808ad0
SHA1 38f7c2439e7829cbd2837be1f8b0380ce5c8e444
SHA256 20adf37360e803029eb7f0a99ec882f277765193f6d4bed683a391c06959581f
SHA512 5939f286d47d8ad459521042781d666ff4f99a7b1e4c5747f32f4b3604abca9171fa777ea6453f2e169a4c62931d960b231894fa8faaae0e531c0f232a30e906

C:\Users\Admin\AppData\Local\Temp\_MEI37362\python311.dll

MD5 76eb1ad615ba6600ce747bf1acde6679
SHA1 d3e1318077217372653be3947635b93df68156a4
SHA256 30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA512 2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

C:\ProgramData\Built.exe

MD5 a827097101051917dc24aa83d7b81e3d
SHA1 c3df29210d09652c07991d8c7881d9d6eaac1b66
SHA256 fa6bbb76f85c19408e746af6150d0053991cc0d449729be2bc9e207265fa0663
SHA512 7fa960c4bc9c785271ec1b3fcc79a23da5a4a6e594c50d9787f9e19b9df6889445e80c6a267c366785ad05463f4504a0f28858c71205b6364601d0824bc0056a

Analysis: behavioral10

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 199.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

145s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240220-en

Max time kernel

121s

Max time network

122s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DET.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 0c48aad28f15f3b67cd1352d042d2ede
SHA1 246d27fd48eecd3fd874302c23ec4eb0c5eb2b74
SHA256 8251824dd725d3f4274347e9e7bc7488fa54809f0f2ce6a8d6f029596a1280f8
SHA512 c31b66ee6ba0e7350e44c173ce7b58ac81ef5426d502238c2f903ff16a2eccf6e0adf183aea18e0f96a62ce553a1aaeafde96b8871b0341dd9102a0e606d0b37

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

91s

Max time network

157s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\ProgramData\Cheat.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\ProgramData\XClient.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 C:\ProgramData\Fluxus V7.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f C:\ProgramData\Fluxus V7.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f C:\ProgramData\Fluxus V7.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1908 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 1908 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2176 wrote to memory of 2232 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe
PID 2176 wrote to memory of 2232 N/A C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe
PID 2232 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2232 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2232 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2232 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 3544 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3544 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 3544 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 3544 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1144 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1144 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 1144 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 1144 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 456 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 456 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 456 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 456 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 456 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 456 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 456 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 448 wrote to memory of 5032 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 448 wrote to memory of 5032 N/A C:\ProgramData\Built.exe C:\ProgramData\Built.exe
PID 456 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 456 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 456 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 4844 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4844 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4844 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4844 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4436 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4436 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2144 wrote to memory of 2228 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2144 wrote to memory of 2228 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2724 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2724 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 5032 wrote to memory of 5008 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 5008 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 2724 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2724 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 5032 wrote to memory of 548 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 548 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 3288 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 3288 N/A C:\ProgramData\Built.exe C:\Windows\system32\cmd.exe
PID 1488 wrote to memory of 3716 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 1488 wrote to memory of 3716 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 1488 wrote to memory of 3716 N/A C:\ProgramData\Cheat.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe
PID 1488 wrote to memory of 4668 N/A C:\ProgramData\Cheat.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 4668 N/A C:\ProgramData\Cheat.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 4668 N/A C:\ProgramData\Cheat.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3288 wrote to memory of 3752 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 548 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 548 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5008 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5008 wrote to memory of 2116 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4864 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4864 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 4864 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4864 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 4668 wrote to memory of 5324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 4668 wrote to memory of 5324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dbug.rar"

C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Built.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1311.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 1.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 blank-mfcfc.in udp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp

Files

C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe

MD5 98ad67941c6edffc9a55921fe2455c05
SHA1 6e202b797857ede29fbe20fb89e4111d7d68e8d8
SHA256 bac9581c8b53b00e95a55e5e245a60076d625ad9b03b362145c72eac6ae0eb2e
SHA512 12d7b6cbd18f0825681150edb23165c8d69afe92991c91473e92db22cfd81dc1856b5cd402fa154f3b5dd80f1590a3ffc636d2509a1ac115b56d2225a6daec1c

C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe

MD5 23f3bd62af7af21076df5c86927429b2
SHA1 8aa784291425e66b8de725f9ba619cf8fba3ca2c
SHA256 0cad3e5a44a9452728ad6c4647b970b7348a2e6600b6ab230477502af96ad9cb
SHA512 2d5f387a57f4c6281a6cc706e3518ab4e752c7d333d2730bfb93fe265215c239960a0c49a745a7ef8e5237ea194834afe98a06cee8617e538d5d0834da574ca1

C:\Users\Admin\AppData\Local\Temp\7zO0884D508\BandeeraRAT By Donbas.exe

MD5 641e3b13ff8c09dc4d15f62a56d42771
SHA1 952c9d3a29927bcf853ed81568512fdda122e697
SHA256 39aa3561f4647e581dffacbfa982470879b88f3d45b477607e4652386e51ecfd
SHA512 881bb7363c76573cf4ee76eb9137fa3a733f27de07ae216dc1c491addf30b91d461bed4d9bff514176cddd1a539c830709f1126eb326c28061dd7562bfe6f971

memory/2232-13-0x0000000000080000-0x0000000000F0A000-memory.dmp

memory/2232-12-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/2232-14-0x000000001BAB0000-0x000000001BAC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 ce249646b93c339c2c2bbaf903d428a6
SHA1 fdb26fe0bc613e55a00329ee48e747093af6934f
SHA256 250115893c5e5e956d045cbee9cdda49e8befe847789f3bdf1f993b689dd7f6e
SHA512 96f9c73cc871753ea88214e1067bb4be86f1e045080e5cfbb4623910a2d138d98028cf8a0b64cadaf09a599909e928d6e47e7a8818b65fe7a71f397e6ce04f6a

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 c487d0dc58be33111b04df7bc3fc27bf
SHA1 9b6486fb29a19bc52ebd7482ba096f311a92f068
SHA256 4897761169f5cb560b92a319f8869ef48129c2eb7209580d37ad0280fd5e698e
SHA512 f247bf5c6b71d7fd8994f7b5a05b7115c720e3f4243c8c9e9e1058eb7c9611755fa649d86fe2c25443a66f211b93768e42c2279f238699f1c7ad8e8575295218

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 9ac028c9a0b86d04aa8cc2c7d3721645
SHA1 02599f3aef7ddb76532eebce9be2fcc72bfd7483
SHA256 f202366d4daac9c25b6e97719eb59a31c1150fcc197076658760233172a6fa81
SHA512 91cb370b76cc3cac0235c410f0f0aadd31e0211fbf3f69407c591e3be99caec878c52abfa19f96d8637fdcfc25a9d891755999368a9da60833d3fd1e7a68f8f5

memory/3544-27-0x00000000009D0000-0x0000000000CEE000-memory.dmp

memory/3544-26-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 54a1d155708ef3c8ee8e1a81f51b82c1
SHA1 02d862d8f6784b46c67f24f28dc4da38d11dd9e1
SHA256 aef460af3b9533640d14ceb91f6dce10f9cbc3cf8191285ac0318d6ca2399d54
SHA512 c9bf2ff15c4884d5b3dce653604ec103174140f446856776becd66ab5c592c1c664a51abae8267a40dace5286224bdb5bb276f59a5f5429bb819f99e8fa855ba

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 a6d58f4049c5e7efa4a01a7162e01568
SHA1 1e6cd87dd7b22da876175095727308aa4b857d22
SHA256 1022f5685a4a0a1aed3ae7d410f1b0fcc4d6eb62ca6c4d129dda4baac699892f
SHA512 1b1027554fadf34406b4f79c177020af3e74bde2abb7b9b87830fc4d92f8a4aee3fef109fc46923cd8926b729370a7e5da5d4f93b80d60d04604960c690fa6fc

memory/1144-40-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 534776882ccc354e66771a1b7e825023
SHA1 429655f003dbc586d19e9d8c89a5046c350f0565
SHA256 e9cdc1c289bb82ee9646c20554706019b6dc7278e0fa23ffc2312edc6b70feba
SHA512 677416129155b5f180c210345cc1ac2466c4970bd97aa851057969a3aeb361d767fe35e00ba24bf140967fc123aefa6bb1f4fe325ff2407a5e1c5c6e60fab400

memory/2232-42-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/1144-41-0x00000000002D0000-0x0000000000E32000-memory.dmp

memory/3544-43-0x000000001BB00000-0x000000001BB10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 400de63ab3ff4119f9d3423af3c30290
SHA1 deb5ae7bbe94c43698505afa1634cf0440522835
SHA256 8a71234acfa717d1ce17343151d2e04da7e79d1b748ea4fb4a6b106ecfe9a3ec
SHA512 04470c4718c770fce54712b77d412343449b062cdba5790b0cdda7a8e2fd29f0b69cca3aa012610af34a68251bdce7d5eb655bc33787d7111c402a80fcecc32b

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/4708-57-0x00000000006B0000-0x00000000006BE000-memory.dmp

memory/3544-59-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/4844-58-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/4708-60-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/1144-61-0x00000000015E0000-0x00000000015F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 e40e1dfa2c69660389f9aabb08af7097
SHA1 e905835c067f0bd62313cd6b52772ce34c763f5a
SHA256 e0d4cef7e8a650c2589d7ca0ba5f7a59ae05f2b50108fed73840236b683f57b8
SHA512 465725a695007640fc0063b738fefc3a704e2e8786494021912dd764a85d7618bc7850a6d1d22a84ef8c6bc9df3679fc2cd934cc66b6ee1af7b1683759f92b02

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 6b5ea35359934ed512e9b7548f237609
SHA1 b1e321a7ef81df5003e2ea140280a932ca8dfd19
SHA256 887214e92b76c2f8ab1260229b453283a8999038c028e812f6cbd15da389869f
SHA512 2331d29d06c4e9013fce288277d23e5c20019f6ba4c63de13088b395389474f620ce7b1e0dd3a6655977248280062e670558b215d5bc2aa2532221354e19f078

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 a53483b3c55cd55e016504ccc9dac4c4
SHA1 ed469095e0681267b144ea58ce891807ed73991b
SHA256 860ff27ca1080e523d7b0275d48f6eecfad89c9c112a894f690da0ac3879cdb4
SHA512 ed953549fb8eb82af825256f7ecd5362aa5ea5e4558f2466fcec79e29ceaa2ce51aeb07853124e907a4d8294a6e058c997c4aba570e6e443f877a56b5cc12b35

memory/4436-85-0x0000000000C20000-0x0000000000C38000-memory.dmp

memory/1144-87-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/4436-86-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/456-88-0x0000000000750000-0x00000000012BE000-memory.dmp

memory/456-89-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/2144-106-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/2144-108-0x0000000000420000-0x0000000000430000-memory.dmp

memory/4844-110-0x000000001B270000-0x000000001B280000-memory.dmp

C:\ProgramData\Cheat.exe

MD5 18260ff3273d5361f429424d71f9c97b
SHA1 2f47380f30fef9c7f36e87bc03736d830fd2a93e
SHA256 4139eaa841b0653eea346257d5563e7c238326a1bd66c2001791ba6a87869b4f
SHA512 d514388c684e177d8cadfa1888adcd2d1db1aa9dc41e0cbd24edac5ecb491d28d7b2c8e1f74b1124421bf3d5d8446fe976f6f0ee642a607802561efa43c5c900

C:\ProgramData\Built.exe

MD5 2cbe03841cccbc5600582694d7a60985
SHA1 08551bb2ec30b43b065654cc21306b76356d3365
SHA256 2a343ab6ef64c5ad0d070a1d190045a716d12d0d39c1264fc03d6fd8a26bed4b
SHA512 fa23de51d582b387d3094debf083f2cd85f0e6df6ce0bd34f68345c410b7c4d68e6594852a84c94b01226be99f72d0bef144caaf4fcff3fca3eae91faa316d15

C:\ProgramData\Built.exe

MD5 5dfa980028349ef583fb11d0a0fb1168
SHA1 242032d5441483670b2da5fdf65e24f6f6b3c67a
SHA256 8a59b6e31bd532c864110be1ddbd9da352006ce3022488f4dc2b9853d36e403d
SHA512 c8a7dde7ff3694db1e0a94a2c27e194ec8232743cfe0b9a06095b66770c69da19d3c3775e36bec77f7a3a8b65b952f460ebd24f3b9e2f3b3e9872500e72a5063

C:\ProgramData\Built.exe

MD5 6996c4e6b05ee697757941ba881c6d03
SHA1 35be46572cbde02f70e9855cade0683a6624ecff
SHA256 70ca983a045a8b2bb306fde2bea91831731938c201e32543f1988060a35a68ea
SHA512 3d6046f444bc954f5ff86e746485c116db136c9ae36e2b296bd7bbb4f17efb37dea2e9249bd0713be1420294f2f41013dc8721bbbd1d0cd3ca7967d244d99cd6

C:\ProgramData\Built.exe

MD5 55223eecdba3c0929ab2dd86249941a2
SHA1 8ade61c795e830d51f2328d54e3d3498dee21941
SHA256 e6e473f219dfb5665e2eec9527eff3e2fcb2fb201acf7d68da0701459868d5fe
SHA512 5320ba09f30f2ec4183b9cc188981bc2340bccbaeeac27672456d759dd4e3410415ddd190a41b7ed16f8b86cb1ccdadcffda4d3e9ddb067d99137bd30a4f6868

C:\Users\Admin\AppData\Local\Temp\_MEI4482\python311.dll

MD5 77d14fe6939d0aee0bb89d1a12db851a
SHA1 082757ce42f6ce4ab01c7cb161ecf0e5d00d319c
SHA256 5dcc0e1ddfebe8a2b952da23ec56179fa93c67ad6d368da5b5e9304fcfa67d3a
SHA512 9c03de015cdeefa4a78184157dae0bfc16266580b51646c2abd00b76ac4ba216d123240b210bf9dd8e564867521aac18b9e34ec7c217dbf2b02f2ca25af6f472

C:\ProgramData\Fluxus V7.exe

MD5 edc5e529bca307f9b85bd89dd4bd5fa1
SHA1 1772289ccfd6fc91e5851fb6f72dd0b8a944650e
SHA256 053bba073dcc9a7bd67c6a9bdd9708146ff8ac6fee3249c3eaa0ff36dbc58f37
SHA512 92e41b20473702c7834d6bc7df1521ba1499acc03c3a962623698d10086ebc9f05776d06ce99a501f79c977021a9c6b72776e98a8eba51ed9f59e5e7803bfeff

C:\Users\Admin\AppData\Local\Temp\_MEI4482\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/4708-164-0x000000001C2B0000-0x000000001C2C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BanderaRAT.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/1488-170-0x00000000053F0000-0x000000000548C000-memory.dmp

memory/4844-172-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/1488-173-0x0000000005A40000-0x0000000005FE4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_ssl.pyd

MD5 936919f3509b2a913bf9e05723bc7cd2
SHA1 6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256 efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA512 2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

memory/2724-196-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_sqlite3.pyd

MD5 c9d6ffa3798bb5ae9f1b082d66901350
SHA1 25724fecf4369447e77283ece810def499318086
SHA256 410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec
SHA512 878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

memory/4784-199-0x0000000074710000-0x0000000074EC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_socket.pyd

MD5 3ea95c5c76ea27ca44b7a55f6cfdcf53
SHA1 aace156795cfb6f418b6a68a254bb4adfc2afc56
SHA256 7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923
SHA512 916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_queue.pyd

MD5 8b3ba5fb207d27eb3632486b936396a3
SHA1 5ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA256 9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA512 18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_lzma.pyd

MD5 5eee7d45b8d89c291965a153d86592ee
SHA1 93562dcdb10bd93433c7275d991681b299f45660
SHA256 7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA512 0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

memory/1460-200-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/5032-202-0x00007FFA98A40000-0x00007FFA98A4F000-memory.dmp

memory/5032-201-0x00007FFA98090000-0x00007FFA980B4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_hashlib.pyd

MD5 6d2132108825afd85763fc3b8f612b11
SHA1 af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256 aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512 196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

memory/1488-205-0x0000000005370000-0x0000000005380000-memory.dmp

memory/4436-206-0x0000000002E00000-0x0000000002E10000-memory.dmp

memory/4784-204-0x0000000004D80000-0x0000000004D90000-memory.dmp

memory/4708-203-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_decimal.pyd

MD5 918e513c376a52a1046c4d4aee87042d
SHA1 d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256 f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512 ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_bz2.pyd

MD5 341a6188f375c6702de4f9d0e1de8c08
SHA1 204a508ca6a13eb030ed7953595e9b79b9b9ba3b
SHA256 7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e
SHA512 5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

C:\Users\Admin\AppData\Local\Temp\_MEI4482\unicodedata.pyd

MD5 6279c26d085d1b2efd53e9c3e74d0285
SHA1 bd0d274fb9502406b6b9a5756760b78919fa2518
SHA256 411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6
SHA512 30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

memory/4784-207-0x00000000051F0000-0x0000000005282000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\sqlite3.dll

MD5 cc9d1869f9305b5a695fc5e76bd57b72
SHA1 c6a28791035e7e10cfae0ab51e9a5a8328ea55c1
SHA256 31cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee
SHA512 e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1

C:\Users\Admin\AppData\Local\Temp\_MEI4482\select.pyd

MD5 2398a631bae547d1d33e91335e6d210b
SHA1 f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256 487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA512 6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

C:\Users\Admin\AppData\Local\Temp\_MEI4482\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI4482\rar.exe

MD5 8c9fa53f3099819a25adf128faf7af2f
SHA1 81a62921b619074c58f05430af8b78226910d531
SHA256 a0b8e933e95e3ba0f7cee27360a267865e3e4894dcd5296c3307bba40bec91f7
SHA512 026e688d31c4923cf1d2718c81a7de10c1e12707cac3e560c99437f205e6863d997551c0bb7fe2b33b23c15b36888fb100af8241288c5c7876fffb44085f6e61

C:\Users\Admin\AppData\Local\Temp\_MEI4482\libssl-3.dll

MD5 6eda5a055b164e5e798429dcd94f5b88
SHA1 2c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256 377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA512 74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

C:\Users\Admin\AppData\Local\Temp\_MEI4482\libcrypto-3.dll

MD5 51552c73266c8d6034894276317b6109
SHA1 1fc334c0a75c3e47f3e1ba616e06777587f68ef2
SHA256 98b6552abe45cc3aa2352cfdfbc897d6bc542295e3034225b26a245dfb02859c
SHA512 0ed6ade58ffbf0ccb3af3412b04b5c0563da3b47bd2a41cfb83371ba9f96833b9ba6c5e35c7e131fa5941654774827ba0f179d98cafdc51f431315536a35df46

memory/4784-208-0x0000000009A30000-0x0000000009A38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\blank.aes

MD5 291948ee8e8927f3a74e829695ff9b43
SHA1 2d28ac4941f4095b8ac4340e4b626af45da15625
SHA256 035ba985560ab044aa1c4c413dc1b5706031a6143cd38606e57b5da145aaac6a
SHA512 924ec1ba39ef26332855871222945b5d5197a7782387175e764558ec410f1f0dab9f8479575e582479e645c3af23d9264141b61846458489e335d308d6024906

C:\Users\Admin\AppData\Local\Temp\_MEI4482\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/4784-210-0x0000000009A80000-0x0000000009A8E000-memory.dmp

memory/4784-209-0x0000000009AC0000-0x0000000009AF8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\_ctypes.pyd

MD5 ee2d4cd284d6bad4f207195bf5de727f
SHA1 781344a403bbffa0afb080942cd9459d9b05a348
SHA256 2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512 a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

memory/4784-176-0x0000000000120000-0x0000000000514000-memory.dmp

memory/4784-211-0x000000000B1B0000-0x000000000B7D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\base_library.zip

MD5 3059a636378b3ba35b631808cbffdfc6
SHA1 e449dcb15a2661027145eee787c1b87d4b6eab24
SHA256 0233486c14ec57062f579aab2b79fb63d70c2feabe353f4189bfe351d2dd53e4
SHA512 308547c58434ef18be19c1170601b07d319f49a668438c98c0e64e852ec8d0556686584ea2b011648dea7686cbe77932507387810893dd648bbfcd5653a01e07

memory/456-171-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/1488-168-0x0000000000B20000-0x0000000000B36000-memory.dmp

C:\ProgramData\Fluxus V7.exe

MD5 95e3ebf960004b5e5c80e8810d443a1e
SHA1 499796121ce5068edd27fcf383528332ac7dddaf
SHA256 1946084513382e53527c68701b8251dddccf9506e1b2a337a73f0e64fc77f9f6
SHA512 be11ebfa15008ccfeed49157d35129d6d35028ee0bc4a51df05db0b1a96af0aef6b1bfd0e15942a7002f9d2bbc52aa31c2a0f11bb059c4b4cca8d62625ac295b

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 e59a398c8ac497dc5bdc41614e9a4279
SHA1 ae4445b9e5c56865c6250da1aa49c5e96b756d24
SHA256 ddefad659debe6982dd53aa3088db264eba823c5894bccbc8bad21b931a4b31b
SHA512 760f39d6d5afef4741f43eb7ddac8be60138e33d853b6ae6194e47f61b03b21121e3e1b8e528b9076f65b59350b0358467aa0d68b95f9154a11e3ac74ca51ba5

C:\ProgramData\Fluxus V7.exe

MD5 042489f03193c5eddaa233129ea779e9
SHA1 73de2e3975e7b015d5d3133edac4574f13998071
SHA256 f05490148e2602111c4917a7855a7effb19c3024ce1fd5c50fcf53a4249b630c
SHA512 76683b80a6a525c9f239f47503c73b8138a7ad3dff9a23676170c8986f673fd10c3802198568d141312f8f54694be603bc9e7800bc59c957f0e1f1c62aa97014

memory/5032-162-0x00007FFA83330000-0x00007FFA8391E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\python311.dll

MD5 7b9a522676db51fcd23ddcf8aa5fbcd9
SHA1 53b65ed47a0b5aedd13a9fcf73b121c1528c1d04
SHA256 3b5d7735effec0f32b3657d94bf8055703daeed5dcec8556a55c179e84231d06
SHA512 ee0266a7098c1e10955a17cc6e37b6992529aacc8632065d8d5f7ed40cd86d49c23f5d74906b22593325f71b4f248061cb32d66e47e5b6f0718194ecc4eefd9b

memory/1488-156-0x0000000074710000-0x0000000074EC0000-memory.dmp

memory/4784-221-0x0000000004D80000-0x0000000004D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\sqlite3.dll

MD5 551f441e1b1e8067c73c1c0cc8288497
SHA1 645e10a9bc6a8217c3995adbd359dca784775586
SHA256 dcae60cefeb7394ec629027bc0f641f004617b6458defa37a3279ef91319a7e0
SHA512 988388b5056b8bfd80af4dfea832b091fac2668bf16910dd36a76424ad955f807b8e1671d7983a591fbc6ddd59e351ffe3b58fce8202a9ff694e49617e9d556a

C:\Users\Admin\AppData\Local\Temp\_MEI4482\libssl-3.dll

MD5 63aa25fd685bc35b50ef242cc892e061
SHA1 3e9d77f595a168d9ee44e5a3a88b9ce7600ff7ee
SHA256 862dd9f85e113d34a5e3f83d1a443d97de05e9305f156145eea643562a7f73dd
SHA512 0a02f4b2154c066102f5eed19416560d1e7adc2933cb9ce643ba00814939c3d87c592dede65b41bda4785cfecb089f8f81e1a144664dc3dda8a46a6f269e4ec0

C:\Users\Admin\AppData\Local\Temp\_MEI4482\libcrypto-3.dll

MD5 81fae25054fa4ceb55be01f8d658f9cc
SHA1 946cf2e9d004c8a9125322a33fd4a79677f1f840
SHA256 a349835e36fa666eab5be444efc316a002960f28ba14318de43989c2b03e5d05
SHA512 0fc8df86120ca8ffa8900b0dc46f04641e6bd82d58f0a6d13350cdd9c464c8e728d5196d52237e16ba280e34c272c63d76a96cdc7e6c24fed33b7f95f2159803

memory/5032-231-0x00007FFA8F280000-0x00007FFA8F299000-memory.dmp

memory/5032-235-0x00007FFA98470000-0x00007FFA9847D000-memory.dmp

memory/5032-236-0x00007FFA87E30000-0x00007FFA87E63000-memory.dmp

memory/5032-245-0x0000029B67270000-0x0000029B67792000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yjmeypwk.nfo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4784-255-0x0000000005F80000-0x0000000005F9A000-memory.dmp

memory/4784-258-0x000000000AE80000-0x000000000AEB6000-memory.dmp

memory/2724-259-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/5032-260-0x00007FFA878D0000-0x00007FFA878E4000-memory.dmp

memory/4864-257-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/5032-243-0x00007FFA87E70000-0x00007FFA87E89000-memory.dmp

memory/5032-241-0x00007FFA87E90000-0x00007FFA88006000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b066abc8cdf2b5f9e84657480cfd28d1
SHA1 f3a341227724470850e61c659b3f79ddcc76d28d
SHA256 1f761410ad57c51f6ab02b69455dc13a81518d8f0ca16a13445c349d18891ba8
SHA512 db03754c3a9994895e4a121cf9882a64a642441d1bd41a81291ad1b88fa42431bdf04697324d6abd2dc651e4ab20115ab99a9ec574c53480a10cb9dc6c3607b1

memory/5032-238-0x00007FFA7FD70000-0x00007FFA80292000-memory.dmp

memory/5032-237-0x00007FFA829B0000-0x00007FFA82A7D000-memory.dmp

memory/5032-233-0x00007FFA88010000-0x00007FFA88033000-memory.dmp

memory/1460-232-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4482\libcrypto-3.dll

MD5 1ba2bc3a626c81a96e60ec453c82d692
SHA1 5432179bf8244014269b07370b31cbdfe3e2cdd2
SHA256 65def90be76a8b01524e67e5d6f45ede6c29a7ca31a077ecac6eb27d79c4ac63
SHA512 478dfedd0b76b128761123808049ac600d4afca93d9047c3a53627bf3e08839dd1f91f97932bb10fbdef9b86a41e7b22e5bda97bd212d532cf38d485637df077

memory/5032-229-0x00007FFA89020000-0x00007FFA8904D000-memory.dmp

memory/4784-223-0x0000000004D80000-0x0000000004D90000-memory.dmp

memory/5032-279-0x00007FFA83330000-0x00007FFA8391E000-memory.dmp

memory/5032-281-0x00007FFA98090000-0x00007FFA980B4000-memory.dmp

memory/4436-213-0x00007FFA86C30000-0x00007FFA876F1000-memory.dmp

memory/5032-304-0x00007FFA829B0000-0x00007FFA82A7D000-memory.dmp

memory/5032-302-0x00007FFA87E30000-0x00007FFA87E63000-memory.dmp

memory/5032-305-0x00007FFA7FD70000-0x00007FFA80292000-memory.dmp

memory/436-370-0x0000017FF9EA0000-0x0000017FF9FEE000-memory.dmp

memory/2732-376-0x000001B3BDBC0000-0x000001B3BDD0E000-memory.dmp

memory/2116-375-0x0000025F1E720000-0x0000025F1E86E000-memory.dmp

memory/5780-408-0x0000026C39350000-0x0000026C3949E000-memory.dmp

memory/5032-412-0x00007FFA98A40000-0x00007FFA98A4F000-memory.dmp

memory/5032-415-0x00007FFA88010000-0x00007FFA88033000-memory.dmp

memory/5032-419-0x00007FFA87E30000-0x00007FFA87E63000-memory.dmp

memory/5032-417-0x00007FFA87E70000-0x00007FFA87E89000-memory.dmp

memory/5032-420-0x00007FFA829B0000-0x00007FFA82A7D000-memory.dmp

memory/5032-421-0x00007FFA7FD70000-0x00007FFA80292000-memory.dmp

memory/5032-418-0x00007FFA98470000-0x00007FFA9847D000-memory.dmp

memory/5032-423-0x00007FFA98440000-0x00007FFA9844D000-memory.dmp

memory/5032-426-0x00007FFA80E90000-0x00007FFA80FAC000-memory.dmp

memory/5032-422-0x00007FFA878D0000-0x00007FFA878E4000-memory.dmp

memory/5032-416-0x00007FFA87E90000-0x00007FFA88006000-memory.dmp

memory/5032-414-0x00007FFA8F280000-0x00007FFA8F299000-memory.dmp

memory/5032-413-0x00007FFA89020000-0x00007FFA8904D000-memory.dmp

memory/5032-411-0x00007FFA98090000-0x00007FFA980B4000-memory.dmp

memory/5032-409-0x00007FFA83330000-0x00007FFA8391E000-memory.dmp

memory/5828-450-0x000002673F870000-0x000002673F9BE000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

155s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 64.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240215-en

Max time kernel

121s

Max time network

122s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 e4005b6bf0a7a0b85714a35e2bb18237
SHA1 a352334b49213d33bcb468e6aa26644774f8afe8
SHA256 b06413f2703b941f4067c3b65334d7c5086a2c4166143b46586ad666733615ad
SHA512 015cd218853d7518674779a7323d83317aafd210388e72d0fad11dacf7fdc9d7be75ec1f56a48bcea2de57afb28c846842331590bf288712be9d67d07614288e

Analysis: behavioral25

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:49

Platform

win7-20240221-en

Max time kernel

260s

Max time network

175s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 a75691174cce2ddc657e0653389177d3
SHA1 06fb74379396918db29825cdaa7b2debfaa932a8
SHA256 ccc02cb89adb6a031dbb3df5a16f5f8184f93e4e991c036f4e1e01478d8e4c6b
SHA512 901468cccd550d9953bb3d3af333b2fec2bcc237eac2f2604454a33546ae41f36ec39bb1aa6974a82cfbdee9a26b2a9d13dad71b56a23423971b8bf997382059

Analysis: behavioral3

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

59s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

njRAT/Bladabindi

trojan njrat

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.url C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\XClient.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Fluxus V7.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\svchоst.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\svchost\$77svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\ProgramData\Built.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchоst = "C:\\ProgramData\\svchоst.exe" C:\ProgramData\XClient.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\Fluxus V7.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A
N/A N/A C:\ProgramData\Cheat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Cheat.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Fluxus V7.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\svchоst.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Windows.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sisk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1664 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1664 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1664 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1664 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1664 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 1664 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe
PID 2884 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2884 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2884 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2884 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2884 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2884 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2564 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2564 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2564 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe
PID 2564 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2564 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2564 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe C:\Users\Admin\AppData\Local\Temp\sisk.exe
PID 2876 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2876 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2876 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 2876 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2876 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2876 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2380 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2380 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2380 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\XClient.exe
PID 2380 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2380 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2380 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2380 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Cheat.exe
PID 2380 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2380 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2380 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Built.exe
PID 2380 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2380 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2380 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2380 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe C:\ProgramData\Fluxus V7.exe
PID 2040 wrote to memory of 1644 N/A C:\ProgramData\Built.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2040 wrote to memory of 1644 N/A C:\ProgramData\Built.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2040 wrote to memory of 1644 N/A C:\ProgramData\Built.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1108 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1108 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1108 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1108 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1108 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1108 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 2436 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2436 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2436 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2436 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2436 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2436 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 2668 wrote to memory of 1540 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2668 wrote to memory of 1540 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 2668 wrote to memory of 1540 N/A C:\ProgramData\XClient.exe C:\Windows\System32\schtasks.exe
PID 1624 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1624 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1624 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe
PID 1624 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1624 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 1624 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe
PID 960 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe
PID 960 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe C:\Windows\System32\attrib.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe

"C:\Users\Admin\AppData\Local\Temp\Dеbug\BandeeraRAT By Donbas.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

"C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe"

C:\Users\Admin\AppData\Local\Temp\sisk.exe

"C:\Users\Admin\AppData\Local\Temp\sisk.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\XClient.exe

"C:\ProgramData\XClient.exe"

C:\ProgramData\Cheat.exe

"C:\ProgramData\Cheat.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\ProgramData\Fluxus V7.exe

"C:\ProgramData\Fluxus V7.exe"

C:\ProgramData\Built.exe

"C:\ProgramData\Built.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchоst" /tr "C:\ProgramData\svchоst.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\svchost\$77svchost.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Windows\system32\schtasks.exe

"schtasks.exe" /Create /SC ONCE /TN "ssbobr2.0.exe" /TR "C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe \"\ssbobr2.0.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST

C:\Windows\system32\schtasks.exe

"schtasks.exe" /query /TN ssbobr2.0.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sisk.exe'

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\Windows.exe

"C:\Users\Admin\AppData\Local\Temp\Windows.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\ProgramData\Cheat.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 5

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1068

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp23F5.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\taskeng.exe

taskeng.exe {6F6725AA-7754-49AE-A36A-501DB4285D9C} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\svchost\$77svchost.exe

"C:\Users\Admin\svchost\$77svchost.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\ProgramData\svchоst.exe

C:\ProgramData\svchоst.exe

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

"C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe"

C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

"C:\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 epsilonbot.xyz udp
US 8.8.8.8:53 greater-questionnaire.gl.at.ply.gg udp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 8.8.8.8:53 points-detect.gl.at.ply.gg udp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 147.185.221.18:35608 points-detect.gl.at.ply.gg tcp
US 8.8.8.8:53 artist-shared.gl.at.ply.gg udp
US 147.185.221.18:34511 artist-shared.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 artist-shared.gl.at.ply.gg tcp
US 8.8.8.8:53 stories-boulevard.gl.at.ply.gg udp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.18:34511 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
US 147.185.221.18:35608 stories-boulevard.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:35608 tcp
US 147.185.221.17:5562 greater-questionnaire.gl.at.ply.gg tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:35608 tcp
N/A 127.0.0.1:34511 tcp
N/A 127.0.0.1:35608 tcp

Files

memory/1664-1-0x0000000000BB0000-0x0000000001A3A000-memory.dmp

memory/1664-0-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1664-2-0x0000000000AF0000-0x0000000000B70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 42d557269c1be519b60ab0c6cd34f73f
SHA1 605cf15649c50998620209a163e01bd12c4261d4
SHA256 aad10328f7b98556fb2ed1df76c3826315c47f9d86014f1a112c585edd99a0fd
SHA512 b8db7ee88fa2693ffc5520ee751d3c8b9e909b43e8a59b6b1e6b46d1c7c4a9d597eeddb97e1eac305b9490f84fd298d768a7a3d2ec335ec11a062520bc13c361

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 46cfd8cd33e121633d6ec2c9d4df71a3
SHA1 7932453b00a787f02f5bc92983636541b3f79923
SHA256 b4d99f76946179aa1d972f402e3c6aac3203629b1b43e48b8698d015a647cfa1
SHA512 80edbfa07c62e836cec5c1a5ace4d566d5e0c87ef30ac2eab8ddcf06cda03134856ea92024d97addbadc0c13c2a18d0e2f2dbba991899ae415022c2b378846f7

memory/2884-8-0x0000000000960000-0x0000000000C7E000-memory.dmp

memory/2884-11-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 f3232b0aba8dd4073a7a45d9b1f158e5
SHA1 7a7878cf7f21af57c464a5e6f0a33ddffb16e7c3
SHA256 48ed45cabfb6e7ae85712bc0d9fcb3b1d936319ef74c736c8d4ca2e3de8cb035
SHA512 6afb1282ba79798fc5c9d434a221667814f4a5809949fbf987fe380135dd5cdfcb3e3bd693a8a8b41a6d03d037800b9e97ef088929b7d173ee540ddc2011ac37

memory/1664-15-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2564-16-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxus_V8.exe

MD5 5351ef0aa067a70527db57d5a878d2c6
SHA1 320e7bf20cf367826cc2d27724d16ca43c79bff8
SHA256 4c44ff2c6f2168da4844747174e216f19ee42c60f7cfa9b412c1aa1e706c8332
SHA512 f3bbf6ed473771ad7a8d0601badce1602d6d210a12987e4f1c86798ebbbfa71fb9cf3d04fed0f7feb3b594e7fdbe942e11e327f90dd103c11ae6025a0759b3a5

memory/2564-17-0x0000000001390000-0x0000000001EF2000-memory.dmp

memory/2884-18-0x000000001B440000-0x000000001B4C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b1a4dc9e46c84c7697640cc8b0c241d8
SHA1 8659e6cbd839fa044bf7d8da1e17e92495821d04
SHA256 95ea59cd01db6bd1882034d7d0afaf6514437207a9a27a94226c6e2358b60025
SHA512 7f76471b2596e58ee02f05cf74a56a1b1eb05e52cedbdccf89f6ae8ff903bbd7694ad9f1b5c02f5f56546b5140bec2a1faa85c634bb19efcf7cc739ca5f8e378

\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 701df65121e1977fdf160bd9cfb9bb6a
SHA1 5fbbddbad5e0ca509b60134f78188f255bf6b74e
SHA256 3723e482205265aab379471320d8ed825c04a106fd15881e5f09e6e25fc4e5f1
SHA512 2b15ab4a089bcf1f62cb0172f1674756016f54e07547b5038ba10975aaf6dde920d2a18d254245b4a4f2715b32040086a00b1cacc1bcf4cc1dc5a512feaa9607

memory/2876-27-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2436-26-0x000000013F400000-0x000000013F40E000-memory.dmp

memory/2884-28-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2436-29-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2564-30-0x000000001B3C0000-0x000000001B440000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 82fca63abb42d87176e6ec1e957d5f9f
SHA1 3ca66668261960d9fe072f6c6996da81184bf32e
SHA256 bb2f3bbfb60a31326743d4864c0a16744131c0315608b68b85e4a1933fe5e09c
SHA512 02e0f826b0080934afae6acce07e0ad8a3d50a507ae828e5d343f40979b008620ea04996c593ed453cce6a5739d5cad5731345e3d5438c4c4cee953c9576f31f

memory/2380-42-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2780-41-0x0000000000030000-0x0000000000048000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Fluxsus_V8.exe

MD5 926bac1a6264aa1b4baa0e4a022f4f5c
SHA1 8999e8a33f5e3e4263aac137256ed530acdaf47e
SHA256 466aca7279237317a24a90e2449a41258e576aeb62fb4efa52503a7ff112a015
SHA512 fd55215b4bc4f08ad5c9fbb99c237c9ec211e4d8bc0f9de4ce1dc80f13d50881ccae25e3eaafc15331b06cc14905a92a79a02a3c5f6fc8312f575cc113d6138b

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 24453e54f3906ed764045d322422e1da
SHA1 b952aff3a549b15d42b0196a030742c041ac6839
SHA256 8f619b468eb63dddfa305d892683131e5b9224feef5d9258bb210e2f26dcd07d
SHA512 543cc5bfb3394127cdc9a5a504e199af373e8d01dbeb4df608d23ff26144048a6ed45aa3fba47392c94628c7f992551e35ce827adb749d0c787cf9b8ee22c88a

memory/2780-43-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sisk.exe

MD5 ab1bbb41c6c90c3b6d93a9be5e352995
SHA1 70cd2de832d76014d7f50ee1a16e89fba701b659
SHA256 1bf82ca4dd37e2b8f28b458da35a1e76059d65999a4bc480f4c245544c963c45
SHA512 77b8aa1baafc4301e563fd6298ebc7785803f6894e12deb52887424a8ad8bf6f907c0297da7ed4cfd58fc151d5507d6164fb2bd2644c6cd71e84a6ca765d57a2

memory/2876-44-0x000000001B600000-0x000000001B680000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 250a260fef8533b76f6d990dd7e6bd29
SHA1 20e00fab8e43f5f8b1ca764943c5f9d1f09da993
SHA256 d67a58001321adb1b3f9e9f06dd4f3973246fb87b108942b4af04c61f9ae3784
SHA512 5b69651299b271a62b709e3966820c94a2e11a1344045d37b5e62d3724002d62692cb914d65c35f1197b4a3e4e4400987e6cb05bb882db3e22f73b51fe0d3100

memory/2380-45-0x0000000001250000-0x0000000001DBE000-memory.dmp

memory/1108-49-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/960-50-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2876-51-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2668-59-0x00000000010F0000-0x0000000001100000-memory.dmp

C:\ProgramData\XClient.exe

MD5 9ecb9d48c8da1e49862a32f5d32e3c9b
SHA1 20902b0b25916dab87b0a373e6fa28ce26feed49
SHA256 fb2089afae7b75b4bfe6780786cd723a7ef09a22ac3b8701b31c3989de41e7ff
SHA512 3dfd281d6989c8a4e9c19c35cb5581821854dfe5719e58e59b4ab7955e272e108e626fa9a7bd6c0fa0ab9d596176ff008c157fa8908959da321cb921dd70cae3

C:\ProgramData\Cheat.exe

MD5 a495f7df4cdb2c9febd69c56ff6563bc
SHA1 f95944cab464e1d89b671be7ec345d44e9bf8a03
SHA256 5779c0b0351a6ecc3a65d5f979858f930c9a63fa907cea2082a0de2af6393052
SHA512 74c38d45af559f5a30d22b2525b5c45becbf512afd828aed0604554e9c6c13b1b587dd88a035be02f9c6d319d4a0f894597de67024902049b00580f3e984f1e7

memory/2564-64-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2668-68-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2436-72-0x000000001B590000-0x000000001B610000-memory.dmp

C:\ProgramData\Built.exe

MD5 f8cb1f93c8d41ceeceb16bcff490ee2c
SHA1 31a3d1af3e1ef16b0223aefbac0ad0a34fd6856b
SHA256 b4c533532e685a6cf90a876e91650eb5f618a6013ab638c3cc32c5978c278800
SHA512 6cf2ce4c7561c787ba31673742cf9b1f606896866b36de536afb9fd1e9b11fac68c7875e6f63375220ab9c7f04f80d66cdf21e0486261db4434b48551ade4f1f

C:\ProgramData\Fluxus V7.exe

MD5 e98eafdae19b25066349f66155177f7e
SHA1 1ff6d4338ecef43541bca9f9e89f0538d284eead
SHA256 0f72f06558031024ef40302ca608c11892eb67bdcc31d386a8bb2fb2cb51adbb
SHA512 deddd1105db94ae45275cc0ef967ea1b0b36a962451449c0a8cf7e4b10be4de7792bc114c3316e086e30268e12890342d464a36caedeb175ca29689a9791152b

C:\Users\Admin\AppData\Local\Temp\_MEI20402\python311.dll

MD5 e7fa49a418373ca9fb5405c080ccb84a
SHA1 9c300ce791402dfa62eb4a7dd5f3089d039fee65
SHA256 eee6d92529f1a1afba0cb53954fb291a3a13140f85683ba9019b410a49688adb
SHA512 d386e08ceaf21a924756c9bc60f81f7f0e2df83f14469ed2c2536037d8773644aeccf98cbcd1e6290479e308d5b83f0eb213c3da5f458ee6ab882e0a8d131eb9

C:\ProgramData\Fluxus V7.exe

MD5 941198a6ba850f299c7335cd4abce708
SHA1 88fe11c1d77d85079c5270b10435586a77ded8d7
SHA256 9556ffba7ba59f15e8a765ad4c954c624268562f9205bcd83adb05c410552825
SHA512 ee10640baa0ffd65fc5296b93768afc1f9096080ccbefa2e5fc9d474e14abc6839d2dcbf34738d4d1d482096f01ca8d40eaafbc2e49f42a7e055e860ddb42311

memory/2380-103-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

C:\ProgramData\Built.exe

MD5 0f330758454904908db5302984c3d481
SHA1 2e29423e41988e75d5a5b3c74b20bfd34a6df6b5
SHA256 3fde13308bb2202f07ddede42faa43a94630fd1a2955a92e5aa3a53e5cf32830
SHA512 d15ee25f9731b71466698a5457aa66b02cd727efe6902fb0dac23433a1db65966306022af063726de38712cd07a122bf9e43976aa4e177938230074f169e5876

\ProgramData\Built.exe

MD5 4ddbaecb2f3b93772c5b4595754128ef
SHA1 1868b750e5b6dd8dd9d9ace0c07e8e1daece8e88
SHA256 6acbea3c29908e20937fe724bcbe8332601bb4b79054da0d47a2b996fa8d8c3a
SHA512 4df615be079bc832066656ac735bda2d308db17a9e0b2ee019d65affc1bf1f348455a5ced0282e3ee47e493ed8204697f10ad106a63cfe3087671a3ef164d15d

\Users\Admin\AppData\Local\Temp\_MEI20402\python311.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\ProgramData\Built.exe

MD5 7194b972294561265896ae9b78a6450a
SHA1 86f8b150cc4f9556931be18fd512ff4d9b2eb639
SHA256 3bb49ea208407c3e8181b7f558cb439ecafebfe9eb6acfe68e0d857d15e4c283
SHA512 37dd392606fd952caa55cff561da07746f19753f4510b62675945663e0f6b2504027c8ddb0adef85142a22739ff598598095eb25755883bfa777194693862bbc

\ProgramData\Built.exe

MD5 fda29cf838d3ed1371d4defa4ab144d8
SHA1 b69393f5e6c8ddd00d78fc3ab8c7cfd05ad38002
SHA256 fd54b1133f490de4c67daa7e95a72718cb003caad84b87420c97aee6bf2454e2
SHA512 40cb4c29bf237648abedcfd6829f8d40f3aacd5a46af0d19af408e258d1227126d4e45f0eb7856419004418e0ef35a0e9fd4d47e773ceb05fa489832eb156c57

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 406c03084e1a8122f1db7f413f4ffd82
SHA1 fde979999fd0775ac34f856567c9fb0c9e475f09
SHA256 f9c5240c208c9fcc4a1a375650d0fb6c4fafa68298b55712b6e6aaa91a6e9996
SHA512 747a96f9b4362af6249f1c0bec9e4b99c999fd5262721235a7b43234b62a82df9e4dcc150ea0ce53c5c63d0a47b56ad8bd3e2efb805ae9fce28c042c8f5de02d

memory/1108-108-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2008-110-0x0000000000B60000-0x0000000000F54000-memory.dmp

memory/3028-109-0x0000000001260000-0x0000000001276000-memory.dmp

memory/3028-111-0x0000000074AB0000-0x000000007519E000-memory.dmp

memory/2008-112-0x0000000074AB0000-0x000000007519E000-memory.dmp

memory/1204-113-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1624-114-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1644-115-0x000007FEF2500000-0x000007FEF2AEE000-memory.dmp

memory/2436-116-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1624-119-0x000000001B4C0000-0x000000001B540000-memory.dmp

memory/960-117-0x000000001C190000-0x000000001C210000-memory.dmp

memory/2780-120-0x000000001ABB0000-0x000000001AC30000-memory.dmp

memory/1204-121-0x000000001AD20000-0x000000001ADA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 6d9edbcc4718e2929afb236fc526d72c
SHA1 35a103e0b3e2b6a7bc3f5d77067a29e277f5f1ee
SHA256 77c92e8ba24254d27dd67c58e269abf86c6327b31a6cb62c6b99dcf31710ed2c
SHA512 e36703d497057efd7c9965f695e3d804ad98166defb65055ea6ba0e898879173d9e3aaf776b0a5816866301b37e142385fbb75ae502113bbf1beebd2c9c10859

memory/2780-125-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

\ProgramData\Built.exe

MD5 f82f7e8dfb473b43ed6d7d4bc548fc93
SHA1 5f4e4d009e792bf748a19d5ad55351f707ffff18
SHA256 51dcc209159f7c14ec0c03726952e3620496fecd1620c8a4a82c721a597d464c
SHA512 24bab3fc4bd1412797f19195fb53d34eade55575507e5d41113013eeff82241ed26c7fd6e08b314c4004ff9c1ed2f2e5211339a93657f750d711fbb12f34e32e

memory/1204-128-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

\ProgramData\Built.exe

MD5 35bb29582c5e9c202cf7608272e131fb
SHA1 522b5c9c96a7e19a4e2e38ecb9cf87c6dc042940
SHA256 3cc0f528cbd3ce48d3ae251e28b939c6011668ac87cb19c59bbb8dab0987eb29
SHA512 2e27907df54323b2d4bd64157382f2753332141e40e5667443a42b57a9ac280ca84663adf6ece069862c214d083c5713292b2a3831baf17a4f8a460a4e766c52

memory/1988-129-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1792-130-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1624-131-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/3028-132-0x00000000011B0000-0x00000000011F0000-memory.dmp

memory/1988-137-0x000000001B4F0000-0x000000001B570000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 e7de15431fb1c282cb71ec3883f9b119
SHA1 6d0dd295a5ee5d62ee782e10afa04b58f4237c38
SHA256 19806ac001dcc83bf45757bd97205c28a49a19dedd0c825e8b0978b65673ea36
SHA512 b3c8068196e587129bec569564213c3bfee9d504b38ba186f3f0c6ae5d3ed77a284eea43f2e71852b7a58f148c77b2d13eb509734cb1140881f711df34994076

memory/864-138-0x00000000025B0000-0x0000000002630000-memory.dmp

C:\Windows.exe

MD5 e95754ce4e8df4658492b7b0f5fc77cf
SHA1 58129910d09a5406da8f7936d065efd92d5aeef5
SHA256 9f3d79b2a3ec9b53ac931a496706f084f301443b9f11dff2684a773aaf6d3914
SHA512 15e98bce0ec91056519a0d39c6fd7976c2cd55516cc2b47cfbd84f2a729e0251c6f83f3c3d56c931dc21620da666c60f4cc34252e1f94331c38737db1a53bd6b

memory/1988-144-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/864-145-0x000007FEEDDA0000-0x000007FEEE73D000-memory.dmp

memory/864-146-0x00000000025B0000-0x0000000002630000-memory.dmp

memory/2668-147-0x000000001B310000-0x000000001B390000-memory.dmp

memory/2432-148-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/960-149-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/1792-150-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2180-151-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/864-152-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

memory/2668-153-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

\Users\Admin\AppData\Local\Temp\ssbobr2.0.exe

MD5 f3d43e332dd898f240b5b42c3d41ad35
SHA1 da619b6a1a57fce3f803362d6dad3d660f2e4309
SHA256 b3ec94de12b665a4a909049940480a5b8eef90d19974bbc20fd00d015e541ef7
SHA512 b29a1dd70ed3b3418e028d396dd57711d7b8a506f97100cc7f4ec974469ca5f2b505b06cc0562fd4b17de7cc6c23ed9d4a03a6888371996634aec019d9a9cfd7

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 c12428c741a655c25bd971d585155747
SHA1 1b522de60155690c4f8f603e6f7ae13b5bf0b0c8
SHA256 5e060baac39e7e82876881d2547ca9cba897aa1b8b7fedc2f15ee3974b9b2451
SHA512 00ba326b9bb389fc13b5d0030ea50ffd15d0e283c5d0318364ddbec047ce89a0e92b5981290fdc911137b1d93044463613516c298da831f60cbd2861ee2c6187

memory/2180-157-0x000000001B570000-0x000000001B5F0000-memory.dmp

memory/2352-160-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

memory/2436-155-0x000000001B590000-0x000000001B610000-memory.dmp

memory/864-154-0x0000000002460000-0x0000000002468000-memory.dmp

memory/3028-161-0x0000000074AB0000-0x000000007519E000-memory.dmp

memory/864-162-0x00000000025B0000-0x0000000002630000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 3f2400d43ffddb2278473b12f3ea090d
SHA1 e0eb353987a81b4f0db8594854b7e7af45e4dbc2
SHA256 f2f23b4820c912382b45cbf7101b93b1ca398cacfbbdaebcb1c07b7ced632e12
SHA512 74a4dce9b8fad00c5c2343faf406c587462698e72d4d6bcb72a9bcfdbb72d6d3046afbfa431cb3a8492fc3aa1e825b1795ed08bd084f3fc29258576d132fdff6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CE6ZTPBBQ0KV97J5401R.temp

MD5 1f4aed1d60b0e0bc6a62c6af703110cf
SHA1 6c1ad27034dcc2f9988f34eaf98c39265a7eb570
SHA256 755a46516895d276fc39b887e57b04582fbaca28a602b4297153dbd01db9f02f
SHA512 a07d3cdf505dcd5d0fcdf91448919e14153abb5e0af7e7ec94cec34574f4b941aad39474106e246debdfb27d27a5dc9626d2650d7d337df15f4f0971e1c255d2

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 abc9251a849944062a935d33677c11a5
SHA1 9cd20738258f3d2c44dea3c0a9e1c6ab06e366de
SHA256 7704dfa0cb11231901cdb6f80bf348e9282932b0171289c10a83c26f8c8f8252
SHA512 5dddef53ea583103e521404414b8b5a7dd32c3b752cd0b305589b5f2ba2ef72417e488e3b50bd368a12f8d2371047e942b57cf7a4b6c9308f0d5f27ee6e19c2b

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 e4092cf67a7f38b2f40f5622f5db91c8
SHA1 d7731a373f32b9db1058d57eb355d125780bfd80
SHA256 e466c0e50d5aef790139f868dea0ebe276ed5cccf50cf53265aa7dae38531d28
SHA512 e4774e86617745e8ce6f08509452c0170a719a1aff0989842826ea7607c4ef7a963d0a7b752435e760d0c69e444daf8c0ecb5972393e4d0ca96be95d528f09d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 df844b1a6920afef612218c96d33b1dd
SHA1 d1200114431dfd19f12995a9476b26057d65b5f8
SHA256 1779ce4ab3b7f510eb5ae5230459f68173d2c416f08d91d14d95ea6d0d0d5e4a
SHA512 768742f4190c87f663c5074840ea750ecee2d96148a1e28be58cef1397cce29cd1264de8ca1bcfbf182264e2389933429316a94d9bd2ea400dcf0ba518d2b2a8

C:\Users\Admin\AppData\Local\Temp\TarB5D.tmp

MD5 6972dfc021d27c10a9d8f04645916feb
SHA1 43849618f1d75084cb7d95f3bbf794c46dae00a7
SHA256 f63237b0e5bcbd839fc31598a918cf5ba7e96d301052c66201edd858e0507556
SHA512 ac9d820514386d81879712c75569355cf37316262b65c166fec1f83dc0a4ae64e1d9cfffe509444d2189e39a412ba45e0ec5cdd541ea6f517567ad078788f774

C:\Users\Admin\AppData\Local\Temp\BanderaRAT.exe

MD5 b54567a54fc96701c664702847c85ff0
SHA1 f44ac1bee99f7a72d24b1b64d3af7995d0af4727
SHA256 661d3359e7461a724a45bff7c94cce3ed91aa294bed1bc8c983fe66724f3c484
SHA512 964d7cc7da049c689211c97c6349a481090fe81a30f862f8f868e375d8530f7e82f5792b2de4405f5e6275ac7a86e06bdec74f789b10510573f44d489e6f075a

\ProgramData\Fluxus V7.exe

MD5 f8826f82c546cba77f07a265c5916979
SHA1 00db7efa5629fb66a83146bb9ec638d3948d790e
SHA256 72798a42846312254f213a993884ee5b85054adc11eb423767710872e9c14535
SHA512 8b1a46fcca77c25be5383d0d58e1dfaa8b6a44b5b82ab41b97d242fa294a50120b459e3c0ca1d5c2bd67715c517cc68b6eaafe5ec2c8e2c6073ffed251759d8a

\ProgramData\Fluxus V7.exe

MD5 d938a9bca4e59c499acaa159b679fdf1
SHA1 1d0558f0023a8f45a8cd6a9a98ac2f876c6c2a48
SHA256 73b48f1e8f5c52c6af04285dfd6c57b9263e36dbadea5e6b15b735f8c45534f6
SHA512 39e3a62b29066218414a1a9ff13ea701d5760d2048034abd4a4535be6d87057d18ad6661dca9e09166d510ba4b562c53be4ddcf4555ed147ddacf5bbf2bf46f3

\ProgramData\Fluxus V7.exe

MD5 e5372335f670496d141afef756589f73
SHA1 d377c7f63ea264489842c9687530a942a533e83e
SHA256 f7041de0535a308cede0c65b3926a6fc30b15c5ec98d5f6a912095e3f2b0837b
SHA512 b43fa829906b745dc818b81b634a9fff058664246351ea98fb324f29ff76d5c09f1570b1325d5111ede0f059e248481671953e8fd0191e33185c861c4f72c289

\ProgramData\Fluxus V7.exe

MD5 b9e56e7d187663a0be38d353c3e89967
SHA1 68a87f85d1c6615cebfbf8a5fc9aef9ffd4ccfa3
SHA256 5875980fbd42e79ef59a1f82dcdeb4a5de376c31aabdd957f7ddb38bade0e6d9
SHA512 2af8a8e098f104dc5c0f898a6574eee64c66fa8a48d8d29277d98008bbde627df8ec22c58f02ce7915d59b76c164b5f90c615e25b702a32c1a8d2715fb8f66b4

C:\Users\Admin\AppData\Local\Temp\tmp23F5.tmp.bat

MD5 027e38583474bfeb7a85067ada4cc8b0
SHA1 eef612643f8942813eaf8038bfcf402b85e34325
SHA256 790551c0ccfe6824b217f6114475282ed0e4611595a441ba52d456c92a2729bb
SHA512 6336107a5fbe63dc65ea410be6595582b285a77ce7f2a38099812064accf2067cefa72193b51fe3dab1696f76f66834a0a1dc4634a6f19bf457dfe6117459e41

C:\ProgramData\svchоst.exe

MD5 abe6def099b7132c238f74b0c1e0daa3
SHA1 20e8beabb54bb65038d255c24005102058fc68bb
SHA256 80edc40118a2276ce71d77df5def1e3275d70a233d48898659783b97af5f4f33
SHA512 077197da49bb8b463b154e9de7660423674dce6f4239d768dd7369696dc173405b2ddac773d263b6b162246444dfa66d3e33bbb12fcbc3d60654c23f70bcc9ad

Analysis: behavioral5

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

135s

Command Line

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ff87664e94fc9c8d27541bd5029c80429c5ec9e8ea1a37fc292d054ccde14e29000000000e80000000020000200000006aded282b2aed3d29a6d053d762dea7538b8c2ec17367fbbbcc8db78446c02a820000000aad92e9e99ccf78e78f9b4a4d16d562ca5cc7c609cd4c96b11fbad7ae20e2a3a400000004ce3783eb99bbc752a25751d7f8ad73e89be0478032dca7db34256fa374a71883b9ec5b22ed4bfb437936176d4e2e8582a54e08687a3ed3c9d87b673405b09eb C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1046C891-DAEE-11EE-9340-6EAD7206CC74} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000008de8918a490cf851b3801751a8d99bc97666f16e79617449f618f820a8885c56000000000e800000000200002000000086908e9230ab7aaf9b9dceb6ab7b83d3b89206d51054d8dc901f59a824d708e0900000001b2a1940b3a33df02be0f1885d148761d9da448c1329dca2cd4356458d500927ee71d64c4bee5601a7a454fc76fb7d1890d5b2fe685d991437316166ac9a7fc148575030efd84d5f9db3fad22d277b98b55207496b77d624d596dde81c4fdde0ce5792ace90f0490a1a0edfe93f118925e829d13defe78f1280746fe04fbdc30ee999beeadc08194bfbad72982af3bb540000000f4146315db322acb2c2645e28b2414665f61e62e5e59ad77b594f2452951bed26e9f4483c4c3b5e2802c38d60fb4ed4dad2a48083d6bde3a716d6f5f0b507016 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415804525" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bbb4e4fa6eda01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2156 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2924 wrote to memory of 2156 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2924 wrote to memory of 2156 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2924 wrote to memory of 2156 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2156 wrote to memory of 2508 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2156 wrote to memory of 2508 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2156 wrote to memory of 2508 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2156 wrote to memory of 2508 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2508 wrote to memory of 2168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2508 wrote to memory of 2168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2508 wrote to memory of 2168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2508 wrote to memory of 2168 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

C:\Users\Admin\AppData\Local\Temp\Tar30F8.tmp

MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 284731a70ed7f88f57c687b0a7c7611d
SHA1 04a5b4a3a64060215ccf1bf3eea5ef378e6cd0d7
SHA256 9ff87d537991e1392cfff04fa9fae379108e2b9130b73667b52dce7b02dbec4e
SHA512 eeede31315b45c541c02f03917db757e1313b40588919b3a5923a63f0e7f4011c6a8178e7d1a61500da9318d1fc65b65498cb4d13728ec4fe4806a95537af688

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 905f3e6085c1674f6a4c34ec279a5054
SHA1 1b512f6dd0c5a2f51b3abf0321da103e107bab64
SHA256 ac9b7699b362d14b1ab5f2adca3fb397bd10f7a188cfe2ab12dbdea6f7ef6265
SHA512 fc86ba892632e4ed84b86d3bb59ec7596780e2e0bd36dcdf23bcd18cc461d35a353541dc35148d8a724c491c35f53ee442780decc3159b5fa0c545c816f4e5c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8af94ee930eb376fe1c9f7b90b4dff0e
SHA1 896a97c0654223ba7e806649b983180574c0a30a
SHA256 49af42d04cc9ce22755151de46f63da6e14752ef78d14950babe6c09b45799b6
SHA512 5f5684d895a762232d01b73e800cecb694fb4294324381a3a84022f1bf2a362836bd16a10d8b7eae80bc25ca51b82f18c045cb1be2d4f73b66b252bfe14772fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f5ab5208e3f0029a102c27a2a6a539cf
SHA1 a1a2c0fae277e96cf341094ffa7f7afdca4676e8
SHA256 8f2c8c3ab11394acad80251bfd883a7099630b95eb5afb508944e0a53ee8cbdb
SHA512 c5979d8d2523b20fa6426b35711506d6e312a16e825aabee755d7096981c6fe97338b858cbff6327e54ab6e4664139af59bb2616cc86d754e1e7f1db37a3adcc

Analysis: behavioral16

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\PORTS.dat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 179.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 218.135.221.88.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

119s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2912 wrote to memory of 2324 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:49

Platform

win10v2004-20240226-en

Max time kernel

133s

Max time network

277s

Command Line

"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Signatures

N/A

Processes

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.exe.xml"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp

Files

memory/3532-0-0x00007FFE380F0000-0x00007FFE38100000-memory.dmp

memory/3532-1-0x00007FFE78070000-0x00007FFE78265000-memory.dmp

memory/3532-2-0x00007FFE75C50000-0x00007FFE75F19000-memory.dmp

memory/3532-3-0x00007FFE380F0000-0x00007FFE38100000-memory.dmp

memory/3532-4-0x00007FFE78070000-0x00007FFE78265000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

120s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

156s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4916 wrote to memory of 4712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4916 wrote to memory of 4712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4916 wrote to memory of 4712 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5404 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4824 wrote to memory of 1760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4824 wrote to memory of 1760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4824 wrote to memory of 1760 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DDOS.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 136.71.105.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

166s

Max time network

190s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 216.58.201.106:443 tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

159s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\DEC.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 90.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
PL 93.184.221.240:80 tcp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

119s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\ENC.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 9a6283a61e4b4b6c1845aa7927074d11
SHA1 1f5d190795a1a693e5178b7e1797293669f881b7
SHA256 312860b9b1116b2168762d610983f3ecb525d24ad5faecfef548fe652476fd84
SHA512 b27ef4a5ff3684420d7a9c5a1c944315ed8d5c8dd56f31f8e301f6469da593e93363b2e2342313d97e02f7799db0b6372475918e8064a4f4e0244fa4043de288

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:48

Platform

win7-20240221-en

Max time kernel

159s

Max time network

132s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

Signatures

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2668 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2668 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe
PID 2668 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Program Files\7-Zip\7zFM.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dbug.rar

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Dbug.rar"

Network

N/A

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.pdb\ = "pdb_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\.pdb C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\pdb_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\LimeRAT.pdb"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 b85074bec6b6abcd9e567cbcc3d55f12
SHA1 4662ab051fff0f84d9880394e35eec8b77be55f5
SHA256 b211a0a27bb88eb302cb39a7e454175a17d205f6517014df6b1881132d1c4f81
SHA512 ed8075f99f1443e200dc6f5871bd8e2299ff18c801aa67d66a318112b91f5ded065aa14946dfbf8fb1c2c79ac6e6908ff7b0029f89064dc998912ac0cb3f8ce4

Analysis: behavioral9

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\MetroFramework.Fonts.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win7-20240221-en

Max time kernel

117s

Max time network

126s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.dat\ = "dat_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.dat C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\GeoIP.dat"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 93e00f441f3b2eed6f9f14f313f01836
SHA1 7efe7f9e71c66924e2b5f15546521bcee2334adf
SHA256 7d11a2e7c4c720a49a9c4ba3eac86311614010a6a0c6d63b2795f92963f59cb9
SHA512 eee7569c910b6a1206496e65a0f389b5fbb333499ead9ae63bc6e97cbfb2dfd50472d6fbeba7834b3cfe984ee2adf71670c5cc462bf65220303879e0917f6547

Analysis: behavioral17

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:47

Platform

win7-20240221-en

Max time kernel

120s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1556 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\CRYP.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-03-05 12:42

Reported

2024-03-05 12:46

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

149s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Dеbug\Misc\Plugins\FM.pdb

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 202.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 33.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 211.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 184.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp

Files

N/A