revengerat | d34a32b1c044553ab8b803f4370526f7a73d1cb519adcaec91b2c10efaa556b3

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe
Size 144KB
Sample240328-mpsrdsgd32
SHA256 d34a32b1c044553ab8b803f4370526f7a73d1cb519adcaec91b2c10efaa556b3
MD5 0371221c3aa1147d1009f0d0b1bf22e8
SHA1 5f33bcfe0070b7ac3b4d527103bb4a9385603de3
SHA512 a42bb69676da8c267a8f5b472cbba1ba408a553f919d8536f0a4e8054da914b5aa34089744301acf9eb5d993881955dda478ee2c5b663a945c8aafccef1a9eab
SSDEEP 1536:8qJo6rUcu/rbPm8J+Ud+kR2qBa5z17gm6zG:8SRw+Ud+kRBBa5yjK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat ⚡⚡ welcome ⚡⚡persistence stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

⚡⚡ WELCOME ⚡⚡

xd.zapto.org:27730

Mutex

RV_MUTEX-aawrHJfWfhaRCl

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/1264-6-0x00000000011E0000-0x00000000011EA000-memory.dmp	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe	0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe	Service Host Network Service.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe	vbc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe	0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1844	Service Host Network Service.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Service Host Network Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Service Host Network Service.exe"	Service Host Network Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe
Token: SeDebugPrivilege	1844	Service Host Network Service.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1844	1264	0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe	102
PID 1264 wrote to memory of 1844	1264	0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe	102
PID 1844 wrote to memory of 1644	1844	Service Host Network Service.exe	103
PID 1844 wrote to memory of 1644	1844	Service Host Network Service.exe	103
PID 1644 wrote to memory of 4548	1644	vbc.exe	105
PID 1644 wrote to memory of 4548	1644	vbc.exe	105
PID 1844 wrote to memory of 2296	1844	Service Host Network Service.exe	106
PID 1844 wrote to memory of 2296	1844	Service Host Network Service.exe	106
PID 2296 wrote to memory of 2300	2296	vbc.exe	108
PID 2296 wrote to memory of 2300	2296	vbc.exe	108
PID 1844 wrote to memory of 4456	1844	Service Host Network Service.exe	109
PID 1844 wrote to memory of 4456	1844	Service Host Network Service.exe	109
PID 4456 wrote to memory of 4020	4456	vbc.exe	111
PID 4456 wrote to memory of 4020	4456	vbc.exe	111
PID 1844 wrote to memory of 4584	1844	Service Host Network Service.exe	112
PID 1844 wrote to memory of 4584	1844	Service Host Network Service.exe	112
PID 4584 wrote to memory of 4316	4584	vbc.exe	114
PID 4584 wrote to memory of 4316	4584	vbc.exe	114
PID 1844 wrote to memory of 3976	1844	Service Host Network Service.exe	115
PID 1844 wrote to memory of 3976	1844	Service Host Network Service.exe	115
PID 3976 wrote to memory of 1064	3976	vbc.exe	117
PID 3976 wrote to memory of 1064	3976	vbc.exe	117
PID 1844 wrote to memory of 1700	1844	Service Host Network Service.exe	118
PID 1844 wrote to memory of 1700	1844	Service Host Network Service.exe	118
PID 1700 wrote to memory of 1152	1700	vbc.exe	120
PID 1700 wrote to memory of 1152	1700	vbc.exe	120
PID 1844 wrote to memory of 260	1844	Service Host Network Service.exe	121
PID 1844 wrote to memory of 260	1844	Service Host Network Service.exe	121
PID 260 wrote to memory of 620	260	vbc.exe	123
PID 260 wrote to memory of 620	260	vbc.exe	123
PID 1844 wrote to memory of 1780	1844	Service Host Network Service.exe	124
PID 1844 wrote to memory of 1780	1844	Service Host Network Service.exe	124
PID 1780 wrote to memory of 956	1780	vbc.exe	126
PID 1780 wrote to memory of 956	1780	vbc.exe	126
PID 1844 wrote to memory of 2444	1844	Service Host Network Service.exe	127
PID 1844 wrote to memory of 2444	1844	Service Host Network Service.exe	127
PID 2444 wrote to memory of 3172	2444	vbc.exe	129
PID 2444 wrote to memory of 3172	2444	vbc.exe	129

C:\Users\Admin\AppData\Local\Temp\0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0371221c3aa1147d1009f0d0b1bf22e8_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fugptjzp.cmdline"
    3⤵
    - Drops startup file
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB80B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4A4CA47CD1344B999631BF7E88B81F9.TMP"
      4⤵
      PID:4548
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w8eqb3ke.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB38.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc17EAC53CF1EE4E58B6B9268E1337A646.TMP"
      4⤵
      PID:2300
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d_ysygcf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC70.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8AA358B2642F4FDB93BF2C3D194E2E11.TMP"
      4⤵
      PID:4020
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ilhzqkhz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD99.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1D01B4FE203140869F17E9B87240AFED.TMP"
      4⤵
      PID:4316
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7xre4yep.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF20.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc17A8D3F5744443F19136426BFF2A39CF.TMP"
      4⤵
      PID:1064
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\acjqjbqy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC068.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCFF06EA1CA0F4D2CA2D24E83583DC1AF.TMP"
      4⤵
      PID:1152
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jfa313ft.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC181.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD0697556797C41E69244A052404C5F0.TMP"
      4⤵
      PID:620
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ksjcdikv.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC27B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcABEA2D9ACBA14BE09D81BC9450D21BC4.TMP"
      4⤵
      PID:956
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ml9bleqv.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC394.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFEE65367B34A529C4565FD57446D0.TMP"
      4⤵
      PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7xre4yep.0.vb

Path C:\Users\Admin\AppData\Local\Temp\7xre4yep.0.vb
Size 301B
SHA256 11ff8b3d62bf5e3e024520eb3659e4ef4f2a41e2a77256f170b5e9b049fadebf
MD5 e4b9808f202806f8a586ac0fc7913b80
SHA1 bdd4224b28e5619c592a7011587e0e87bf6b3e92
SHA512 dd3f0e39b3f9b88a7f235b0417922d4c0190b1bc3855ed326b3a86c85a6d63dad61b2e3dcb8ae792b93b4c69fad1b3ef5313186025a0442271344ec7ae2164f6
MD5 SHA1 SHA512

Submit Download

7xre4yep.cmdline

Path C:\Users\Admin\AppData\Local\Temp\7xre4yep.cmdline
Size 171B
SHA256 c0dbe2f3d88129f864fc0c91b058d0c6dc0fcb75fa3bc6bc17b026e986c3444f
MD5 7882f9ccb079be29abf6bc7abd714bfe
SHA1 77e793a5b94a605ad7d6d5f327f81507edeebecc
SHA512 1d11ea8aa2d751b9d2134a3195f45cb4b2477b8f8e0a6b0ca0edff57dbf9fed67bcef28b59b355307e8586fd2d8c23978ec12743b78e5942ae18ccc55e0663a7
MD5 SHA1 SHA512

Submit Download

RESB80B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB80B.tmp
Size 1KB
SHA256 35f6b1187c2a2baec9ca8f344479479a220e353ed280c34a6bd4348fd098fdae
MD5 65c0cfdea92a5fc3b79421eedcabaa54
SHA1 d6a30d8653a918fffd0cb4eaae0fe53546f777db
SHA512 604456e8111c54e77c00c84e193d3e507579c616d359096703f78026dc615dc315da56fcf568557fe40a4cff22c83931773eef5531e28b1b8e62777a387dc9fd
MD5 SHA1 SHA512

Submit Download

RESBB38.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBB38.tmp
Size 1KB
SHA256 1e11d73ea31acca86a5ced201b2e7856c1db526f86d818af0300aa1e77f84124
MD5 3642fc89419dd55ad5a2d6b52144d46c
SHA1 9a249e4119373320653cb7484c980c7605672afa
SHA512 dc93f4326c2ad27cdfb3c4f117684374e3718905b06219a8348fc0c53bccd0d5eda435fba78a9346c113f73aa3f1f0fd37aadbc94ede1b616bc0a25b1715bec4
MD5 SHA1 SHA512

Submit Download

RESBC70.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBC70.tmp
Size 1KB
SHA256 bbe5a17b4b8305117de3ae8903d9c886ca59d41207b540ded8a2dee3b4796633
MD5 90b762d2200dad0ea319fcb91db0da4d
SHA1 a8824e142c2305e56af75229413a50fa59059c79
SHA512 e9ac9bd7b0828ee78aeb0bf51400920247cb9ff24e37d0f1e26d878e6d93647bcd5528476a27760a9cb636868139c06c738b4bda3f9282926c18b311bb20c8d1
MD5 SHA1 SHA512

Submit Download

RESBD99.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBD99.tmp
Size 1KB
SHA256 7c6dac958f72318ceaa28d3ad9602355cec62e64f1677c8a4b6675bead59ef7e
MD5 13abea029faac941435570d23e4ed85a
SHA1 a11147cbf46492886d57931062d729da70f36c33
SHA512 df153eee6b4b55fc9d13dc95c5693077191a238ff5466850d7ac2290e66f671661f2e03ab0d37ebbd9fc8100c9de5b05e6471a280891162ad7f3f81f626755bb
MD5 SHA1 SHA512

Submit Download

RESBF20.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBF20.tmp
Size 1KB
SHA256 9c1e390890c46e0d9c9b4afcb15c6406f7a711cb34e35303d37437c78b01fb2b
MD5 475ccc02ba7596f071d3347806b1a457
SHA1 c3e9af7dee18e0cc69d02119649b03b4d918620a
SHA512 c57ea230f6fb11abf4da6e978885e485462e182cf9c2b4a60d33f2f46226e3544f0bdc54bc02f9ba3afd81c9909fca00d7c2e1d5a02004bf3d9c66a4eb50464f
MD5 SHA1 SHA512

Submit Download

RESC068.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC068.tmp
Size 1KB
SHA256 530d2a5e5467df0e79881483b10ece104457a3929892cb4bdd5e2130154840c3
MD5 3b6e7105ed189361b6a445ef08d3667b
SHA1 d9b54e46a40c96828dd0a13b6908380bdc3b5ac2
SHA512 7d3a3b26b3249e710d0032116d41e3d738ba774106b0e5375db104f234472cace31f9c4afb690b9b167386ec57a969ba2fead790c1f1706e2ef1073ef88f7f8e
MD5 SHA1 SHA512

Submit Download

RESC181.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC181.tmp
Size 1KB
SHA256 b1b0b4d993dd5f0ed599d6a5d1df85a83fc4ffcfb7513128c087138ef5e5e46b
MD5 d863d23d0041a589c14cc15c5a134d8c
SHA1 f8f7b19e0f13f89000151927dd7287a2e9d14c0d
SHA512 d88dbf71b964381a6f6ecf6a9967905c95e1835b9764e64d37e65e0895ca78356cd3a462e7ab88d3df088a66b62bc352b70036b5cb4479a30be71a90affff489
MD5 SHA1 SHA512

Submit Download

RESC27B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC27B.tmp
Size 1KB
SHA256 57840f1a659410cdd54dbee5c36cc8d196deef9eacf846d85932ba019cd4a36c
MD5 88c3d0ac7ff7110bc3a312e67fcdedf5
SHA1 e05e596a147cfd02418fd9126b8a7843e4b93539
SHA512 a9facada5714cd06ece61de998f1a674fb676f18a7aee5835cdbfd91ca0312d1d9643bf70767845b092aebe9054d075146e14040c5eccd0e32b6b49fc8155cb4
MD5 SHA1 SHA512

Submit Download

RESC394.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC394.tmp
Size 1KB
SHA256 c82220d63e3af3c20b02071cd416a1e5fd5f9838f0dfb7f639b351c388a84bf1
MD5 03f04672bb5196976b0375ab5fb1b494
SHA1 7e6c5a435fd8eee04ccbf4f8a715fe756e09510b
SHA512 65f93bc957e3332ea817ebbd1b41c9df22da400995634c1ae33ec773a225168fd7a133a594c75a674cf3e1a704b62669b9ddbc8b0612405b0bdf9ee0294de4dc
MD5 SHA1 SHA512

Submit Download

acjqjbqy.0.vb

Path C:\Users\Admin\AppData\Local\Temp\acjqjbqy.0.vb
Size 304B
SHA256 15bca0d615bef793fce92cf2acb3063d9ecbdf766efb009473c555b22a59b348
MD5 fb01d8183f16b971831f9d37461beba2
SHA1 e348c4296dae9b97c4ec78deb8673b4bf8ef19cc
SHA512 660ebc5639b71db5661b4af21cc8ecb6b471229753418241c618ce34f7707b64d56f0f16e8575381a0b01e8cde55731a104a35a34cba5c679c47043e8bb09f2f
MD5 SHA1 SHA512

Submit Download

acjqjbqy.cmdline

Path C:\Users\Admin\AppData\Local\Temp\acjqjbqy.cmdline
Size 174B
SHA256 6513c6b12e4bb5152db366a9f151580db178c9664f27dd518ba1e8ed2792b8a5
MD5 2d3773996ef0eba2960bb8217f7938a0
SHA1 a92d4e4d6ffee4ee75bad1698e7357c46efd10d9
SHA512 4f7aa4220cdb3670f187088fb010bf6cb84792218f33ac5ae0f5f58871b6153244933534ac17ed71a2d870299266ac618653bcae99ee101c70e9abddff93f52a
MD5 SHA1 SHA512

Submit Download

d_ysygcf.0.vb

Path C:\Users\Admin\AppData\Local\Temp\d_ysygcf.0.vb
Size 301B
SHA256 0a563c904f9f4fb91d4decc420e76cad0a2f802451a1c10602b8b3117be8a301
MD5 47d95656f9388d5e4f6e1c602c48ca06
SHA1 ff56a474d3c674f22f915a9489e053ca833b8b2f
SHA512 4a274648130b0d40bd368511cbfdc3e813ea847eb0b4fd7e919d6131a50a005afc6b9a2b112da396b7bc33382cc85a59509ae48131fae3bb8bc2bf514e6bf3bb
MD5 SHA1 SHA512

Submit Download

d_ysygcf.cmdline

Path C:\Users\Admin\AppData\Local\Temp\d_ysygcf.cmdline
Size 171B
SHA256 c5791537c3de29e26515ea1af48abb60853f7f1d9c8f524c70cecf1dcf10687e
MD5 ae7d4675fe754c4c26be53818d5cf9ab
SHA1 20f0365de580ef92a389b2d01c83eda5ec6cfd89
SHA512 136797052d8ef2559f32102cd7ef387dc68303c9619f850e07fa572e15beec3bb58556e36e22299dc256b4a9eb8902713c0b7d0b81187c730abab5f904a0a31a
MD5 SHA1 SHA512

Submit Download

fugptjzp.0.vb

Path C:\Users\Admin\AppData\Local\Temp\fugptjzp.0.vb
Size 218B
SHA256 2ce35fd0b2c5aa514c88f61416dcc4fe37f6b449988a4b960620190ce8ca87d7
MD5 fc21d1773763a696222c7777d0544e40
SHA1 3c46bb126cf95ca8b5a2e867a40e553414a5de00
SHA512 8999e289375a037ba404d1f30d9ef2f33f6bb51ff61bb68845ac421acfa9aa934aca16acd545707d2f132f252c84dbaab1163bf9598879c5c1299751d3c452a0
MD5 SHA1 SHA512

Submit Download

fugptjzp.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fugptjzp.cmdline
Size 216B
SHA256 7d8802fcc8506dccc4063d9e8d045238a54966af8a76b0d82b2261f061f1e64e
MD5 f4cefb9446ebe449ec3c5b5e1edb52ed
SHA1 95d8ba61a49361c2e9b3fbbacc3d36d9e72dd4a9
SHA512 01f8e03156e06c2ab3a893fac10c18531437c2908aad8e45b29ec767672e0cb4eca82598700884c772ab1033585da1eb10ba2dc7818b9ac302262e8dcaab00ef
MD5 SHA1 SHA512

Submit Download

ilhzqkhz.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ilhzqkhz.0.vb
Size 302B
SHA256 7ce30bb37dc992b8beebe64d4809a542ff2afe508ae5acdcc2c209e7968355ff
MD5 ffa9399faf40436a18e1b46f1c582cf0
SHA1 32e79f416b4ea766d957c705fd575ab3897319fd
SHA512 dce5f551841910c5c0df0eb23a073d7823d84d2b3715543c204819b3d22c70b417cf205f338075f4a5309616c91c7d1691f0087cc2d4734329ccef6f675fba89
MD5 SHA1 SHA512

Submit Download

ilhzqkhz.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ilhzqkhz.cmdline
Size 172B
SHA256 2db5eab3f7e4fd05d473264f643ebac80fdbae39148d68ce70059985c9e4c533
MD5 7d3f900a5ef07de945857f2962a74b06
SHA1 278ad81d8b378a95f3b2c8222f1cf60836b0c8b0
SHA512 4592fe5e925ce78f7c4af717b078016d3984a7eae06ba1096fa2073b382f9e50cd199aeed2edceb124e61f995acf962feb1b754af97e43f9b64c5138abed5866
MD5 SHA1 SHA512

Submit Download

jfa313ft.0.vb

Path C:\Users\Admin\AppData\Local\Temp\jfa313ft.0.vb
Size 294B
SHA256 85f6f13ecb42d4415d8d5929d793e038c872bac973f2a4aea2e4ca4673b5fe86
MD5 a6f6d5bed819117a37e2be89b8e63e03
SHA1 bbf25777cdb346f45c00fbb8b6fade9bee6590c7
SHA512 ce893699bf3d39131893d4768e4e881b286a8779b926dc5e1ff25df82a1d899d8ced3132a5b4d69acb14181a524da5467ae32c9f165d7093219ea865f4d8aff9
MD5 SHA1 SHA512

Submit Download

jfa313ft.cmdline

Path C:\Users\Admin\AppData\Local\Temp\jfa313ft.cmdline
Size 164B
SHA256 1053b4dfac2eca797f937e8fb41e534393084ac0054ef8cb3c3cf74a069bd3d3
MD5 c0966751eeb571f83e40c0de78ce57d9
SHA1 abed4d3838e9f6f5e38ad4637a547af937a11071
SHA512 b66c646e63f58ffa93f2492d948e04c119109e933990d2e7ef1408f10211358c658452b8a557b25a244d00d6d46f2e9bbeaa56c500764cbeb85d88dd411a29ba
MD5 SHA1 SHA512

Submit Download

ksjcdikv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ksjcdikv.0.vb
Size 300B
SHA256 5983931487c4a1f4b9f7d937b05a405212d2efc5bf18f04a638457a01683540d
MD5 2e1d49c27d6baa9b3ad357bc22a920a3
SHA1 c4315fc5c5330880b1700660cd31583b2de6a845
SHA512 fca817d30cfd37b50a55318cfe072549043c75f9f82c83dd6700d4ba63a54be20d11bf46c48badf42072ffd5107ec2da21c6d9c2a4df0ffca2743ad5adf3f312
MD5 SHA1 SHA512

Submit Download

ksjcdikv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ksjcdikv.cmdline
Size 170B
SHA256 a4620a0b6ecba3be9f9447bdd6ffe56101514b41da6ae5ced08135a3bec4b0af
MD5 1a7815c8d99f134d3b4b698fb236b460
SHA1 41ec4d6f97fb81e028988a3473b48db5076b1d54
SHA512 2463e83e5cd6ee748a8d9ae42a96a179d94be36814aa87e0f46ac1fc93caa2a6c4521ee5d984c58cd40516214a06a0af6066f19b495fd5f89ed65226db366430
MD5 SHA1 SHA512

Submit Download

ml9bleqv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ml9bleqv.0.vb
Size 303B
SHA256 b3260fe36913c2bf10e77e73d23bd2a715d28a7144b5faaee68152ce4469289d
MD5 6ba302d5bd05c3635068ab9ad6856f98
SHA1 381eeaa6e13513cef25ab2af4375cec6ae02dff5
SHA512 81f6d7fdb7556ea789117a61d6dcf61a5b90c08b4fbd08fc5c0b89b02dfed44e07215e56f8f1b69a16afca72098a1e4c9365ba065554789d2b0effd16b1479e6
MD5 SHA1 SHA512

Submit Download

ml9bleqv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ml9bleqv.cmdline
Size 173B
SHA256 dbc65dcd83668ea2bb9dfa54ff8a2c8d3a985de1d8c2689a9dc840674f4b7781
MD5 4e0097d44d48d7095481f32bc12eb957
SHA1 bd2e79f424a21bf0acb5a0f236053e02c99156da
SHA512 d5824645fdec3d730a909ad3fed78b8184a54b3b2f76d5f5d07fdb4ac72843ad0410eab83e4f5805f48e12b23dca6082c72dafe13c2916294b07756c52b35e94
MD5 SHA1 SHA512

Submit Download

vbc17EAC53CF1EE4E58B6B9268E1337A646.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc17EAC53CF1EE4E58B6B9268E1337A646.TMP
Size 644B
SHA256 2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
MD5 dac60af34e6b37e2ce48ac2551aee4e7
SHA1 968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA512 1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
MD5 SHA1 SHA512

Submit Download

vbc1D01B4FE203140869F17E9B87240AFED.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1D01B4FE203140869F17E9B87240AFED.TMP
Size 676B
SHA256 f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
MD5 85c61c03055878407f9433e0cc278eb7
SHA1 15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA512 7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756
MD5 SHA1 SHA512

Submit Download

vbc8AA358B2642F4FDB93BF2C3D194E2E11.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8AA358B2642F4FDB93BF2C3D194E2E11.TMP
Size 668B
SHA256 0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
MD5 3906bddee0286f09007add3cffcaa5d5
SHA1 0e7ec4da19db060ab3c90b19070d39699561aae2
SHA512 0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
MD5 SHA1 SHA512

Submit Download

vbcA4A4CA47CD1344B999631BF7E88B81F9.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcA4A4CA47CD1344B999631BF7E88B81F9.TMP
Size 732B
SHA256 01a4da2c8dfc942b92d11f4e7ad7d2778cc897656ad6533078157042ffaf8ba9
MD5 d1ab5cd7b8edf473611603f7c0523c86
SHA1 9735a5ee3505c8d44491ff5fc329ad1de7926c81
SHA512 eeb2ef49281d2469e23340ddc195defa178a8aaed59147f0213904232bd09d8a46022eb16785e609589861082395dc7546ba0c2181418c421b959001922925c9
MD5 SHA1 SHA512

Submit Download

vbcCFF06EA1CA0F4D2CA2D24E83583DC1AF.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcCFF06EA1CA0F4D2CA2D24E83583DC1AF.TMP
Size 684B
SHA256 e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
MD5 8135713eeb0cf1521c80ad8f3e7aad22
SHA1 1628969dc6256816b2ab9b1c0163fcff0971c154
SHA512 a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4
MD5 SHA1 SHA512

Submit Download

vbcFEE65367B34A529C4565FD57446D0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcFEE65367B34A529C4565FD57446D0.TMP
Size 684B
SHA256 453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
MD5 7a707b422baa7ca0bc8883cbe68961e7
SHA1 addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA512 81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
MD5 SHA1 SHA512

Submit Download

w8eqb3ke.0.vb

Path C:\Users\Admin\AppData\Local\Temp\w8eqb3ke.0.vb
Size 286B
SHA256 1e50f9d0a9432a9b1c5ef6bce47bc1f244b805285d407ffaa4b35997b882eee9
MD5 e27ddcebf38139054a7eed42335b9d22
SHA1 16b4d7a12b3768219d4bfcd90cc5e0b65fe64149
SHA512 89f4f3ea3052c813b5dbc01c8a6294bf02fa5d056c7e5b6232be0e42f727807b303e5f140b3e4bdf6a479f0786f28732fd361a944ae45c5d987414d342acce33
MD5 SHA1 SHA512

Submit Download

w8eqb3ke.cmdline

Path C:\Users\Admin\AppData\Local\Temp\w8eqb3ke.cmdline
Size 156B
SHA256 b983a4a74bda0ca103fcfca9136e5dbf3b3d32f7d93b685af5ea43daadf3f187
MD5 8e6c44537c2b62dbdd4b809c009ae18b
SHA1 5c444f57cef336edb877746b8e468c5b86720d7f
SHA512 72ddb5001cbc69c1cb1bc0a7ecaa0500ef3865818cf6c07ac1aff3c187e3d4bf2d31e9f6a63c381f5a8c4333d9ebfb90302960a935a94b61139748e6847a0a5d
MD5 SHA1 SHA512

Submit Download

Service Host Network Service.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Service Host Network Service.exe
Size 144KB
SHA256 d34a32b1c044553ab8b803f4370526f7a73d1cb519adcaec91b2c10efaa556b3
MD5 0371221c3aa1147d1009f0d0b1bf22e8
SHA1 5f33bcfe0070b7ac3b4d527103bb4a9385603de3
SHA512 a42bb69676da8c267a8f5b472cbba1ba408a553f919d8536f0a4e8054da914b5aa34089744301acf9eb5d993881955dda478ee2c5b663a945c8aafccef1a9eab
SSDEEP 1536:8qJo6rUcu/rbPm8J+Ud+kR2qBa5z17gm6zG:8SRw+Ud+kRBBa5yjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/260-126-0x0000000002510000-0x0000000002520000-memory.dmp

Download

memory/1264-10-0x0000000001110000-0x0000000001120000-memory.dmp

Download

memory/1264-0-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1264-1-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1264-2-0x0000000001110000-0x0000000001120000-memory.dmp

Download

memory/1264-25-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1264-9-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1264-8-0x000000001BBB0000-0x000000001BC12000-memory.dmp

Download

memory/1264-3-0x000000001B8E0000-0x000000001B986000-memory.dmp

Download

memory/1264-7-0x000000001D410000-0x000000001D8DE000-memory.dmp

Download

memory/1264-6-0x00000000011E0000-0x00000000011EA000-memory.dmp

Download

memory/1264-5-0x000000001C630000-0x000000001CB3E000-memory.dmp

Download

memory/1264-4-0x0000000001190000-0x0000000001198000-memory.dmp

Download

memory/1644-34-0x0000000002380000-0x0000000002390000-memory.dmp

Download

memory/1700-111-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/1780-141-0x00000000023C0000-0x00000000023D0000-memory.dmp

Download

memory/1844-24-0x00000000010D0000-0x00000000010E0000-memory.dmp

Download

memory/1844-42-0x00000000010D0000-0x00000000010E0000-memory.dmp

Download

memory/1844-26-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1844-23-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1844-29-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1844-28-0x00000000010D0000-0x00000000010E0000-memory.dmp

Download

memory/1844-27-0x00007FF8A2100000-0x00007FF8A2AA1000-memory.dmp

Download

memory/1844-166-0x00000000010D0000-0x00000000010E0000-memory.dmp

Download

memory/2296-52-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/2444-157-0x00000000022B0000-0x00000000022C0000-memory.dmp

Download

memory/3976-96-0x0000000002520000-0x0000000002530000-memory.dmp

Download

memory/4456-66-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

Download

memory/4584-81-0x00000000022E0000-0x00000000022F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads