Malware Analysis Report

2024-09-22 23:57

Sample ID 240417-sae5msda99
Target cbfb91e9f660870d7b99000a18370afb635fbc17d579441de7091a9c9bcc153f
SHA256 cbfb91e9f660870d7b99000a18370afb635fbc17d579441de7091a9c9bcc153f
Tags
asyncrat stormkitty default rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cbfb91e9f660870d7b99000a18370afb635fbc17d579441de7091a9c9bcc153f

Threat Level: Known bad

The file cbfb91e9f660870d7b99000a18370afb635fbc17d579441de7091a9c9bcc153f was found to be: Known bad.

Malicious Activity Summary

asyncrat stormkitty default rat stealer

AsyncRat

StormKitty payload

StormKitty

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Looks up geolocation information via web service

Drops desktop.ini file(s)

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Gathers network information

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-04-17 14:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-17 14:55

Reported

2024-04-17 14:58

Platform

win7-20240221-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\6187b61fb25af42b5650a81361798a51\Admin@KXIPPCKF_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6187b61fb25af42b5650a81361798a51\Admin@KXIPPCKF_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6187b61fb25af42b5650a81361798a51\Admin@KXIPPCKF_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6187b61fb25af42b5650a81361798a51\Admin@KXIPPCKF_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\6187b61fb25af42b5650a81361798a51\Admin@KXIPPCKF_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\6187b61fb25af42b5650a81361798a51\Admin@KXIPPCKF_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1300 set thread context of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1400 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 1400 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 1400 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 1400 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 2504 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2796 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 3052 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 3052 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 3052 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 3052 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2796 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2796 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2796 wrote to memory of 1916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3052 wrote to memory of 1300 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 3052 wrote to memory of 1300 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 3052 wrote to memory of 1300 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 3052 wrote to memory of 1300 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 2504 wrote to memory of 2188 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2188 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2188 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 2188 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2188 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2188 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2188 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1300 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 372 wrote to memory of 1616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 372 wrote to memory of 1616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 372 wrote to memory of 1616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 372 wrote to memory of 1616 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1616 wrote to memory of 2880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1616 wrote to memory of 2880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1616 wrote to memory of 2880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1616 wrote to memory of 2880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1616 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1616 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1616 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1616 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1616 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1616 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1616 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1616 wrote to memory of 1112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 372 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 372 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 372 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 372 wrote to memory of 1752 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1752 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1752 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1752 wrote to memory of 2060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1752 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1752 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1752 wrote to memory of 1384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe

"C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xikg.vbe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /release

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c swbglvlssx.bmp vcpadlxuao.dat

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /release

C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp

swbglvlssx.bmp vcpadlxuao.dat

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /renew

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /renew

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
US 8.8.8.8:53 apps.identrust.com udp
IE 2.18.24.8:80 apps.identrust.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xikg.vbe

MD5 5ae9f9fdd5c7d683b7f9f2ea276b2fb7
SHA1 a71eed0968de9caf7636a1c81322f27588af0546
SHA256 b1b3fd9a4ae874afe1ac1af617d6e7210dfe831a9057bbebdf74f3086f5af8b1
SHA512 49343720b71d35fd28d0567b751a01e0d504204845930caa0cec3879f95c056703894e0579fd4d7f75c763f382323b66f259c6a3c1959b26b7a0a44316f50f2b

\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp

MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcpadlxuao.dat

MD5 aa1915f975679c2099d0a9fdacabfd85
SHA1 6fa5f8a05ad8b06b4a4464560c669c1067cb8f4a
SHA256 48842b595e9dfa512f008c6d77520c4cfdea84c16336a2f1c5003f1964b0d8da
SHA512 67b016129ec10111c81f25f922369eaae486437ad6614f5cfb0339e260d29f2e27010f0ec14addd2d7aa8212bfa783740f9989284ee175524da349a1b198ad9b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anrpi.3gp

MD5 406db994bb11c5320a6d2780c8af9419
SHA1 10503f33ae662a8eb92dc3198ffc074cc736b24c
SHA256 ee4366252ab52d6c079246c14d9407457a91a64065816ac2c26acc2582c41fd2
SHA512 1a5e66f74f7112e2e0cdec4d5e997c02656efb0182b1c1aa292437eb711046c3b110a8adb548d603f17d67c764b1aa5f189408050cc6478ad38bcfe238342e72

C:\Users\Admin\AppData\Local\Temp\RarSFX0\qwjwmi.lsc

MD5 042b73b18e96dd8e5848507d7ac60ddc
SHA1 cc789c7fca70c7a2cb3666a4c691cfafa74f3cb2
SHA256 d5f12fabd9bab67d33cf3e26a325c7f720dc9d58b505605c5b17a2e26b7b7437
SHA512 8c9bd44c14960f587abc387fe817be479e02c2b7c503b849d441101f2f248460d0452040f646c1832b19a5690db47b43687250e295835abe7cee4900f0768969

memory/372-74-0x0000000001170000-0x0000000002170000-memory.dmp

memory/372-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/372-77-0x0000000001170000-0x0000000002170000-memory.dmp

memory/372-79-0x0000000001170000-0x0000000002170000-memory.dmp

memory/372-81-0x0000000001170000-0x0000000002170000-memory.dmp

memory/372-82-0x0000000001170000-0x00000000011A0000-memory.dmp

memory/372-83-0x0000000073100000-0x00000000737EE000-memory.dmp

memory/372-84-0x0000000000D20000-0x0000000000D60000-memory.dmp

memory/372-179-0x0000000000D20000-0x0000000000D60000-memory.dmp

memory/372-183-0x0000000073100000-0x00000000737EE000-memory.dmp

memory/372-184-0x0000000000D20000-0x0000000000D60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab4543.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar5284.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\Local\88aae9043eb411c41390c3c6f32b12ab\msgid.dat

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/372-267-0x0000000000D20000-0x0000000000D60000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-17 14:55

Reported

2024-04-17 14:59

Platform

win10v2004-20240412-en

Max time kernel

169s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe"

Signatures

AsyncRat

rat asyncrat

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
File created C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3096 set thread context of 4916 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3252 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 3252 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 3252 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe C:\Windows\SysWOW64\WScript.exe
PID 3712 wrote to memory of 3896 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 3896 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 3896 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 1520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 1520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 1520 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3896 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3896 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3896 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 1520 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 1520 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 1520 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp
PID 3712 wrote to memory of 4620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 4620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3712 wrote to memory of 4620 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3096 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3096 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3096 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4620 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 4620 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 4620 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 3096 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3096 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4916 wrote to memory of 3508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3508 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 3508 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3508 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3508 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3508 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3508 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3508 wrote to memory of 4516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3508 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3508 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 3508 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4916 wrote to memory of 3744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3744 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3744 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3744 wrote to memory of 1252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3744 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3744 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3744 wrote to memory of 1004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe

"C:\Users\Admin\AppData\Local\Temp\c6f6a21328d5e291f331c4283fb3d4ed13499a1de87f773734c09ba0ccbd72be.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xikg.vbe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /release

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c swbglvlssx.bmp vcpadlxuao.dat

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /release

C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp

swbglvlssx.bmp vcpadlxuao.dat

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ipconfig /renew

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /renew

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 163.233.34.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
NL 52.111.243.31:443 tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.184.16.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 66.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:7707 tcp
US 8.8.8.8:53 25.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:7707 tcp
N/A 127.0.0.1:8808 tcp
N/A 127.0.0.1:6606 tcp
N/A 127.0.0.1:6606 tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xikg.vbe

MD5 5ae9f9fdd5c7d683b7f9f2ea276b2fb7
SHA1 a71eed0968de9caf7636a1c81322f27588af0546
SHA256 b1b3fd9a4ae874afe1ac1af617d6e7210dfe831a9057bbebdf74f3086f5af8b1
SHA512 49343720b71d35fd28d0567b751a01e0d504204845930caa0cec3879f95c056703894e0579fd4d7f75c763f382323b66f259c6a3c1959b26b7a0a44316f50f2b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\swbglvlssx.bmp

MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcpadlxuao.dat

MD5 aa1915f975679c2099d0a9fdacabfd85
SHA1 6fa5f8a05ad8b06b4a4464560c669c1067cb8f4a
SHA256 48842b595e9dfa512f008c6d77520c4cfdea84c16336a2f1c5003f1964b0d8da
SHA512 67b016129ec10111c81f25f922369eaae486437ad6614f5cfb0339e260d29f2e27010f0ec14addd2d7aa8212bfa783740f9989284ee175524da349a1b198ad9b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\anrpi.3gp

MD5 406db994bb11c5320a6d2780c8af9419
SHA1 10503f33ae662a8eb92dc3198ffc074cc736b24c
SHA256 ee4366252ab52d6c079246c14d9407457a91a64065816ac2c26acc2582c41fd2
SHA512 1a5e66f74f7112e2e0cdec4d5e997c02656efb0182b1c1aa292437eb711046c3b110a8adb548d603f17d67c764b1aa5f189408050cc6478ad38bcfe238342e72

C:\Users\Admin\AppData\Local\Temp\RarSFX0\qwjwmi.lsc

MD5 042b73b18e96dd8e5848507d7ac60ddc
SHA1 cc789c7fca70c7a2cb3666a4c691cfafa74f3cb2
SHA256 d5f12fabd9bab67d33cf3e26a325c7f720dc9d58b505605c5b17a2e26b7b7437
SHA512 8c9bd44c14960f587abc387fe817be479e02c2b7c503b849d441101f2f248460d0452040f646c1832b19a5690db47b43687250e295835abe7cee4900f0768969

memory/4916-73-0x0000000000D70000-0x0000000001D70000-memory.dmp

memory/4916-74-0x0000000000D70000-0x0000000000DA0000-memory.dmp

memory/4916-75-0x00000000728B0000-0x0000000073060000-memory.dmp

memory/4916-76-0x000000000D0C0000-0x000000000D0D0000-memory.dmp

memory/4916-104-0x000000000D440000-0x000000000D4A6000-memory.dmp

memory/4916-171-0x00000000728B0000-0x0000000073060000-memory.dmp

memory/4916-205-0x000000000D0C0000-0x000000000D0D0000-memory.dmp

C:\Users\Admin\AppData\Local\b9bc7084975ee05e71a887511fd8e822\Admin@GYXYZBUQ_en-US\System\Process.txt

MD5 e36752f1bb132552c7b7d08eb5b6ff18
SHA1 a6a8e2719d5ec3c4d803c369a3cedb301323b1a8
SHA256 4d6c7d7f0a60ee48c38737ac83313cc5b0f6868db0f99b28c35d228a31fa737c
SHA512 6c245771ee67ffbc8e411fb81a5f7e31c01a7931713e6014e51c3c6a8077d56b7a543ecb17cf48bee80883bf1a94b901475b7b4c4f40c291d157b335bbfa5703

memory/4916-248-0x000000000D0C0000-0x000000000D0D0000-memory.dmp

memory/4916-250-0x000000000DFB0000-0x000000000E042000-memory.dmp

memory/4916-251-0x000000000E600000-0x000000000EBA4000-memory.dmp

memory/4916-255-0x000000000E0B0000-0x000000000E0BA000-memory.dmp

C:\Users\Admin\AppData\Local\03c164f6b151f39fecacc790fef4edc5\msgid.dat

MD5 7c4ede33a62160a19586f6e26eaefacf
SHA1 db8770342fdf063d3128150901ea357f68bb9001
SHA256 41e32284df1a73272655a26bfe6d4919ed6504972cc47461330a26e90cd9ddc3
SHA512 6d7f64fcddff389eb6251671e1c53d761e0d21b0e7a4fe4c872ed60f80f11fa97f18b5799435da306820cbf33dc88d94f0e6a707bcc834051101230f752be974

memory/4916-261-0x000000000D870000-0x000000000D882000-memory.dmp

memory/4916-286-0x000000000D0C0000-0x000000000D0D0000-memory.dmp