xworm | 66bc491ac60ff2af35a6b35984b68b5054b8f70b30c1b9e07d1c4e3163fdf767

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11484da8db8f1bbeaff9b8b4b7387e7d.exe
Size 535KB
Sample240503-en3wzaef51
SHA256 66bc491ac60ff2af35a6b35984b68b5054b8f70b30c1b9e07d1c4e3163fdf767
MD5 11484da8db8f1bbeaff9b8b4b7387e7d
SHA1 8604e6082a89f9731beba669de3520788dd70d6a
SHA512 54fabcf2e5e10c73eff2552b1390e849d385b174995eb0dee5c71c8d8395cd58bc89c8eaa78f73dad8e0f95048f951fb24e0e06877ec5be6738af28b730d7f53
SSDEEP 6144:MoEjg84W5xNSuIdNqqS+lsrKAe3Y8l/v:QgE5xwuIKp+N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

logo-active.gl.at.ply.gg:25835
your-purchasing.gl.at.ply.gg:35731

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002168f-7.dat	family_xworm
behavioral2/files/0x0031000000023bbc-23.dat	family_xworm
behavioral2/memory/4440-33-0x0000000000600000-0x0000000000616000-memory.dmp	family_xworm
behavioral2/memory/348-32-0x00000000008F0000-0x0000000000906000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3324	powershell.exe
2460	powershell.exe
3048	powershell.exe
2708	powershell.exe
2384	powershell.exe
208	powershell.exe
668	powershell.exe
1188	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	11484da8db8f1bbeaff9b8b4b7387e7d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	System.exe

Executes dropped EXE 7 IoCs

pid	Process
348	System.exe
3016	abobus.exe
4440	svchost.exe
2924	svchost.exe
2508	System.exe
3364	svchost.exe
4224	System.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe"	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5076	schtasks.exe
2552	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1636	tasklist.exe

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery

T1018

pid	Process
3000	PING.EXE
3860	PING.EXE
4268	PING.EXE
4408	PING.EXE
2084	PING.EXE
3244	PING.EXE
4532	PING.EXE
2432	PING.EXE
3496	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
668	powershell.exe
668	powershell.exe
208	powershell.exe
208	powershell.exe
668	powershell.exe
208	powershell.exe
1188	powershell.exe
1188	powershell.exe
1188	powershell.exe
3324	powershell.exe
3324	powershell.exe
3324	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2708	powershell.exe
2708	powershell.exe
3048	powershell.exe
3048	powershell.exe
2708	powershell.exe
3048	powershell.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe
4440	svchost.exe
348	System.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	348	System.exe
Token: SeDebugPrivilege	4440	svchost.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	4440	svchost.exe
Token: SeDebugPrivilege	348	System.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	2924	svchost.exe
Token: SeDebugPrivilege	2508	System.exe
Token: SeDebugPrivilege	3364	svchost.exe
Token: SeDebugPrivilege	4224	System.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4440	svchost.exe
348	System.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 348	4468	11484da8db8f1bbeaff9b8b4b7387e7d.exe	84
PID 4468 wrote to memory of 348	4468	11484da8db8f1bbeaff9b8b4b7387e7d.exe	84
PID 4468 wrote to memory of 3016	4468	11484da8db8f1bbeaff9b8b4b7387e7d.exe	85
PID 4468 wrote to memory of 3016	4468	11484da8db8f1bbeaff9b8b4b7387e7d.exe	85
PID 4468 wrote to memory of 4440	4468	11484da8db8f1bbeaff9b8b4b7387e7d.exe	86
PID 4468 wrote to memory of 4440	4468	11484da8db8f1bbeaff9b8b4b7387e7d.exe	86
PID 3016 wrote to memory of 3916	3016	abobus.exe	88
PID 3016 wrote to memory of 3916	3016	abobus.exe	88
PID 3916 wrote to memory of 2264	3916	cmd.exe	89
PID 3916 wrote to memory of 2264	3916	cmd.exe	89
PID 3916 wrote to memory of 3000	3916	cmd.exe	90
PID 3916 wrote to memory of 3000	3916	cmd.exe	90
PID 3916 wrote to memory of 3244	3916	cmd.exe	93
PID 3916 wrote to memory of 3244	3916	cmd.exe	93
PID 3916 wrote to memory of 3860	3916	cmd.exe	97
PID 3916 wrote to memory of 3860	3916	cmd.exe	97
PID 348 wrote to memory of 208	348	System.exe	99
PID 348 wrote to memory of 208	348	System.exe	99
PID 4440 wrote to memory of 668	4440	svchost.exe	100
PID 4440 wrote to memory of 668	4440	svchost.exe	100
PID 4440 wrote to memory of 1188	4440	svchost.exe	104
PID 4440 wrote to memory of 1188	4440	svchost.exe	104
PID 3916 wrote to memory of 4532	3916	cmd.exe	105
PID 3916 wrote to memory of 4532	3916	cmd.exe	105
PID 348 wrote to memory of 3324	348	System.exe	108
PID 348 wrote to memory of 3324	348	System.exe	108
PID 4440 wrote to memory of 2460	4440	svchost.exe	110
PID 4440 wrote to memory of 2460	4440	svchost.exe	110
PID 348 wrote to memory of 3048	348	System.exe	112
PID 348 wrote to memory of 3048	348	System.exe	112
PID 4440 wrote to memory of 2708	4440	svchost.exe	114
PID 4440 wrote to memory of 2708	4440	svchost.exe	114
PID 348 wrote to memory of 2384	348	System.exe	116
PID 348 wrote to memory of 2384	348	System.exe	116
PID 3916 wrote to memory of 2432	3916	cmd.exe	118
PID 3916 wrote to memory of 2432	3916	cmd.exe	118
PID 4440 wrote to memory of 5076	4440	svchost.exe	120
PID 4440 wrote to memory of 5076	4440	svchost.exe	120
PID 3916 wrote to memory of 4268	3916	cmd.exe	122
PID 3916 wrote to memory of 4268	3916	cmd.exe	122
PID 348 wrote to memory of 2552	348	System.exe	123
PID 348 wrote to memory of 2552	348	System.exe	123
PID 3916 wrote to memory of 3496	3916	cmd.exe	126
PID 3916 wrote to memory of 3496	3916	cmd.exe	126
PID 3916 wrote to memory of 4408	3916	cmd.exe	127
PID 3916 wrote to memory of 4408	3916	cmd.exe	127
PID 3916 wrote to memory of 2084	3916	cmd.exe	128
PID 3916 wrote to memory of 2084	3916	cmd.exe	128
PID 3916 wrote to memory of 1636	3916	cmd.exe	130
PID 3916 wrote to memory of 1636	3916	cmd.exe	130
PID 3916 wrote to memory of 1192	3916	cmd.exe	131
PID 3916 wrote to memory of 1192	3916	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\11484da8db8f1bbeaff9b8b4b7387e7d.exe
"C:\Users\Admin\AppData\Local\Temp\11484da8db8f1bbeaff9b8b4b7387e7d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\System.exe
  "C:\Users\Admin\AppData\Local\Temp\System.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2552
- C:\Users\Admin\AppData\Local\Temp\abobus.exe
  "C:\Users\Admin\AppData\Local\Temp\abobus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4565.tmp\4566.tmp\4567.bat C:\Users\Admin\AppData\Local\Temp\abobus.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2264
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3000
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3244
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3860
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4532
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2432
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4268
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3496
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4408
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2084
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1636
  - - C:\Windows\system32\find.exe
      find /i "cs2.exe"
      4⤵
      PID:1192
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:5076

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\AppData\Roaming\System.exe
C:\Users\Admin\AppData\Roaming\System.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Users\Admin\AppData\Roaming\System.exe
C:\Users\Admin\AppData\Roaming\System.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
MD5 a43e653ffb5ab07940f4bdd9cc8fade4
SHA1 af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA512 62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
MD5 SHA1 SHA512

Submit Download

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 1b407adb428381b328c00a5dc3f2817cfa6a88f8d7566aea0ef2638ad05f611d
MD5 19e3446e5131ffc8654c075ae8beda24
SHA1 bc85831fdbfdf20f74929bbad25aeaddf8d1dfb1
SHA512 6a190badc5d0f1b16a4b428336cf33d75a1169c526a3682611265b7f1d577632bbbd869db34f421cfb73a380dbabd539d41365921bec658746f58799bf323fc2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 fff934d70d813381536d272c5b8ac6ad70acd054267b13592da767c9bd1dda62
MD5 993af531f0b57e8128ec273731c3a8e2
SHA1 a42ea55876f4f390837dd2c95fb7ff2344b6e9e1
SHA512 bdf5970ff2ee314dc297fce5c0f44765e77acbf269cd9ad9e7448a391d5f80d66a0c5426f99bc3480851e8763413aa180b3b3b6b22ef0e86a365450cb8c334e4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def
MD5 SHA1 SHA512

Submit Download

4567.bat

Path C:\Users\Admin\AppData\Local\Temp\4565.tmp\4566.tmp\4567.bat
Size 712B
SHA256 f60f30bb535beec466c0ccaee0fefa3d14efe9f5a52031206e1bbe3f64b26390
MD5 1c6d570cacfeda450549313478b0c5e0
SHA1 c914ab0dadf9b782ffd47cf42305ec0b5228ffb5
SHA512 f0203662b33ce4efdb2458fac762b3ab24e799d676ed2b79d75c32486861a3206e0558212ddd14a1bf60cf28ea84409868d79cd5f14333d391b68af16c4280a0
MD5 SHA1 SHA512

Submit Download

System.exe

Path C:\Users\Admin\AppData\Local\Temp\System.exe
Size 65KB
SHA256 a28a54a0a3b3d502c2f7aecf1f9109f61cfa822e0ccc1f3ef67250baa12d49db
MD5 d4195c5da221fd57c3fa82c51c73fc4d
SHA1 f253e51c33874bf1f7bd55f21122bdd77e4c4ea4
SHA512 0af7e1cd86cd249d1ab8d170b47de0ee2669ea55537f56a6958560be74769b299a3f71ab717693689d9014e2187c70a6ca490e0f94d0c6f452a91924c96a766e
SSDEEP 1536:vjSeu8j4OqsyojkGO1+bnBW/Qj6SwO/nNF0irG86:OV8dDjpO1+bnBWY/wOfbx6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_mhkhom4f.3xl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhkhom4f.3xl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

abobus.exe

Path C:\Users\Admin\AppData\Local\Temp\abobus.exe
Size 122KB
SHA256 672e9ece4c044fe3c385d49bbc35b52c4348f170bb7de7963a9f1e709f8a089b
MD5 588625ea18fb70571c443a739fa75bad
SHA1 9ce88840d71ea3f011595e22f13651df5cdaf971
SHA512 917d9a54170cbce7238227207b386342f03be71fc5339b66713b63ed4584d1d972e491fffbe9cea5b2ed3c3b417409bf8da1672bb1711b5d2c93bacdb3c2cb33
SSDEEP 3072:I/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSA2:jtzsb5Uh28+V1WW69B9VjMdxPedN9ug3
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 66KB
SHA256 6b129d4a5aa3cc91abc19dae5922f857282d4c37e7f23df626d9b9ca8f845061
MD5 a788becf083156d7fac2be10c6d08d4e
SHA1 4ff004a365b01bd590667baf797d906a927ca218
SHA512 ac868aa2b3091a5eb1672fbb44aff879666d73753ef6e39ca8781759905064c594c265a2411b6dfde122b821fab2225c577d0de1a28606dd39b8318c5f0055d4
SSDEEP 1536:WfDhfoFRbIn/yNMZ2Mh+bT/mkJD8a6KcUVOxHByW:atIBLg2E+bT/9O9UVOxHL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/348-34-0x00007FFA085D0000-0x00007FFA09091000-memory.dmp

Download

memory/348-32-0x00000000008F0000-0x0000000000906000-memory.dmp

Download

memory/348-131-0x00007FFA085D0000-0x00007FFA09091000-memory.dmp

Download

memory/668-57-0x000002A1B0D00000-0x000002A1B0D22000-memory.dmp

Download

memory/4440-37-0x00007FFA085D0000-0x00007FFA09091000-memory.dmp

Download

memory/4440-33-0x0000000000600000-0x0000000000616000-memory.dmp

Download

memory/4440-132-0x00007FFA085D0000-0x00007FFA09091000-memory.dmp

Download

memory/4468-0-0x0000000000D00000-0x0000000000D8C000-memory.dmp

Download

memory/4468-1-0x00007FFA085D3000-0x00007FFA085D5000-memory.dmp

Download