Malware Analysis Report

2024-11-30 20:07

Sample ID 240509-b91rysee64
Target a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe
SHA256 a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a
Tags
zgrat evasion rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a

Threat Level: Known bad

The file a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe was found to be: Known bad.

Malicious Activity Summary

zgrat evasion rat spyware stealer

Detect ZGRat V1

ZGRat

Detects executables packed with unregistered version of .NET Reactor

Disables Task Manager via registry modification

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 01:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 01:51

Reported

2024-05-09 01:54

Platform

win7-20240221-en

Max time kernel

120s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Detects executables packed with unregistered version of .NET Reactor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Journal\WmiPrvSE.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\Windows Journal\24dbde2999530e C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\System.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\System.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\27d1bcfc3c54e0 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\Microsoft Office\Office14\WmiPrvSE.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\Microsoft Office\Office14\24dbde2999530e C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Downloaded Program Files\886983d96e3d3e C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Windows\Downloaded Program Files\csrss.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\VideoLAN\VLC\lua\System.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1284 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 1284 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 1284 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 1284 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 2264 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2264 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2264 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2264 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2676 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 564 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 564 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 564 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 564 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 564 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 564 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 564 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 564 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 564 wrote to memory of 2408 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 2408 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 2408 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 2408 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 2412 wrote to memory of 2700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2412 wrote to memory of 2700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2412 wrote to memory of 2700 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 2412 wrote to memory of 2744 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2412 wrote to memory of 2744 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2412 wrote to memory of 2744 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2412 wrote to memory of 1036 N/A C:\Windows\System32\cmd.exe C:\Program Files\VideoLAN\VLC\lua\System.exe
PID 2412 wrote to memory of 1036 N/A C:\Windows\System32\cmd.exe C:\Program Files\VideoLAN\VLC\lua\System.exe
PID 2412 wrote to memory of 1036 N/A C:\Windows\System32\cmd.exe C:\Program Files\VideoLAN\VLC\lua\System.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

"C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat" "

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

"C:\Users\Admin\AppData\Roaming\componentRuntimehost/BridgeChainportWebInto.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6ONt7i6u8S.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\VideoLAN\VLC\lua\System.exe

"C:\Program Files\VideoLAN\VLC\lua\System.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 065963cm.nyashkoon.top udp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp

Files

memory/1284-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

memory/1284-1-0x00000000009C0000-0x0000000000FE6000-memory.dmp

memory/1284-3-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

MD5 7909ebef4dcca4c12310ea3acd8f53f7
SHA1 d5e5c0210bd384378f24e9f9209124d4af6d3da7
SHA256 8eabb7d40887e02b4aa9933fdca0d5ee1d46a5a26a69a4da9279b6819742121a
SHA512 ec85375ea50bfa391120f6e8402bf8bfe34afefebfec8616dad3a76becbd73e1eca8bbaed1fb010de76d0e8f0ba34641ad4cb8f8a7a234050a13fca5bf1131cb

memory/1284-11-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe

MD5 cf441f15daf3339180706cf594e97131
SHA1 ca5663745d79bd9196fea24b51d6061f79355d3c
SHA256 9a2afde59f2326a4cfbc827e87c7270da20d4a6e19e8d00b5b3a479c26f8ad13
SHA512 37d2b08ca78ee06fbcc93577a31a243670fd4efce506449e2e4e3b33c2319081e1f905f8651a642112386620f6551c1a598cdc7f69e682ee252fddc2fa9cde74

C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat

MD5 f4846b111f4c8ced35bf1ed60502270f
SHA1 625bb8296688ca9cde0c60c60cc17ed83383050c
SHA256 2b20a48f281b60176569332a9e56f5aa7911ba9793f87f9729aafc81aab5a6cd
SHA512 ef77a850b15f988754eb17c48ce84e15bcf824c4bcc64ac7f5f372f86fee5738de67417fd0cf56271d1701b5256edcf4ad8603b5fab28016af8e28359967df67

\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

MD5 51a33d556ce031ad0a5e752f10b00a13
SHA1 f05e11e3034481de8590ee4afd912628cacfde9a
SHA256 eab0d35dc956885b222e69fde419f3974db712c98bbb23f41325388bde0cc341
SHA512 c27a18ebee3e32854e4ad136c3af7de753764a9b44fc024487eb4a197a3f68b506f8578c4beab63e23c64b4e8ce10d63d2987b78175a9691e9aec9fc13887356

memory/2408-25-0x0000000000060000-0x00000000003CA000-memory.dmp

memory/2408-27-0x0000000000780000-0x00000000007A6000-memory.dmp

memory/2408-29-0x0000000000760000-0x000000000076E000-memory.dmp

memory/2408-31-0x0000000000A90000-0x0000000000AAC000-memory.dmp

memory/2408-33-0x0000000000770000-0x0000000000780000-memory.dmp

memory/2408-35-0x0000000000AB0000-0x0000000000AC8000-memory.dmp

memory/2408-37-0x00000000007B0000-0x00000000007C0000-memory.dmp

memory/2408-39-0x00000000008D0000-0x00000000008E0000-memory.dmp

memory/2408-41-0x00000000008E0000-0x00000000008EE000-memory.dmp

memory/2408-43-0x0000000002390000-0x00000000023A2000-memory.dmp

memory/2408-45-0x00000000022F0000-0x0000000002300000-memory.dmp

memory/2408-47-0x00000000024D0000-0x00000000024E6000-memory.dmp

memory/2408-49-0x00000000024F0000-0x0000000002502000-memory.dmp

memory/2408-51-0x0000000002300000-0x0000000002310000-memory.dmp

memory/2408-53-0x00000000023B0000-0x00000000023C0000-memory.dmp

memory/2408-55-0x000000001AE40000-0x000000001AE9A000-memory.dmp

memory/2408-57-0x00000000023C0000-0x00000000023CE000-memory.dmp

memory/2408-59-0x000000001ADE0000-0x000000001ADF8000-memory.dmp

memory/2408-61-0x0000000002510000-0x000000000251C000-memory.dmp

memory/2408-63-0x000000001AFF0000-0x000000001B03E000-memory.dmp

C:\Windows\Downloaded Program Files\csrss.exe

MD5 6dc9114e994d3772fdb05caa7a1a41ab
SHA1 1cad245e2a1382953284a34ec7a4d58aa33a5b83
SHA256 0fe07459060e3fb8c153c76536eae3d7b7f4cfb62389225517411b0e5263940e
SHA512 4c3b38f18e9602afeb6aa42cdedbf40e01ad3da45e4e9637544e442576091e1a8b7c0a3059e302676f8f32fe6f46b1e4c4f97dd69fbd78822b8dc153f040049b

C:\Users\Admin\AppData\Local\Temp\6ONt7i6u8S.bat

MD5 37e29bb5e3b92806134e6e877e893519
SHA1 8e4bcfb072f952e7c8f770ad4fc176918d825ae0
SHA256 0459bcf60cbc01cb8b09693faccd2944ff2f2297d4213d3df20267d126c0d205
SHA512 1e9bc39c69fe8855d7338890b83c09b72dfc573dd72594e2a5365c707270fbc477b3fd8151242c03b45abb9555c6dab5b08be81c8ded21b4acfdf014f9c2d0f8

memory/1036-82-0x0000000000090000-0x00000000003FA000-memory.dmp

C:\Program Files\VideoLAN\VLC\lua\System.exe

MD5 4daa6418e407f8357916b02dc665c5a0
SHA1 11a70eb3a617bb14398ea0998d43aa336082232f
SHA256 505a811646b2dceaf90092c38b1ff0dd71745c1a876d8d3feba49276307800a6
SHA512 b50ec4b06f0b4a1ca07431d50bcaf73c0aff9423271a4f96fba3f1802c49beec0ef94c936d9e183c6f199ca57f579f25fe23081f37e3cd8288163245fde914ab

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 01:51

Reported

2024-05-09 01:54

Platform

win10v2004-20240226-en

Max time kernel

143s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Detects executables packed with unregistered version of .NET Reactor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\sr-Latn-RS\SearchApp.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Windows\SysWOW64\sr-Latn-RS\38384e6a620884 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\61a52ddc9dd915 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\e6c9b481da804f C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\msedge.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\fr-FR\lsass.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Windows\fr-FR\6203df4a6bafc7 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3488 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 3488 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 3488 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 3196 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 3196 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 3196 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 368 wrote to memory of 1408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 368 wrote to memory of 1408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 368 wrote to memory of 1408 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1408 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1408 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1408 wrote to memory of 4720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1408 wrote to memory of 3800 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 1408 wrote to memory of 3800 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 3800 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 3800 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 4868 wrote to memory of 3268 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 4868 wrote to memory of 3268 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 4868 wrote to memory of 660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 4868 wrote to memory of 660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 4868 wrote to memory of 4500 N/A C:\Windows\System32\cmd.exe C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe
PID 4868 wrote to memory of 4500 N/A C:\Windows\System32\cmd.exe C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

"C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat" "

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

"C:\Users\Admin\AppData\Roaming\componentRuntimehost/BridgeChainportWebInto.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VTwnNdY7rx.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe

"C:\Program Files\WindowsPowerShell\Modules\OfficeClickToRun.exe"

Network

Country Destination Domain Proto
GB 216.58.201.106:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 065963cm.nyashkoon.top udp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp
US 8.8.8.8:53 34.185.67.172.in-addr.arpa udp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp

Files

memory/3488-0-0x00007FFC22ED3000-0x00007FFC22ED5000-memory.dmp

memory/3488-1-0x0000000000010000-0x0000000000636000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\injector.exe

MD5 af3137e67eabdae073fdc900f863f6a8
SHA1 53d956673d51d05f17374a778fa08c70f3d33372
SHA256 659517254a9b0f0478c4f601326dd9d9afd8f86308179e202fe6b89184b9a0c9
SHA512 4edbdcee2328256a7fa01c0b4aaa18f24a4c392269cefdcdad34bf2b222edd4332b654da36223925dd1769eb463e5163344342da30f1dd2f7fd54fa64c9bb4ad

memory/3488-10-0x00007FFC22ED0000-0x00007FFC23991000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

MD5 2cf0a29383fd0b2054138434eed1b265
SHA1 84138a0182af9ef5c6b31255bd85707e0ad6a0c3
SHA256 e4011f2b2426a6fcb2f48317c8623a9d7583b782b2a4f10caee19f0df70b4185
SHA512 3977b288e3512184bed9ead0947f35cb6e3c95c83a517cadd8c63ed642fbb47a41e9ac30c43a0f877ed33bd13a482e082c308081b387e7d339f71c3582da91ca

memory/3488-16-0x00007FFC22ED0000-0x00007FFC23991000-memory.dmp

C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe

MD5 cf441f15daf3339180706cf594e97131
SHA1 ca5663745d79bd9196fea24b51d6061f79355d3c
SHA256 9a2afde59f2326a4cfbc827e87c7270da20d4a6e19e8d00b5b3a479c26f8ad13
SHA512 37d2b08ca78ee06fbcc93577a31a243670fd4efce506449e2e4e3b33c2319081e1f905f8651a642112386620f6551c1a598cdc7f69e682ee252fddc2fa9cde74

C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat

MD5 f4846b111f4c8ced35bf1ed60502270f
SHA1 625bb8296688ca9cde0c60c60cc17ed83383050c
SHA256 2b20a48f281b60176569332a9e56f5aa7911ba9793f87f9729aafc81aab5a6cd
SHA512 ef77a850b15f988754eb17c48ce84e15bcf824c4bcc64ac7f5f372f86fee5738de67417fd0cf56271d1701b5256edcf4ad8603b5fab28016af8e28359967df67

C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

MD5 51a33d556ce031ad0a5e752f10b00a13
SHA1 f05e11e3034481de8590ee4afd912628cacfde9a
SHA256 eab0d35dc956885b222e69fde419f3974db712c98bbb23f41325388bde0cc341
SHA512 c27a18ebee3e32854e4ad136c3af7de753764a9b44fc024487eb4a197a3f68b506f8578c4beab63e23c64b4e8ce10d63d2987b78175a9691e9aec9fc13887356

memory/3800-30-0x0000000000AB0000-0x0000000000E1A000-memory.dmp

memory/3800-32-0x000000001BA80000-0x000000001BAA6000-memory.dmp

memory/3800-34-0x000000001B8D0000-0x000000001B8DE000-memory.dmp

memory/3800-36-0x000000001B940000-0x000000001B95C000-memory.dmp

memory/3800-37-0x000000001C9C0000-0x000000001CA10000-memory.dmp

memory/3800-39-0x000000001B920000-0x000000001B930000-memory.dmp

memory/3800-41-0x000000001C970000-0x000000001C988000-memory.dmp

memory/3800-43-0x000000001B930000-0x000000001B940000-memory.dmp

memory/3800-45-0x000000001B960000-0x000000001B970000-memory.dmp

memory/3800-47-0x000000001BAB0000-0x000000001BABE000-memory.dmp

memory/3800-49-0x000000001C990000-0x000000001C9A2000-memory.dmp

memory/3800-51-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

memory/3800-53-0x000000001CA30000-0x000000001CA46000-memory.dmp

memory/3800-55-0x000000001CA50000-0x000000001CA62000-memory.dmp

memory/3800-56-0x000000001D1A0000-0x000000001D6C8000-memory.dmp

memory/3800-58-0x000000001BAD0000-0x000000001BAE0000-memory.dmp

memory/3800-60-0x000000001C9B0000-0x000000001C9C0000-memory.dmp

memory/3800-62-0x000000001CCD0000-0x000000001CD2A000-memory.dmp

memory/3800-64-0x000000001CA10000-0x000000001CA1E000-memory.dmp

memory/3800-66-0x000000001CC90000-0x000000001CCA8000-memory.dmp

memory/3800-70-0x000000001CD80000-0x000000001CDCE000-memory.dmp

memory/3800-68-0x000000001CA20000-0x000000001CA2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\VTwnNdY7rx.bat

MD5 f7a6ca7702ccaa7ac5ccc64985be19f8
SHA1 eeb4bdb404e63c0fd458715d11dd8a61cccc74d6
SHA256 61ee11ffe5e1401fe083e7fc5d59f92f9e12afc669ad9b8f850da2ff3770c408
SHA512 e5b799c4087892b913b2a5e8c7b3b8de56914d2fa0c12759e34029433e6762ac68de7346d334b6b62e45400bfbecc3785c54211193925fc21fa358d1210b46af

memory/4500-110-0x000000001D990000-0x000000001DAA5000-memory.dmp