dcrat | 0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25

Analysis

max time kernel
23s
max time network
25s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XNXBot Test v5.exe
Size 2.6MB
Sample240516-1erm8she46
SHA256 0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25
MD5 3a6417ba5ef68d3d1823cda12878d367
SHA1 216a748dd2756ad28960a79775b3e13fcf0eed5f
SHA512 819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668
SSDEEP 49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 17 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2524	schtasks.exe
		2384	schtasks.exe
File created	C:\Program Files (x86)\Google\Temp\smss.exe		mscomAgent.exe
		1548	schtasks.exe
		2428	schtasks.exe
		2580	schtasks.exe
		1900	schtasks.exe
		2648	schtasks.exe
		1660	schtasks.exe
		1696	schtasks.exe
		2452	schtasks.exe
		1824	schtasks.exe
		360	schtasks.exe
		1596	schtasks.exe
File created	C:\Program Files (x86)\Google\Temp\69ddcba757bf72		mscomAgent.exe
		2340	schtasks.exe
		1584	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\", \"C:\\comsurrogateServercommon\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\Idle.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\", \"C:\\comsurrogateServercommon\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\smss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\", \"C:\\comsurrogateServercommon\\lsass.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\conhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\", \"C:\\comsurrogateServercommon\\lsass.exe\""	mscomAgent.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2712	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	360	2712	schtasks.exe	32

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000015d20-9.dat	dcrat
behavioral1/memory/2632-13-0x0000000000110000-0x0000000000360000-memory.dmp	dcrat
behavioral1/memory/2352-39-0x0000000000D10000-0x0000000000F60000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
2632	mscomAgent.exe
2352	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2092	cmd.exe
2092	cmd.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\Idle.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\smss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Google\\Temp\\smss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\comsurrogateServercommon\\lsass.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\conhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\conhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\comsurrogateServercommon\\lsass.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Internet Explorer\\ja-JP\\Idle.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Sidebar\\it-IT\\smss.exe\""	mscomAgent.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Temp\smss.exe	mscomAgent.exe
File created	C:\Program Files (x86)\Google\Temp\69ddcba757bf72	mscomAgent.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\Idle.exe	mscomAgent.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\6ccacd8608530f	mscomAgent.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\smss.exe	mscomAgent.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\69ddcba757bf72	mscomAgent.exe
File created	C:\Program Files (x86)\Google\Temp\smss.exe	mscomAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2524	schtasks.exe
2648	schtasks.exe
1596	schtasks.exe
1824	schtasks.exe
1696	schtasks.exe
2340	schtasks.exe
360	schtasks.exe
2452	schtasks.exe
2384	schtasks.exe
2428	schtasks.exe
2580	schtasks.exe
1548	schtasks.exe
1900	schtasks.exe
1660	schtasks.exe
1584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2632	mscomAgent.exe
2632	mscomAgent.exe
2632	mscomAgent.exe
852	taskmgr.exe
852	taskmgr.exe
2352	smss.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	mscomAgent.exe
Token: SeDebugPrivilege	852	taskmgr.exe
Token: SeDebugPrivilege	2352	smss.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe
852	taskmgr.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2216	2696	XNXBot Test v5.exe	28
PID 2696 wrote to memory of 2216	2696	XNXBot Test v5.exe	28
PID 2696 wrote to memory of 2216	2696	XNXBot Test v5.exe	28
PID 2696 wrote to memory of 2216	2696	XNXBot Test v5.exe	28
PID 2216 wrote to memory of 2092	2216	WScript.exe	29
PID 2216 wrote to memory of 2092	2216	WScript.exe	29
PID 2216 wrote to memory of 2092	2216	WScript.exe	29
PID 2216 wrote to memory of 2092	2216	WScript.exe	29
PID 2092 wrote to memory of 2632	2092	cmd.exe	31
PID 2092 wrote to memory of 2632	2092	cmd.exe	31
PID 2092 wrote to memory of 2632	2092	cmd.exe	31
PID 2092 wrote to memory of 2632	2092	cmd.exe	31
PID 2632 wrote to memory of 2244	2632	mscomAgent.exe	48
PID 2632 wrote to memory of 2244	2632	mscomAgent.exe	48
PID 2632 wrote to memory of 2244	2632	mscomAgent.exe	48
PID 2244 wrote to memory of 1360	2244	cmd.exe	50
PID 2244 wrote to memory of 1360	2244	cmd.exe	50
PID 2244 wrote to memory of 1360	2244	cmd.exe	50
PID 2244 wrote to memory of 2352	2244	cmd.exe	52
PID 2244 wrote to memory of 2352	2244	cmd.exe	52
PID 2244 wrote to memory of 2352	2244	cmd.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XNXBot Test v5.exe
"C:\Users\Admin\AppData\Local\Temp\XNXBot Test v5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\comsurrogateServercommon\ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\comsurrogateServercommon\BU5c99cqg2jzc.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\comsurrogateServercommon\mscomAgent.exe
      "C:\comsurrogateServercommon\mscomAgent.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pNRQkraVyd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2244
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1360
      - C:\Program Files (x86)\Windows Sidebar\it-IT\smss.exe
        
        "C:\Program Files (x86)\Windows Sidebar\it-IT\smss.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\comsurrogateServercommon\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\comsurrogateServercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\comsurrogateServercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\it-IT\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pNRQkraVyd.bat

Path C:\Users\Admin\AppData\Local\Temp\pNRQkraVyd.bat
Size 218B
SHA256 ff637484860ed09284cebb22104d3bc1ab6c51e1683d7e1e751d4c795b5672ee
MD5 b9e930d36a5bec78f3ada353409aa9e6
SHA1 a73494c31f513a2df0da4771694e1e982a60e21e
SHA512 b0710b5bb771453016b83c3fff45f2b6f56c0530c6849075a804a212571ef2fdba082c6a3a4d3bc6ed3f914d00449d7db1c77276b7bb9a3f7b9331d9a088a09d
MD5 SHA1 SHA512

Submit Download

BU5c99cqg2jzc.bat

Path C:\comsurrogateServercommon\BU5c99cqg2jzc.bat
Size 55B
SHA256 d7105ee692b694f449108c533bd361b5d7d6a41602acb5f9daaa611800a4119d
MD5 d8c1badb2510bbf4488af2000fa47899
SHA1 34ff8a3367ffc6d3320ccf3dc4e5e602aacb4194
SHA512 0de83b211d2c4f450e5ff041b1b2f1c363151dd2abb990821bb3277c543ae5ad6977a4897210a79114920d1d52da26522e3aeced146c1487b9ad76b925a8288b
MD5 SHA1 SHA512

Submit Download

ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe

Path C:\comsurrogateServercommon\ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe
Size 225B
SHA256 0467ec4409e7abe4c793aa799094039859c212506a20d7ff78a5283697fbbc75
MD5 464eb5fbd1d2388aa6f3d2aaec4a9309
SHA1 41e7d16bef980098f8c9e785d65d2a545993bb8e
SHA512 997966240818cb172d0fe4a1701593882b74ab18031095c7dccd8b449d8637c2e631138591375cb16fc31a4ffd50e5131d7724e76a08e4e7c68de2a40ca63bcd
MD5 SHA1 SHA512

Submit Download

mscomAgent.exe

Path \comsurrogateServercommon\mscomAgent.exe
Size 2.3MB
SHA256 8ed97cc29cf906767eeafc2f01ae853688add73580061c50b96235babb545f24
MD5 9a7f8bce21abf6d5931d00fd9f86be17
SHA1 30c3453cfb6242c81ef040c6f4f2d4dccd4c2eb0
SHA512 69c1e4bb02ad477c619e58556372ca34945ee3813642cf2698f5bb492e7f2cf42eb424e088172621ced657f975a3c0af89022a0f0a91a46795d97697632c2651
SSDEEP 49152:g6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1Bf:rn/V89ITPTnK1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/852-36-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/852-35-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2352-40-0x00000000002F0000-0x0000000000302000-memory.dmp

Download

memory/2352-39-0x0000000000D10000-0x0000000000F60000-memory.dmp

Download

memory/2632-16-0x0000000000860000-0x00000000008B6000-memory.dmp

Download

memory/2632-19-0x0000000000590000-0x0000000000598000-memory.dmp

Download

memory/2632-18-0x0000000000410000-0x000000000041E000-memory.dmp

Download

memory/2632-17-0x00000000003B0000-0x00000000003C2000-memory.dmp

Download

memory/2632-15-0x00000000003D0000-0x00000000003E6000-memory.dmp

Download

memory/2632-14-0x0000000000390000-0x00000000003AC000-memory.dmp

Download

memory/2632-13-0x0000000000110000-0x0000000000360000-memory.dmp

Download