dcrat | 0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25

Analysis

max time kernel
30s
max time network
38s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XNXBot Test v5.exe
Size 2.6MB
Sample240516-1erm8she46
SHA256 0bf62e7a92cc0f2241f582c7ee1feb647dba3557e61b389b50f97032f73eba25
MD5 3a6417ba5ef68d3d1823cda12878d367
SHA1 216a748dd2756ad28960a79775b3e13fcf0eed5f
SHA512 819d2dc1d82ef61bb1b94cb0aaa8f89732e853901b5bff03ec6d48f02cf04783ef22087ad57785fd3d974a1fc0f74311832e3734f5325a37c45f672d62e20668
SSDEEP 49152:UbA30H6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1BfF:Uben/V89ITPTnK1BN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 43 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		5080	schtasks.exe
		32	schtasks.exe
		4952	schtasks.exe
		1276	schtasks.exe
		3712	schtasks.exe
		3284	schtasks.exe
		2448	schtasks.exe
		4448	schtasks.exe
		3884	schtasks.exe
		3888	schtasks.exe
		4904	schtasks.exe
		2128	schtasks.exe
		4916	schtasks.exe
		5088	schtasks.exe
		1300	schtasks.exe
		4500	schtasks.exe
		4800	schtasks.exe
		2212	schtasks.exe
		5076	schtasks.exe
		5092	schtasks.exe
		2524	schtasks.exe
		4228	schtasks.exe
		4912	schtasks.exe
		1712	schtasks.exe
		4832	schtasks.exe
		3032	schtasks.exe
		3876	schtasks.exe
		2764	schtasks.exe
		4120	schtasks.exe
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings		XNXBot Test v5.exe
		2464	schtasks.exe
		3296	schtasks.exe
		4604	schtasks.exe
		2848	schtasks.exe
		200	schtasks.exe
		4860	schtasks.exe
		4408	schtasks.exe
		4436	schtasks.exe
		856	schtasks.exe
		4928	schtasks.exe
		1324	schtasks.exe
		1416	schtasks.exe
		1336	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 14 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Windows NT\\csrss.exe\", \"C:\\comsurrogateServercommon\\sihost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Windows NT\\csrss.exe\", \"C:\\comsurrogateServercommon\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Windows\\schemas\\AvailableNetwork\\OfficeClickToRun.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Windows NT\\csrss.exe\", \"C:\\comsurrogateServercommon\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Windows\\schemas\\AvailableNetwork\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\fontdrvhost.exe\", \"C:\\Windows\\Branding\\Basebrd\\ShellExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Windows NT\\csrss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Windows NT\\csrss.exe\", \"C:\\comsurrogateServercommon\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Windows NT\\csrss.exe\", \"C:\\comsurrogateServercommon\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Windows\\schemas\\AvailableNetwork\\OfficeClickToRun.exe\", \"C:\\Users\\All Users\\fontdrvhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\", \"C:\\comsurrogateServercommon\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\", \"C:\\Users\\All Users\\USOPrivate\\System.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\", \"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	mscomAgent.exe

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	200	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	5024	schtasks.exe	77
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	5024	schtasks.exe	77

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000800000001aba8-11.dat	dcrat
behavioral2/memory/4260-14-0x0000000000660000-0x00000000008B0000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

pid	Process
4260	mscomAgent.exe
3852	ShellExperienceHost.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows NT\\csrss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows NT\\csrss.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\Branding\\Basebrd\\ShellExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Recovery\\WindowsRE\\ShellExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\comsurrogateServercommon\\dllhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\USOPrivate\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\schemas\\AvailableNetwork\\OfficeClickToRun.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\fontdrvhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "\"C:\\Windows\\Branding\\Basebrd\\ShellExperienceHost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\Speech_OneCore\\Engines\\TTS\\en-US\\NUSData\\sysmon.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\fontdrvhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\comsurrogateServercommon\\dllhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\USOPrivate\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\comsurrogateServercommon\\sihost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\All Users\\SoftwareDistribution\\fontdrvhost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\schemas\\AvailableNetwork\\OfficeClickToRun.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\OfficeClickToRun.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\comsurrogateServercommon\\sihost.exe\""	mscomAgent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\""	mscomAgent.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows NT\csrss.exe	mscomAgent.exe
File created	C:\Program Files\Windows NT\886983d96e3d3e	mscomAgent.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe	mscomAgent.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\e6c9b481da804f	mscomAgent.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\sysmon.exe	mscomAgent.exe
File created	C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\121e5b5079f7c0	mscomAgent.exe
File created	C:\Windows\schemas\AvailableNetwork\OfficeClickToRun.exe	mscomAgent.exe
File created	C:\Windows\schemas\AvailableNetwork\e6c9b481da804f	mscomAgent.exe
File created	C:\Windows\Branding\Basebrd\ShellExperienceHost.exe	mscomAgent.exe
File created	C:\Windows\Branding\Basebrd\f8c8f1285d826b	mscomAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4952	schtasks.exe
4120	schtasks.exe
4904	schtasks.exe
1712	schtasks.exe
5092	schtasks.exe
2524	schtasks.exe
32	schtasks.exe
1416	schtasks.exe
3712	schtasks.exe
3296	schtasks.exe
200	schtasks.exe
2764	schtasks.exe
4604	schtasks.exe
2212	schtasks.exe
5076	schtasks.exe
2128	schtasks.exe
4500	schtasks.exe
1336	schtasks.exe
1300	schtasks.exe
4228	schtasks.exe
4408	schtasks.exe
4832	schtasks.exe
856	schtasks.exe
1324	schtasks.exe
4448	schtasks.exe
4800	schtasks.exe
5088	schtasks.exe
1276	schtasks.exe
3032	schtasks.exe
2848	schtasks.exe
4928	schtasks.exe
4860	schtasks.exe
3876	schtasks.exe
2448	schtasks.exe
3884	schtasks.exe
4912	schtasks.exe
4916	schtasks.exe
3888	schtasks.exe
2464	schtasks.exe
4436	schtasks.exe
3284	schtasks.exe
5080	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1739856679-3467441365-73334005-1000_Classes\Local Settings	XNXBot Test v5.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
4260	mscomAgent.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe
3852	ShellExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4260	mscomAgent.exe
Token: SeDebugPrivilege	3852	ShellExperienceHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3852	ShellExperienceHost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 964	4788	XNXBot Test v5.exe	73
PID 4788 wrote to memory of 964	4788	XNXBot Test v5.exe	73
PID 4788 wrote to memory of 964	4788	XNXBot Test v5.exe	73
PID 964 wrote to memory of 3672	964	WScript.exe	74
PID 964 wrote to memory of 3672	964	WScript.exe	74
PID 964 wrote to memory of 3672	964	WScript.exe	74
PID 3672 wrote to memory of 4260	3672	cmd.exe	76
PID 3672 wrote to memory of 4260	3672	cmd.exe	76
PID 4260 wrote to memory of 3852	4260	mscomAgent.exe	120
PID 4260 wrote to memory of 3852	4260	mscomAgent.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XNXBot Test v5.exe
"C:\Users\Admin\AppData\Local\Temp\XNXBot Test v5.exe"
1⤵
- DcRat
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\comsurrogateServercommon\ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\comsurrogateServercommon\BU5c99cqg2jzc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\comsurrogateServercommon\mscomAgent.exe
      "C:\comsurrogateServercommon\mscomAgent.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Windows\Branding\Basebrd\ShellExperienceHost.exe
        
        "C:\Windows\Branding\Basebrd\ShellExperienceHost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\comsurrogateServercommon\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\comsurrogateServercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\comsurrogateServercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\SoftwareDistribution\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SoftwareDistribution\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\USOPrivate\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\USOPrivate\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\USOPrivate\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\comsurrogateServercommon\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\comsurrogateServercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\comsurrogateServercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\schemas\AvailableNetwork\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Windows\schemas\AvailableNetwork\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Windows\Branding\Basebrd\ShellExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\Basebrd\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BU5c99cqg2jzc.bat

Path C:\comsurrogateServercommon\BU5c99cqg2jzc.bat
Size 55B
SHA256 d7105ee692b694f449108c533bd361b5d7d6a41602acb5f9daaa611800a4119d
MD5 d8c1badb2510bbf4488af2000fa47899
SHA1 34ff8a3367ffc6d3320ccf3dc4e5e602aacb4194
SHA512 0de83b211d2c4f450e5ff041b1b2f1c363151dd2abb990821bb3277c543ae5ad6977a4897210a79114920d1d52da26522e3aeced146c1487b9ad76b925a8288b
MD5 SHA1 SHA512

Submit Download

mscomAgent.exe

Path C:\comsurrogateServercommon\mscomAgent.exe
Size 2.3MB
SHA256 8ed97cc29cf906767eeafc2f01ae853688add73580061c50b96235babb545f24
MD5 9a7f8bce21abf6d5931d00fd9f86be17
SHA1 30c3453cfb6242c81ef040c6f4f2d4dccd4c2eb0
SHA512 69c1e4bb02ad477c619e58556372ca34945ee3813642cf2698f5bb492e7f2cf42eb424e088172621ced657f975a3c0af89022a0f0a91a46795d97697632c2651
SSDEEP 49152:g6nz8ln4V8tVeSOwfgT3f5X7KQnaWG1Bf:rn/V89ITPTnK1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe

Path C:\comsurrogateServercommon\ohhgw1nntQ9XkKMgv86C7qCUupIEIA.vbe
Size 225B
SHA256 0467ec4409e7abe4c793aa799094039859c212506a20d7ff78a5283697fbbc75
MD5 464eb5fbd1d2388aa6f3d2aaec4a9309
SHA1 41e7d16bef980098f8c9e785d65d2a545993bb8e
SHA512 997966240818cb172d0fe4a1701593882b74ab18031095c7dccd8b449d8637c2e631138591375cb16fc31a4ffd50e5131d7724e76a08e4e7c68de2a40ca63bcd
MD5 SHA1 SHA512

Submit Download

memory/3852-56-0x000000001B5B0000-0x000000001B5C2000-memory.dmp

Download

memory/4260-17-0x0000000002B80000-0x0000000002B96000-memory.dmp

Download

memory/4260-16-0x000000001BB70000-0x000000001BBC0000-memory.dmp

Download

memory/4260-15-0x0000000001050000-0x000000000106C000-memory.dmp

Download

memory/4260-18-0x000000001B600000-0x000000001B656000-memory.dmp

Download

memory/4260-19-0x0000000002BA0000-0x0000000002BB2000-memory.dmp

Download

memory/4260-20-0x000000001C0F0000-0x000000001C616000-memory.dmp

Download

memory/4260-22-0x000000001B650000-0x000000001B658000-memory.dmp

Download

memory/4260-21-0x000000001B4A0000-0x000000001B4AE000-memory.dmp

Download

memory/4260-14-0x0000000000660000-0x00000000008B0000-memory.dmp

Download