asyncrat | 138be3a5769af371a332cf9404cca591cd78d594d6a072fa8047e222ac92770e

Analysis

max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VigilByte Resou_nls..scr
Size 362KB
Sample240521-np33sscb4v
SHA256 138be3a5769af371a332cf9404cca591cd78d594d6a072fa8047e222ac92770e
MD5 7c031479dedab585b453098453a09f35
SHA1 401ec0bf7ce170a67c0317150c2b83885e8abc54
SHA512 17160d0c966c6ea6f8ac182ccd361baf2900dbfbf92ae59804861a404ba5a77a37e499ae0ac2588d46fcd26ce08d29a02e66b09894e4319212fb9f0d23a9643f
SSDEEP 6144:rBx7iw0qvLJXnlUGujCtjno6itQl+REw6FMG/UHQS8PUHIRA8yVYtFmCaxHU0bM:rTkqjVnl36ud0zR/6CtQ9PUHIG8Dn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat op os evasion execution persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

20.117.108.240:5612

Mutex

HssS7dvHeccj

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

20.117.108.240:7825

Mutex

IOr8QBoiV215

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	VigilByte Resou_nls..scr
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	MicrosoftCorporation.exe

Executes dropped EXE 11 IoCs

pid	Process
3596	7z.exe
2344	goodbyedpi.exe
5104	7z.exe
400	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
2084	Service.exe
2804	7z.exe
2016	aitstatic.exe
3536	ComSvcConfig.exe
2064	MicrosoftCertificateServices.exe
3608	WinSAT.exe

Loads dropped DLL 3 IoCs

pid	Process
2344	goodbyedpi.exe
3608	WinSAT.exe
3608	WinSAT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Service.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 4168	400	MicrosoftCorporation.exe	104
PID 2016 set thread context of 3756	2016	aitstatic.exe	125
PID 3536 set thread context of 1856	3536	ComSvcConfig.exe	131
PID 2064 set thread context of 840	2064	MicrosoftCertificateServices.exe	133

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	VigilByte Resou_nls..scr
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
396	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4676	VigilByte Resou_nls..scr
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4168	MicrosoftCorporation.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	VigilByte Resou_nls..scr
Token: SeRestorePrivilege	3596	7z.exe
Token: 35	3596	7z.exe
Token: SeSecurityPrivilege	3596	7z.exe
Token: SeSecurityPrivilege	3596	7z.exe
Token: SeRestorePrivilege	5104	7z.exe
Token: 35	5104	7z.exe
Token: SeSecurityPrivilege	5104	7z.exe
Token: SeSecurityPrivilege	5104	7z.exe
Token: SeDebugPrivilege	4168	MicrosoftCorporation.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeRestorePrivilege	2804	7z.exe
Token: 35	2804	7z.exe
Token: SeSecurityPrivilege	2804	7z.exe
Token: SeSecurityPrivilege	2804	7z.exe
Token: SeDebugPrivilege	3756	RegAsm.exe
Token: SeDebugPrivilege	1856	RegAsm.exe
Token: SeSecurityPrivilege	3608	WinSAT.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3596	4676	VigilByte Resou_nls..scr	94
PID 4676 wrote to memory of 3596	4676	VigilByte Resou_nls..scr	94
PID 4676 wrote to memory of 3596	4676	VigilByte Resou_nls..scr	94
PID 4676 wrote to memory of 2344	4676	VigilByte Resou_nls..scr	96
PID 4676 wrote to memory of 2344	4676	VigilByte Resou_nls..scr	96
PID 4676 wrote to memory of 5104	4676	VigilByte Resou_nls..scr	101
PID 4676 wrote to memory of 5104	4676	VigilByte Resou_nls..scr	101
PID 4676 wrote to memory of 5104	4676	VigilByte Resou_nls..scr	101
PID 4676 wrote to memory of 400	4676	VigilByte Resou_nls..scr	103
PID 4676 wrote to memory of 400	4676	VigilByte Resou_nls..scr	103
PID 4676 wrote to memory of 400	4676	VigilByte Resou_nls..scr	103
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 400 wrote to memory of 4168	400	MicrosoftCorporation.exe	104
PID 4168 wrote to memory of 5028	4168	MicrosoftCorporation.exe	105
PID 4168 wrote to memory of 5028	4168	MicrosoftCorporation.exe	105
PID 4168 wrote to memory of 5028	4168	MicrosoftCorporation.exe	105
PID 5028 wrote to memory of 1992	5028	cscript.exe	110
PID 5028 wrote to memory of 1992	5028	cscript.exe	110
PID 5028 wrote to memory of 1992	5028	cscript.exe	110
PID 1992 wrote to memory of 2756	1992	cmd.exe	112
PID 1992 wrote to memory of 2756	1992	cmd.exe	112
PID 1992 wrote to memory of 2756	1992	cmd.exe	112
PID 2756 wrote to memory of 2800	2756	net.exe	113
PID 2756 wrote to memory of 2800	2756	net.exe	113
PID 2756 wrote to memory of 2800	2756	net.exe	113
PID 1992 wrote to memory of 2084	1992	cmd.exe	114
PID 1992 wrote to memory of 2084	1992	cmd.exe	114
PID 2084 wrote to memory of 684	2084	Service.exe	116
PID 2084 wrote to memory of 684	2084	Service.exe	116
PID 684 wrote to memory of 4844	684	cmd.exe	118
PID 684 wrote to memory of 4844	684	cmd.exe	118
PID 684 wrote to memory of 396	684	cmd.exe	119
PID 684 wrote to memory of 396	684	cmd.exe	119
PID 4168 wrote to memory of 2804	4168	MicrosoftCorporation.exe	121
PID 4168 wrote to memory of 2804	4168	MicrosoftCorporation.exe	121
PID 4168 wrote to memory of 2804	4168	MicrosoftCorporation.exe	121
PID 4168 wrote to memory of 2016	4168	MicrosoftCorporation.exe	124
PID 4168 wrote to memory of 2016	4168	MicrosoftCorporation.exe	124
PID 4168 wrote to memory of 2016	4168	MicrosoftCorporation.exe	124
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 2016 wrote to memory of 3756	2016	aitstatic.exe	125
PID 4168 wrote to memory of 3536	4168	MicrosoftCorporation.exe	130
PID 4168 wrote to memory of 3536	4168	MicrosoftCorporation.exe	130
PID 4168 wrote to memory of 3536	4168	MicrosoftCorporation.exe	130
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131
PID 3536 wrote to memory of 1856	3536	ComSvcConfig.exe	131

C:\Users\Admin\AppData\Local\Temp\VigilByte Resou_nls..scr
"C:\Users\Admin\AppData\Local\Temp\VigilByte Resou_nls..scr" /S
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\ProgramData\sevenZip\7z.exe
  "C:\ProgramData\sevenZip\7z.exe" x "C:\ProgramData\SSLNetwork\goodbyedpi.7z" -o"C:\ProgramData\SSLNetwork" -y
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\ProgramData\SSLNetwork\goodbyedpi.exe
  "C:\ProgramData\SSLNetwork\goodbyedpi.exe" -5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2344
- C:\ProgramData\sevenZip\7z.exe
  "C:\ProgramData\sevenZip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\isyjmt2lbv.7z" -o"C:\Users\Admin\AppData\Local\Temp\isyjmt2lbvhUb" -phR3^&b2%A9!gK*6LqP7t$NpW
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\isyjmt2lbvhUb\MicrosoftCorporation.exe
  "C:\Users\Admin\AppData\Local\Temp\isyjmt2lbvhUb\MicrosoftCorporation.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Users\Admin\AppData\Local\Temp\isyjmt2lbvhUb\MicrosoftCorporation.exe
    #system32
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SysWOW64\cscript.exe
      "cscript.exe" /B /NoLogo "C:\Users\Public\Videos\b.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Videos\b.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1992
      - C:\Windows\SysWOW64\net.exe
        
        net session
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2800
      - C:\Users\Public\Videos\Service.exe
        
        C:\Users\Public\Videos\Service.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c babel.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell -NoProfile -ExecutionPolicy Bypass -Command "$defenderExclusions = Get-MpPreference; $defenderExclusions.ExclusionPath = $defenderExclusions.ExclusionPath + 'C:\'; Set-MpPreference -ExclusionPath $defenderExclusions.ExclusionPath"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
        
        C:\Windows\system32\reg.exe
        
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:396
  - - C:\ProgramData\sevenZip\7z.exe
      "C:\ProgramData\sevenZip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\f3bee459-0484-4925-bc76-81766648dd44.7z" -o"C:\Users\Admin\AppData\Local\Temp\Vf3bee459-0484-4925-bc76-81766648dd44" -pSaToshi780189.!
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\aitstatic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #system32
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\ComSvcConfig.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #system32
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MicrosoftCertificateServices.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:2064
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #system32
        5⤵
        
        PID:840
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\WinSAT.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\WinSAT.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinDivert.dll

Path C:\ProgramData\SSLNetwork\WinDivert.dll
Size 23KB
SHA256 a97859785a2df1d4462e7d48d33ccbd89fedd40dac4970f4afd89e63f59ee1ec
MD5 66028ed384c62b3b4ab851809d38881e
SHA1 81924fc6409a9ee00623332cc77827633bb3cc1a
SHA512 7a86faf0057db3e9ed78cfa1569154990d0a7eec3da1ca30ff79229745355a1ada4304b8d2b5228cb98afb21786c92eee959067ae9f0bf518af9c5aead3c9159
SSDEEP 384:yFeZ7IibcWUhRRD0qbk91c8bKKvBRseZPFMejOcD3PmH9vRQxVzE:ygEeSRR158b/dIYPWvRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

goodbyedpi.7z

Path C:\ProgramData\SSLNetwork\goodbyedpi.7z
Size 66KB
SHA256 7d5f9842c34a83780808e990da2eeabbd003a2db7a424de5dda63da6913db603
MD5 761093755f2649264ec240c4871d958d
SHA1 4ccf19678a1863237c8c16e72fad664d663b86b4
SHA512 88f400389c4fc25f812f7016e89b45d94c7eb94f2bf5c8c6d7ae5c1d8c56abbdcc8e817e5a740d0cd1f376ef132e86d1fc8b3e93385eb009c8cfbf2273ec948d
SSDEEP 1536:xcohVBIhHVoo4PIW0j6LOlWENqkNXGXmoGuYJF1x/UaoF2Yz:eoh7oy5RwWENqkQ2Vua1x/7oFTz
MD5 SHA1 SHA512 SSDEEP

Submit Download

goodbyedpi.exe

Path C:\ProgramData\SSLNetwork\goodbyedpi.exe
Size 73KB
SHA256 331ac6c1d22ba5a0a217f3f27d0d823051869cafc8b8ef7f2002fa2accebc74e
MD5 5a2136bcbc14293b4f88dfba3243dd0a
SHA1 349174de8d042d814bd28b171770391764195f1c
SHA512 c844e5d36dfb52bff7a5c2f9d19530de094f811641d57a35bf7023b5dc9a134a83488f65389c5a9805b7afffd197175e15fae3f67ec3e0dc9d490e60daf693c5
SSDEEP 1536:0DUStjrGshxSrBwzh6E6xdK6aTe0yNgnIcm:0DUCjBhxSrazwqrUgID
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\ProgramData\sevenZip\7z.exe
Size 577KB
SHA256 2e2e69b6e3da6d3bb46207d1393d6253e96ecb7dd1c4d6a41ec41a55f1516549
MD5 e877ed2d9463e6729db5768f23640aa4
SHA1 6b1aef079ffd30872f4f372012ab111b7d7c42e4
SHA512 487b3c607b38c14b843972f8aa47fdd1eafa725f477942aaf5ceea2e06805cda2821ceaa1687a5e5071eb3c3892215ae96b038c3249944f85915935c018638b8
SSDEEP 12288:eeesPuTyZA5BfFJ/C8r10GVb5dzuX56cEnjsFMfVnA3TLRERy:eeLnZI//CQ10QldukJnjsFMNA3TLRsy
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftCorporation.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MicrosoftCorporation.exe.log
Size 321B
SHA256 10c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8
MD5 baf5d1398fdb79e947b60fe51e45397f
SHA1 49e7b8389f47b93509d621b8030b75e96bb577af
SHA512 b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413
MD5 SHA1 SHA512

Submit Download

babel.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\babel.bat
Size 380B
SHA256 f79ea324982a5e2ec73a3a6a7acd13cbfbd83bf28267ee4fec5098e332450730
MD5 ee59ad824ab63da2f08c4db2f809a146
SHA1 c0badf069b83e9a3f0708224bbd7c87d303bd8d0
SHA512 ad19559e390313ff9247aaf5de23ae1160c5c06ac37172f16c69abe3d1d96cd253d359ea9f1ec77e2cccc1378ffa5c83d597065b8fb8f4dc3f889f94643ea395
MD5 SHA1 SHA512

Submit Download

ComSvcConfig.exe

Path C:\Users\Admin\AppData\Local\Temp\Vf3bee459-0484-4925-bc76-81766648dd44\ComSvcConfig.exe
Size 91KB
SHA256 4f9ae5b89c89e5c79c53db694d4d67e2d9b3c47c7389c8c3899dedbc9e92be76
MD5 9211293fdf6164567c9c0557cf200057
SHA1 cef794bc498b0b4ffea444c8f0bd002f0ad717bc
SHA512 bc858a5bf2f61a84718c204b1b3cef8883e91d88f5ca3f974b9531f433e44b62d2d7474a8f5f65213703146603ff531a5441a2640c7c63bf0e3b05de0671a609
SSDEEP 1536:nMZI65tohmg4x4mRpkKzk9c/8a95TmjsqeEPQk4SfV:nMuHdOpkKzuc/8afmjsqeEPQk4S9
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftCertificateServices.exe

Path C:\Users\Admin\AppData\Local\Temp\Vf3bee459-0484-4925-bc76-81766648dd44\MicrosoftCertificateServices.exe
Size 74KB
SHA256 9397bbad3a07f7abb3ec75326ba8dc585fd61e7f429b4cc62e238a87737f8b5d
MD5 9a07aa10c5f8a1baaf17922e4d7eef2e
SHA1 893680d4208493b3921f4de4a8a40dbe446271ff
SHA512 f0c97b8750d1146caf87d195747cfafe12c4d202cfe58d7141a15a3ccd3cf10a7a0fb7a2917e57a43fdf18a52174b54350b9a6a0d94f06de2fa11bd0cfae29f5
SSDEEP 1536:+aclU+R1ynEfiOe85oP7xlZGdINQXR/pK+GGrG4BWTTgc9:+a8/TYEfGWoNG2NQXR/pMG64QvB
MD5 SHA1 SHA512 SSDEEP

Submit Download

aitstatic.exe

Path C:\Users\Admin\AppData\Local\Temp\Vf3bee459-0484-4925-bc76-81766648dd44\aitstatic.exe
Size 91KB
SHA256 b010fc8a5324e8c3f72bd5884f5f31cbc02dcb9df573cf5a82405560f4927687
MD5 4516d516dcf02b03d700312e4af2b58f
SHA1 8a36bd779bfba8a87b5d8ee8e6c0d7c0a4faa3ca
SHA512 0709c4069670d24c96d32f47fbf8a0eb0b3484cdce07205f5d2640b9b852fa8d0b1fda1b93d2858062ad76c44778cbc68ee831f3919e82422197c64e9a698f39
SSDEEP 1536:rMuBw+olasjN0Fu8MmiGRwOFSe4808VxdHDYIEgr69cmoLu0t0H:rMuBwsshLW/j4v8PdHsX9cmoLu0Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5vcoitvh.d2x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vcoitvh.d2x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

isyjmt2lbv.7z

Path C:\Users\Admin\AppData\Local\Temp\isyjmt2lbv.7z
Size 1.2MB
SHA256 9f8b0a94df65adf17f63f57f61c7d34c925536548c7076f6a13bc53429d54858
MD5 e59bec64102b5fc4ec846b1c742eafd4
SHA1 95c19240df91a337090bf8a23fb93965cbe6560a
SHA512 6459c9ea24ee46874ad6061653d50a71f4986d4dc751dc4e8b6f06475397b428af59e74dea83987496fbcbd8dc0b8bc1b57538831090e2066e50519913848377
SSDEEP 24576:We5B+3xHPsQ4KSF5b9maSo7S8pdNytDkVwE1hKm7MvYZAcAmOsD9WVtn:We5s3B0PKGBmsDpetvm7cYZyeItn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftCorporation.exe

Path C:\Users\Admin\AppData\Local\Temp\isyjmt2lbvhUb\MicrosoftCorporation.exe
Size 1.2MB
SHA256 c9f5cfba7202db9fde50c885c96b787258358398b8738e4b3954845ef0936866
MD5 f24c087bfd6a5a11079a0ff8ee778593
SHA1 cbc18f13be5788356fd776b92c17f748ba9b313a
SHA512 0325b5b97e41fd927aa8241f11813ceda7610e9815a18c97fc6257cfd681cf1c799b530f40f1cfab6944a2bc39ab32dc8a8dcb6347a4edb17781b286cc1cbf81
SSDEEP 24576:vwx9zxRNc+szf5FE0JahIJqnRrOCIRwU0Wfuwj2KD8SUSh8oGaWR:vwxHk+o/EgEsgOV2Wfu+/8S4
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4BAB.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nss4BAB.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
MD5 SHA1 SHA512 SSDEEP

Submit Download

Service.exe

Path C:\Users\Public\Videos\Service.exe
Size 173KB
SHA256 8d1a65e6518734cf14f0b301faeb013691e1992596bf190093443c7e01014ddd
MD5 8e4bd18fec7dc15624f8e5a92b9fd984
SHA1 ef36e236e4d9c92385bfd73f20389cba234760c6
SHA512 99442c65067941197fed3b4eb0f6f72b86b440f7de5ab29b0914d467fa25f8c61e8b47f20ade0850e722f67688fb677e316caa35fac75e0175d70d1d5d37f3fd
SSDEEP 3072:NahKyd2n31Z5GWp1icKAArDZz4N9GhbkrNEkxfH7YOWxoz:NahO1p0yN90QE+fv
MD5 SHA1 SHA512 SSDEEP

Submit Download

b.bat

Path C:\Users\Public\Videos\b.bat
Size 1KB
SHA256 98679e199f231aa012b301bc3b2a678b1ff52a87bc1c59c546183b9f53bc65ed
MD5 874525c405f65daa259081784a3458f1
SHA1 dfd8f40593c680381f7be52c5765184673412b9e
SHA512 272f4378fe22795896e15f3b009a594873f56e4e08144c5d72b92944ed8044b41b2b68881af9c4809086340a3b36a4ada8c708220368fd89c256d0d9028c993c
MD5 SHA1 SHA512

Submit Download

b.vbs

Path C:\Users\Public\Videos\b.vbs
Size 74B
SHA256 98cb3d001dbb0bddf97bba87a645cbea8e8fac569e0fa01c2b68530b9c6412cd
MD5 4def58f71185d258e72f6d7fabcbe5e2
SHA1 3cf7aefe4419333e19c9cf35845f3ba6fa5334a7
SHA512 fa83a22acb11144ae348be5bf6526daee99f1cd7396198be33ad08f57042da560b566bee3d964ff01130a15850d6904fe42062971d40b5b92af47913c8c5f5ef
MD5 SHA1 SHA512

Submit Download

memory/400-37-0x0000000005990000-0x0000000005F34000-memory.dmp

Download

memory/400-36-0x0000000000B20000-0x0000000000C56000-memory.dmp

Download

memory/840-132-0x0000000005490000-0x0000000005522000-memory.dmp

Download

memory/840-130-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1856-117-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2016-97-0x0000000000600000-0x000000000061E000-memory.dmp

Download

memory/2064-129-0x0000000000020000-0x0000000000038000-memory.dmp

Download

memory/2344-133-0x00007FF6AE9F0000-0x00007FF6AEA0B000-memory.dmp

Download

memory/2344-100-0x00007FF6AE9F0000-0x00007FF6AEA0B000-memory.dmp

Download

memory/2344-101-0x0000000062800000-0x000000006280D000-memory.dmp

Download

memory/3536-116-0x0000000000920000-0x000000000093C000-memory.dmp

Download

memory/3756-104-0x0000000005210000-0x00000000052AC000-memory.dmp

Download

memory/3756-105-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/3756-98-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4168-38-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/4676-34-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/4676-0-0x000000007521E000-0x000000007521F000-memory.dmp

Download

memory/4676-2-0x0000000075210000-0x00000000759C0000-memory.dmp

Download

memory/4676-1-0x0000000000010000-0x000000000006C000-memory.dmp

Download

memory/4844-60-0x000001B1D4CC0000-0x000001B1D4CE2000-memory.dmp

Download