Description	Indicator	Process	Target
PID 2324 wrote to memory of 2652	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\7-Zip\7zFM.exe
PID 2324 wrote to memory of 2652	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\7-Zip\7zFM.exe
PID 2324 wrote to memory of 2652	N/A	C:\Windows\system32\cmd.exe	C:\Program Files\7-Zip\7zFM.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (4).rar"

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New folder (4).rar"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 14:45

Reported

2024-06-09 14:48

Platform

win10v2004-20240508-en

Max time kernel

152s

Max time network

154s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (4).rar"

Signatures

Detect Xworm Payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Xworm

trojan rat xworm

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Desktop\New folder (4)\nuitka-extractor.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe	N/A

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	api.ipify.org	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	ip-api.com	N/A	N/A
N/A	api.ipify.org	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	ipinfo.io	N/A	N/A
N/A	ipinfo.io	N/A	N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\schtasks.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	C:\Windows\system32\cmd.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeRestorePrivilege	N/A	C:\Program Files\7-Zip\7zG.exe	N/A
Token: 35	N/A	C:\Program Files\7-Zip\7zG.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Program Files\7-Zip\7zG.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Program Files\7-Zip\7zG.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\7-Zip\7zG.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4140 wrote to memory of 876	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Users\Admin\Desktop\New folder (4)\nuitka-extractor.exe
PID 4140 wrote to memory of 876	N/A	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	C:\Users\Admin\Desktop\New folder (4)\nuitka-extractor.exe
PID 4104 wrote to memory of 1452	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 1452	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 1452	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 1628	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 1628	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 1628	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4628	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 4104 wrote to memory of 4628	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Users\Admin\AppData\Local\Temp\dllhost.exe
PID 4104 wrote to memory of 2212	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe
PID 4104 wrote to memory of 2212	N/A	C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe	C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\New folder (4).rar"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap18603:86:7zEvent21362

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"

C:\Users\Admin\Desktop\New folder (4)\nuitka-extractor.exe

"C:\Users\Admin\Desktop\New folder (4)\nuitka-extractor.exe" ".\Nexus Release V1.6.exe"

C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe

"C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAbgByACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHAAcwBwACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATQB1AHMAdAAgAGIAZQAgAHIAdQBuACAAYQBzACAAYQBkAG0AaQBuACAAZgBvAHIAIABzAGMAcgBpAHAAdABzACAAdABvACAAcAByAG8AcABlAHIAbAB5ACAAZQB4AGUAYwB1AHQAZQAnACwAJwAnACwAJwBPAEsAJwAsACcAVwBhAHIAbgBpAG4AZwAnACkAPAAjAHgAawBsACMAPgA="

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAcAB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGUAYQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AagBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZABrACMAPgA="

C:\Users\Admin\AppData\Local\Temp\dllhost.exe

"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"

C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe

"C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe"

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_4368_133624180788400277\nexus.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\nexusloader.exe

"C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dllhost.exe'

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iexplore.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM Telegram.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	217.106.137.52.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	u.cubeupload.com	udp
US	172.67.160.244:443	u.cubeupload.com	tcp
US	8.8.8.8:53	ip-api.com	udp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	208.95.112.1:80	ip-api.com	tcp
US	8.8.8.8:53	244.160.67.172.in-addr.arpa	udp
US	8.8.8.8:53	69.241.92.91.in-addr.arpa	udp
US	8.8.8.8:53	1.112.95.208.in-addr.arpa	udp
US	8.8.8.8:53	api.ipify.org	udp
US	104.26.13.205:443	api.ipify.org	tcp
US	8.8.8.8:53	ipinfo.io	udp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	8.8.8.8:53	192.186.117.34.in-addr.arpa	udp
US	8.8.8.8:53	205.13.26.104.in-addr.arpa	udp
US	104.26.13.205:443	api.ipify.org	tcp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
NL	91.92.241.69:5555		tcp
US	104.26.13.205:443	api.ipify.org	tcp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	104.26.13.205:443	api.ipify.org	tcp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	104.26.13.205:443	api.ipify.org	tcp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	104.26.13.205:443	api.ipify.org	tcp
US	8.8.8.8:53	12.173.189.20.in-addr.arpa	udp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	104.26.13.205:443	api.ipify.org	tcp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp
US	104.26.13.205:443	api.ipify.org	tcp
US	34.117.186.192:443	ipinfo.io	tcp
NL	91.92.241.69:6060	91.92.241.69	tcp

Files

memory/4140-19-0x000001885F210000-0x000001885F232000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fadsvh1.ck0.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4140-24-0x0000018860360000-0x00000188603A4000-memory.dmp

memory/4140-25-0x0000018860430000-0x00000188604A6000-memory.dmp

memory/4140-26-0x00000188603F0000-0x000001886040E000-memory.dmp

C:\Users\Admin\Desktop\New folder (4)\nuitka-extractor.exe

MD5	27b827b9b4617cc6534b3fb2893b30b8
SHA1	11843274818de131aa01f27a5e1a32f8445f5e10
SHA256	5ff1182402689097675e873d0f795bed2639e69d3d0cf8fb72b975d8f9d141cd
SHA512	f8afb3e246181bc88d6afd232e7e230fcf3ed9b6090372417b14f4b729f0ddeb83eeb6c8ec67d5f347c73f2197466c092430df4b0dc710367fdf6418241f5faa

C:\Users\Admin\Desktop\New folder (4)\Nexus Release V1.6.exe

MD5	97d5fc7aa91b287c1da40b530490ba7f
SHA1	dd1a0d2d3bd7a6590b361b8afcdca781803a7791
SHA256	6abd91cfcd50134df5b2d0b677c13e672626dfe7bcadff65e125c93cdee3c2bc
SHA512	2d42f62703303e744456a9ff6924fe1cabe40cf9b3ca298ac504cf3bfd0695e92289f2045c41cae15cb3348fad4682b41840931abed489bd8b037110d5e41d55

C:\Users\Admin\AppData\Local\Temp\dllhost.exe

MD5	cc7686bf7c7d81f59196d5cc3cab3348
SHA1	ac39079f223f87d404c421c48239f913b12f00a8
SHA256	49c175257966f191a2abce16d8533d359fc27ecf6512da870a9c59937914d5f7
SHA512	940cfb37c1f5e5dbd86cc14d5a0a85dfaf889754051d4fc0d0afbe7bedceaec91b5f36b873b5e24cd081432db1b7d61df72a198681b9ab8e3a9b57197cfb58ae

memory/4628-45-0x0000000000F20000-0x0000000000F38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe

MD5	967adda3e5738fc034a1179482e09581
SHA1	eb96afbee081846bd8af1e173cd2ccc371cb3e9a
SHA256	14329ef35eb26ab12b38f7da97707125f5f257b3173342f9dc90b20dfc760ea2
SHA512	fba760d43c51f8bdc979edbd68ca0716f432217ef4cfe5cc345287adc4f25e491604e65b3a339f15b7c0754cc56a7976b2b3deba66e4312aa08f87f2770aa732

memory/1628-51-0x00000000052D0000-0x0000000005306000-memory.dmp

memory/1628-55-0x0000000005A10000-0x0000000006038000-memory.dmp

memory/1628-80-0x00000000059D0000-0x00000000059F2000-memory.dmp

memory/1628-84-0x0000000006120000-0x0000000006186000-memory.dmp

memory/1628-82-0x00000000060B0000-0x0000000006116000-memory.dmp

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	eb3f111d9fda949162305e4f364f613c
SHA1	a4233d3889d0962df1cf5b95d63122036014698c
SHA256	e48df2979184435aad09306596e4207dbd15a3343633800437d5fd88c20e5bbf
SHA512	387ae3f06cc13f6b4017e481a9ec6b6936929afb98021fe16327cc4d8f13a1d255294e8f1eb01df7290c58d1ec65586b9849e870e443b2db5dfd7c2a5d033436

memory/1452-113-0x0000000006120000-0x0000000006474000-memory.dmp

memory/1628-298-0x00000000068B0000-0x00000000068CE000-memory.dmp

memory/1628-299-0x00000000068E0000-0x000000000692C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5	b61f243e8d2b9d4e88dcbcb3d90376ba
SHA1	a7ca56ff65fa7fdc0d253e57e4c3d67c9f0c898c
SHA256	3f6a8d47ee94835ac169fa6eed9bcc0cad193e2e8fed4562a21189e1352beb7f
SHA512	e4c6ef0b2838f1645efcb07f855d794b1d80d574202de483def3812e0d607a374ba781aee28b995bc4e4c61875ccbfffcdc3d22986f7035a623130fbf878dcea

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\python310.dll

MD5	384349987b60775d6fc3a6d202c3e1bd
SHA1	701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA256	f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
SHA512	6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\nexusloader.exe

MD5	5e61211e577a7fb75fab8b0c38ac11ea
SHA1	b00d7db41af8de8d8122e65ae77eb3ef28b3f633
SHA256	2ea85a21886caa6ad7ac3c840a903031af872df01bb42b597b5b599e2884b8a1
SHA512	7a2114cf3f2a372e1b699a8a91bac793a80bcb4dc6886e1d137be7e3f50015e976987b034d4b9e46cbfe43f9a7acb299c1963289b95f80ed1ea6396881203fc6

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\vcruntime140.dll

MD5	11d9ac94e8cb17bd23dea89f8e757f18
SHA1	d4fb80a512486821ad320c4fd67abcae63005158
SHA256	e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512	aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\_bz2.pyd

MD5	b45e82a398713163216984f2feba88f6
SHA1	eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839
SHA256	4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
SHA512	b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\tcl86t.dll

MD5	ad03d1e9f0121330694415f901af8f49
SHA1	ad8d3eee5274fef8bb300e2d1f4a11e27d3940df
SHA256	224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9
SHA512	19b85c010c98fa75eacfd0b86f9c90a2dbf6f07a2b3ff5b4120108f3c26711512edf2b875a782497bdb3d28359325ad95c17951621c4b9c1fd692fde26b77c33

C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\select.pyd

MD5	78d421a4e6b06b5561c45b9a5c6f86b1
SHA1	c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA256	f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
SHA512	83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

C:\Users\Admin\AppData\Local\Temp\onefile_4368_133624180788400277\_ssl.pyd

MD5	11c5008e0ba2caa8adf7452f0aaafd1e
SHA1	764b33b749e3da9e716b8a853b63b2f7711fcc7c
SHA256	bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
SHA512	fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\libcrypto-1_1.dll

MD5	63c4f445b6998e63a1414f5765c18217
SHA1	8c1ac1b4290b122e62f706f7434517077974f40e
SHA256	664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512	aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

C:\Users\Admin\AppData\Local\Temp\onefile_4368_133624180788400277\zstandard\backend_c.pyd

MD5	4652c4087b148d08adefedf55719308b
SHA1	30e06026fea94e5777c529b479470809025ffbe2
SHA256	003f439c27a532d6f3443706ccefac6be4152bebc1aa8bdf1c4adfc095d33795
SHA512	d4972c51ffbce63d2888ddfead2f616166b6f21a0c186ccf97a41c447c1fac6e848f464e4acde05bea5b24c73c5a03b834731f8807a54ee46ca8619b1d0c465d

memory/1452-1205-0x0000000006B70000-0x0000000006B8A000-memory.dmp

memory/1452-1206-0x0000000008B20000-0x00000000090C4000-memory.dmp

memory/1452-1207-0x0000000007A50000-0x0000000007AE2000-memory.dmp

memory/1452-1204-0x0000000007EF0000-0x000000000856A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\onefile_4368_133624180788400277\libssl-1_1.dll

MD5	bd857f444ebbf147a8fcd1215efe79fc
SHA1	1550e0d241c27f41c63f197b1bd669591a20c15b
SHA256	b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA512	2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

memory/1628-1240-0x0000000007AA0000-0x0000000007B43000-memory.dmp

memory/1628-1239-0x0000000006EC0000-0x0000000006EDE000-memory.dmp

memory/1628-1229-0x0000000075210000-0x000000007525C000-memory.dmp

memory/1628-1241-0x0000000007C60000-0x0000000007C6A000-memory.dmp

memory/1628-1243-0x0000000007E50000-0x0000000007EE6000-memory.dmp

memory/1628-1228-0x0000000006E80000-0x0000000006EB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\_socket.pyd

MD5	5dd51579fa9b6a06336854889562bec0
SHA1	99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA256	3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
SHA512	7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\PIL\_imaging.pyd

MD5	1d4aaaf3c2e8dbf96a39ddb901cdda82
SHA1	cf316bf88bfa0c6b207293533f1d2cecbd95e2d4
SHA256	88718894be067dd54e7e07d4dffa8dfc39bed02de65ff92dc5922b2ad2407995
SHA512	e88c1f6507faa883f543d47e892f6a20b6547b29883982550d6772a742510b7570fe47f912da3630ec870669e07773ec4a3d1c38962cebf63bce23b9ac55efbe

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\_lzma.pyd

MD5	5a77a1e70e054431236adb9e46f40582
SHA1	be4a8d1618d3ad11cfdb6a366625b37c27f4611a
SHA256	f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
SHA512	3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\tcl\encoding\cp1252.enc

MD5	5900f51fd8b5ff75e65594eb7dd50533
SHA1	2e21300e0bc8a847d0423671b08d3c65761ee172
SHA256	14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512	ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

C:\Users\Admin\AppData\Local\Temp\onefile_2212_133624180780118898\tk86t.dll

MD5	e3c7ed5f9d601970921523be5e6fce2c
SHA1	a7ee921e126c3c1ae8d0e274a896a33552a4bd40
SHA256	bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77
SHA512	bfa76b6d754259eabc39d701d359dd96f7a4491e63b17826a05a14f8fdf87656e8fc541a40e477e4fef8d0601320dd163199520e66d9ee8b5d6bb5cd9a275901

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_tkinter.pyd

MD5	0f1aa5b9a82b75b607b4ead6bb6b8be6
SHA1	5d58fd899018a106d55433ea4fcb22faf96b4b3d
SHA256	336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190
SHA512	b32ea7d3ed9ae3079728c7f92e043dd0614a4da1dbf40ae3651043d35058252187c3c0ad458f4ca79b8b006575fac17246fb33329f7b908138f5de3c4e9b4e52

C:\Users\Admin\AppData\Local\Temp\onefile_4368_133624180788400277\nexus.exe

MD5	c6ecb950084247ce60fc3b09adfb62c8
SHA1	79f8379f843bf7c670420b50ddc4a0b99b918246
SHA256	b30a422797179d7f11549f9dd60cf2b5c72995afcf0d81f357a35cfd74c7bce5
SHA512	c4729e239db284f6d10e69d62c06970876b88d3fe4527cfdf639a496bb99a6c4416701d3a0d4a0ee7a524c9f05c2d985f872bc9ab830b6a01d2b2c8fe0a211d5

memory/1628-1244-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

memory/1628-1254-0x0000000007E30000-0x0000000007E3E000-memory.dmp

memory/1628-1255-0x0000000007EF0000-0x0000000007F04000-memory.dmp

memory/1628-1256-0x0000000007F30000-0x0000000007F4A000-memory.dmp

memory/1628-1257-0x0000000007F10000-0x0000000007F18000-memory.dmp

C:\Users\Admin\AppData\Roaming\Armory.zip

MD5	76cdb2bad9582d23c1f6f4d868218d6c
SHA1	b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256	8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512	5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\temp_cookies.sqlite

MD5	42c395b8db48b6ce3d34c301d1eba9d5
SHA1	b7cfa3de344814bec105391663c0df4a74310996
SHA256	5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA512	7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

Sample ID	240609-r4zwgacc85
Target	New folder (4).rar
SHA256	27c1530c5875b2dcc4de80b67e0803c0a625814bac19f6a1c7f9046b381d5fec
Tags	xworm execution rat trojan

Malware Analysis Report

2024-09-11 14:56

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files