Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2024 01:28

General

  • Target

    a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81.exe

  • Size

    11.4MB

  • MD5

    34cb7fca8cb671327865d0bcf6de72bc

  • SHA1

    f0b1cedace31b386c893530e6dce75c2ecfef083

  • SHA256

    a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81

  • SHA512

    a09a2fd355e0e7f7a7bf0c25fee3300d7e695f1871514181aef6cb7c5d9f085f6a3003cfea423ad3c79d1b463b2dd3e323c84ae6d8e352483270ee20e520d373

  • SSDEEP

    196608:gcoxkLeUoO9/jmTUkXBnG9u21tvj0brnXiT8QPLaUQrsl2az0Desq3UOF2iQsmR3:rjLQO/64kBUu2vvjU2Tr+UfIaz0DgV2P

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 18 IoCs
  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 24 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 16 IoCs
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81.exe
    "C:\Users\Admin\AppData\Local\Temp\a6a27d9ba682a107558cdb16fcd50ebbe3d112c8dab38e96d5926c522781cc81.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Users\Admin\AppData\Local\Temp\x10.exe
      "C:\Users\Admin\AppData\Local\Temp\x10.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Users\Admin\AppData\Local\Temp\x9.exe
        "C:\Users\Admin\AppData\Local\Temp\x9.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Users\Admin\AppData\Local\Temp\x8.exe
          "C:\Users\Admin\AppData\Local\Temp\x8.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2316
          • C:\Users\Admin\AppData\Local\Temp\x7.exe
            "C:\Users\Admin\AppData\Local\Temp\x7.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2736
            • C:\Users\Admin\AppData\Local\Temp\x6.exe
              "C:\Users\Admin\AppData\Local\Temp\x6.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2548
              • C:\Users\Admin\AppData\Local\Temp\x5.exe
                "C:\Users\Admin\AppData\Local\Temp\x5.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:2480
                • C:\Users\Admin\AppData\Local\Temp\x4.exe
                  "C:\Users\Admin\AppData\Local\Temp\x4.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:848
                  • C:\Users\Admin\AppData\Local\Temp\CheatLauncherV2.exe
                    "C:\Users\Admin\AppData\Local\Temp\CheatLauncherV2.exe"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:2680
                    • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
                      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:2104
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\agentInto\ygzWE.vbe"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2236
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\agentInto\pR9EprN9daTFn7S7o.bat" "
                          12⤵
                          • Loads dropped DLL
                          PID:332
                          • C:\agentInto\fontsessionruntime.exe
                            "C:\agentInto\fontsessionruntime.exe"
                            13⤵
                            • Modifies WinLogon for persistence
                            • UAC bypass
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Checks whether UAC is enabled
                            • Drops file in Program Files directory
                            • Drops file in Windows directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:1396
                            • C:\Users\Public\Favorites\cmd.exe
                              "C:\Users\Public\Favorites\cmd.exe"
                              14⤵
                              • UAC bypass
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • System policy modification
                              PID:1360
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sd03Rq8sfQ.bat"
                                15⤵
                                  PID:664
                                  • C:\Windows\system32\w32tm.exe
                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                    16⤵
                                      PID:2188
                                    • C:\Users\Public\Favorites\cmd.exe
                                      "C:\Users\Public\Favorites\cmd.exe"
                                      16⤵
                                      • UAC bypass
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Suspicious use of AdjustPrivilegeToken
                                      • System policy modification
                                      PID:2404
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3VuZXIL9D7.bat"
                                        17⤵
                                          PID:2400
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            18⤵
                                              PID:2732
                                            • C:\Users\Public\Favorites\cmd.exe
                                              "C:\Users\Public\Favorites\cmd.exe"
                                              18⤵
                                              • UAC bypass
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:2228
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LNTJ9RwtTg.bat"
                                                19⤵
                                                  PID:2368
                                                  • C:\Windows\system32\w32tm.exe
                                                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                    20⤵
                                                      PID:1256
                                                    • C:\Users\Public\Favorites\cmd.exe
                                                      "C:\Users\Public\Favorites\cmd.exe"
                                                      20⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • System policy modification
                                                      PID:292
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yWsVffVfPD.bat"
                                                        21⤵
                                                          PID:996
                                                          • C:\Windows\system32\w32tm.exe
                                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                            22⤵
                                                              PID:1708
                                                            • C:\Users\Public\Favorites\cmd.exe
                                                              "C:\Users\Public\Favorites\cmd.exe"
                                                              22⤵
                                                              • UAC bypass
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:2460
                                    • C:\Users\Admin\AppData\Local\Temp\Built.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                      10⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of WriteProcessMemory
                                      PID:1436
                                      • C:\Users\Admin\AppData\Local\Temp\Built.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Built.exe"
                                        11⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2004
                                    • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
                                      "C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"
                                      10⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2476
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Idle.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:1672
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:1620
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:884
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\services.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:556
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\services.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2880
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\services.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:3060
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\taskhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2116
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\taskhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:984
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\taskhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:1424
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2868
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:1816
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\taskhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:1616
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontsessionruntimef" /sc MINUTE /mo 8 /tr "'C:\Windows\it-IT\fontsessionruntime.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2144
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontsessionruntime" /sc ONLOGON /tr "'C:\Windows\it-IT\fontsessionruntime.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2528
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontsessionruntimef" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\fontsessionruntime.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2968
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Favorites\cmd.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2664
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Public\Favorites\cmd.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2636
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Favorites\cmd.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2728
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontsessionruntimef" /sc MINUTE /mo 12 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\fontsessionruntime.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2152
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontsessionruntime" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\fontsessionruntime.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2944
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontsessionruntimef" /sc MINUTE /mo 10 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\fontsessionruntime.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2440
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre7\lib\explorer.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2368
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:2920
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre7\lib\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Scheduled Task/Job: Scheduled Task
                    PID:1312

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\3VuZXIL9D7.bat
                    Filesize

                    198B

                    MD5

                    ebc0d70fdd9aaa9f7282bd571a141ba9

                    SHA1

                    000565372019086f63a50c5fe8e875dc57ed255a

                    SHA256

                    8bfe3888c969509107b593667b3d685b64f4d65d5d48c015b4cf83a4ee12530c

                    SHA512

                    3582d024b8ab65c2f1f3c44f80a3ff1db7bccec026a0670a5940eb689299edc192d1d9770b82cfda10a89cf1a7c73d4cc1c594357f1393e7872f045c3d386480

                  • C:\Users\Admin\AppData\Local\Temp\CheatLauncherV2.exe
                    Filesize

                    11.4MB

                    MD5

                    108590051fab4871af861b8b12ad1e96

                    SHA1

                    172d10992c078145e1439e85869dcee89e95819b

                    SHA256

                    7d11195746ed7866dce67ebe82dd5c9bdc6f3251528a9d40c22be61612f71d1a

                    SHA512

                    27863d3991e490d69f199d8bf3ea521bee1cfe18336fcf64960c5fa16cd4ec7fc7e4a74f4795b9ffeed194326f6f28dc800569b0e6f7d2bb8647d64f37c2d544

                  • C:\Users\Admin\AppData\Local\Temp\LNTJ9RwtTg.bat
                    Filesize

                    198B

                    MD5

                    438f9c6a0b91a0a2e67d25255861da70

                    SHA1

                    b8de366207dfcac257b8f456afa2bf98dcf07d4e

                    SHA256

                    23372e6ae286e01685e8cc1761309125f74fbf862e35ad6e6b8aeb2861ff52b1

                    SHA512

                    5130541f8dbb8fb6c410914810e30ac2a3ac1c158d4eed0ca9a2e010366db1a0b82d71883f968d0822829b8969e22cc2fc55aa9021ae677d67f67aab8ae2f7db

                  • C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe
                    Filesize

                    13KB

                    MD5

                    6557bd5240397f026e675afb78544a26

                    SHA1

                    839e683bf68703d373b6eac246f19386bb181713

                    SHA256

                    a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239

                    SHA512

                    f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97

                  • C:\Users\Admin\AppData\Local\Temp\_MEI14362\python312.dll
                    Filesize

                    1.7MB

                    MD5

                    fb8bedf8440eb432c9f3587b8114abc0

                    SHA1

                    136bb4dd38a7f6cb3e2613910607131c97674f7c

                    SHA256

                    cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

                    SHA512

                    b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

                  • C:\Users\Admin\AppData\Local\Temp\sd03Rq8sfQ.bat
                    Filesize

                    198B

                    MD5

                    bb5862845a1d8deefe10380db90c498e

                    SHA1

                    43072f6344d75d2e77991c4e7c5f9f1e5f47e120

                    SHA256

                    c116e84625f9d883d853d08bd0eeb44cda150528a0330b54cc6ec253048957fd

                    SHA512

                    65d277c893b81c05c39a8054348e6c28e4b45a7019cc5c3f98353303c2d46eda2475bd0fbf18bb272894e8ff279ea104c409c1635d5452792d678275c2214c0f

                  • C:\Users\Admin\AppData\Local\Temp\x4.exe
                    Filesize

                    11.4MB

                    MD5

                    609a00e116060457295ce9293e6e3b3e

                    SHA1

                    e99114d54d914b0d543e62ff54807d83551a16b6

                    SHA256

                    5cac320a19828d4e3e89428ad877951babaa6739a337ff4c8c2f3b9828d85358

                    SHA512

                    1c1f117e06ca09dab65626bca4cab8ccf4b3073dca564a6cc2dc9e82a752f936150ff75e077db0c906d1248f9ca9bb94d1af8fed616d8e013c548b25033f8fcc

                  • C:\Users\Admin\AppData\Local\Temp\x5.exe
                    Filesize

                    11.4MB

                    MD5

                    8dbee0cb9b7550432df6beb4d9ea5cf0

                    SHA1

                    592502d95f326d76387d85fb48036179a7d15d38

                    SHA256

                    d7ffd20027f5b1b9948e76fa157023c22a86425e026a377684a3947abdb61135

                    SHA512

                    20422414b413c33b1db119488a71322b449db756ecee73c3825fee991fd468a0e09c6ae4b60fe2fd568b0590b77df43937ef8e35d752ff931482519d9fb0c183

                  • C:\Users\Admin\AppData\Local\Temp\yWsVffVfPD.bat
                    Filesize

                    198B

                    MD5

                    2b5c046af8daf9014928798260b6455a

                    SHA1

                    8f8a665e174f6751a2809503d6a30b91b4c03950

                    SHA256

                    1d586db96a494106b4efa4fd60f378e86b7f86cfdc6461c9909053b52eac5646

                    SHA512

                    545b875ef0304e34e7f901b4ecc6c905e91e297f3c7830f807b807d0077447a938501fa97a88282345ee2a65317d86cdd22cef5ec6f40831bffabda04ca6dfa9

                  • C:\agentInto\pR9EprN9daTFn7S7o.bat
                    Filesize

                    37B

                    MD5

                    590bafac5ec119e118eb63489987073c

                    SHA1

                    43b1193a321ea8eb187d478b824b29688e2e40d4

                    SHA256

                    6d73104dd95eb27a2ad2b311cab5fcd401f2aac68cb050eff23e2cbf752a40ac

                    SHA512

                    b81edccf58145f977c683f808fc88d599c25fad5647e958d9da8fc6f016c0d75eaddb44064c46ea487144873ab6648a8a70c074dc9ec4fe8f37711717cef5685

                  • C:\agentInto\ygzWE.vbe
                    Filesize

                    204B

                    MD5

                    1e49f9332d5b41ddcaf97f7c284c16f8

                    SHA1

                    aa9f15475f700366b4b22728dce302b58401850b

                    SHA256

                    d569b2b96fe889ccca95d5296d45a5b05e501bdefbe6216d30a53267a0bcf55a

                    SHA512

                    1487aad116ee07a2abbba90f1290657420057c98e5f7a8a8f308f497ea5176ff7ba77252ce709c84318947834637c171bb69e6dbea9e4d9f3d8e19ca260b652b

                  • \Users\Admin\AppData\Local\Temp\Built.exe
                    Filesize

                    24.0MB

                    MD5

                    68d3ea3afa53dedfd3593d140747b932

                    SHA1

                    757ff4ea1105bdcc861c98872cb28f3a32b170e9

                    SHA256

                    97e31ae693f118965c81672374dfa269f2b5c3c2b9502ac983f8b5817d5d0002

                    SHA512

                    b72adb6eed395db98f9bd3452c82252807320ed682cd585714fa4d526b6644ea873a62914f5fed2989fcf85f7b2e9472e37c2e3bbfb92867a2747ccee8ef8048

                  • \Users\Admin\AppData\Local\Temp\DCRatBuild.exe
                    Filesize

                    4.3MB

                    MD5

                    2edb71dd3792b6f6a774edbf67bb78d2

                    SHA1

                    7a8cff8359caec23a66212118ce4edd1e239bfeb

                    SHA256

                    9daadd6e7cbd889a2a05fa94d2876710542332a79782cec38c09e9079415b6ae

                    SHA512

                    aa9bb70014a07b181960bd9ea1c1106f046f123f24a263c45ab58a461245e141a0ad3af7d7b17e0cc59675fe1934f62a735756d52d068474690828fe6b44719f

                  • \Users\Admin\AppData\Local\Temp\x10.exe
                    Filesize

                    11.4MB

                    MD5

                    b93fc536df3c66e783fcbb9071db7545

                    SHA1

                    ce29bc506242c2389366f67edb3b36577d01f778

                    SHA256

                    9267614f67e94feeeae12c00f294e8af4587cf74ce817d179098d7e17ef24874

                    SHA512

                    4b4a87624eb5f23a13ac55acc874e9444c41b54a772e3d89a5a383a476d09db6dcdac69bc914645fe8c3102ea050a4dbede65f379c4f51aa1fdeb01e8194b1e6

                  • \Users\Admin\AppData\Local\Temp\x6.exe
                    Filesize

                    11.4MB

                    MD5

                    61f5d17c10de6541139134fb7058f88e

                    SHA1

                    a6df4a45aab40753023f2fdd7efd32ae9a226ff5

                    SHA256

                    914287ad713df86ea9fed9f86cd963f88eb22de143d8892b7ef055fd45dba567

                    SHA512

                    28b66e1cb8334e806139c8b30ec3100010abf277d9d2e5eecf99ac837fb384ca5bf76de2549bf4faf92614cfaa6a861abbe75055248242d9dc392c319375a900

                  • \Users\Admin\AppData\Local\Temp\x7.exe
                    Filesize

                    11.4MB

                    MD5

                    0e9fee8861c55c0ebadc5f678fbd8a9a

                    SHA1

                    c760e5d24b60902f566529af6ddaf2b90e319046

                    SHA256

                    866d6644ccce8d86d9526ef959ee5ddd9414e35750a1a10968035063ffa694d8

                    SHA512

                    f3461f6e0c0004a0b56578efd83d7fd3f79ec47ad8e0848ae14d21bb585ecbfec9770296382f63054395e636ba911b9e4bcc3f88c0eb9b73e542ad1f5d0b869e

                  • \Users\Admin\AppData\Local\Temp\x8.exe
                    Filesize

                    11.4MB

                    MD5

                    dd97aab085b140b715dd1a52038e3c70

                    SHA1

                    21a8cbffa7c31a3ae0493b8567b528faba5c4fe9

                    SHA256

                    42be65ad4df6bf83ce6a30c1a159921463571c32faf372af53a5edab641ea7aa

                    SHA512

                    7ad65e44d706e304c493895eec33a538937de13a13b0af7b13be95be0615177d78e1eb3b8cbd06e5612dc7bcf522d2c9abd5c6ab4efacf20052bdf7e09bc4ba2

                  • \Users\Admin\AppData\Local\Temp\x9.exe
                    Filesize

                    11.4MB

                    MD5

                    7e5f18a5c7eb009e54ae4fc6127e864c

                    SHA1

                    e9217d8f28de469a091ce420c5f74abd5e77ae92

                    SHA256

                    60f981607fdd0547fa8afb700fbfc0cc8fcac163bc819e36bbd859ce5594b016

                    SHA512

                    2a4ef3c3c13a59ca681e189b662952583f5d124bd7cb5f8690aa30c44871fda2db9839b55bc26e0e53af7f0447e910d405a3693aacbd214e13a62b13f11061ed

                  • \agentInto\fontsessionruntime.exe
                    Filesize

                    4.0MB

                    MD5

                    6cf5f23f1c8ca3bc6342506baac300da

                    SHA1

                    18affb87f0e996d202f0be3b8109701120ea3995

                    SHA256

                    f3ee0a31d29b515d2e0bf776507897ca3ef5605d0470adcc4163209ba78e3445

                    SHA512

                    66830da8515a32f3cf03149f0b23398265cbad452be1e81bfbaa2fb553e607ab498b2e6d2af06d9ec840236c2fe7d964443ed4f2ab4d9e50bd07ecf1aa70335b

                  • memory/1360-198-0x0000000000800000-0x0000000000812000-memory.dmp
                    Filesize

                    72KB

                  • memory/1360-197-0x0000000000810000-0x0000000000C12000-memory.dmp
                    Filesize

                    4.0MB

                  • memory/1360-199-0x0000000002300000-0x0000000002312000-memory.dmp
                    Filesize

                    72KB

                  • memory/1396-163-0x0000000000D00000-0x0000000000D08000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-164-0x0000000000D10000-0x0000000000D1C000-memory.dmp
                    Filesize

                    48KB

                  • memory/1396-166-0x0000000000E40000-0x0000000000E4C000-memory.dmp
                    Filesize

                    48KB

                  • memory/1396-160-0x0000000000CB0000-0x0000000000CBC000-memory.dmp
                    Filesize

                    48KB

                  • memory/1396-173-0x0000000001330000-0x000000000133A000-memory.dmp
                    Filesize

                    40KB

                  • memory/1396-172-0x0000000001320000-0x0000000001328000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-156-0x0000000000600000-0x0000000000610000-memory.dmp
                    Filesize

                    64KB

                  • memory/1396-154-0x00000000005D0000-0x00000000005DC000-memory.dmp
                    Filesize

                    48KB

                  • memory/1396-158-0x0000000000C60000-0x0000000000CB6000-memory.dmp
                    Filesize

                    344KB

                  • memory/1396-171-0x0000000001310000-0x0000000001318000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-170-0x0000000001300000-0x0000000001308000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-169-0x00000000012F0000-0x00000000012FE000-memory.dmp
                    Filesize

                    56KB

                  • memory/1396-168-0x00000000012E0000-0x00000000012EC000-memory.dmp
                    Filesize

                    48KB

                  • memory/1396-167-0x0000000000E50000-0x0000000000E58000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-165-0x0000000000DA0000-0x0000000000DA8000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-146-0x0000000001340000-0x0000000001742000-memory.dmp
                    Filesize

                    4.0MB

                  • memory/1396-157-0x0000000000610000-0x000000000061A000-memory.dmp
                    Filesize

                    40KB

                  • memory/1396-161-0x0000000000CC0000-0x0000000000CC8000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-174-0x000000001AC30000-0x000000001AC3C000-memory.dmp
                    Filesize

                    48KB

                  • memory/1396-162-0x0000000000CD0000-0x0000000000CE2000-memory.dmp
                    Filesize

                    72KB

                  • memory/1396-153-0x00000000005F0000-0x0000000000602000-memory.dmp
                    Filesize

                    72KB

                  • memory/1396-155-0x00000000005E0000-0x00000000005E8000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-152-0x00000000003B0000-0x00000000003B8000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-151-0x0000000000390000-0x00000000003A6000-memory.dmp
                    Filesize

                    88KB

                  • memory/1396-150-0x0000000000380000-0x0000000000388000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-149-0x00000000002E0000-0x00000000002FC000-memory.dmp
                    Filesize

                    112KB

                  • memory/1396-148-0x00000000002D0000-0x00000000002D8000-memory.dmp
                    Filesize

                    32KB

                  • memory/1396-147-0x00000000001C0000-0x00000000001CE000-memory.dmp
                    Filesize

                    56KB

                  • memory/1396-159-0x00000000006A0000-0x00000000006AC000-memory.dmp
                    Filesize

                    48KB

                  • memory/2004-131-0x000007FEF58E0000-0x000007FEF5FA5000-memory.dmp
                    Filesize

                    6.8MB

                  • memory/2228-235-0x0000000000FA0000-0x00000000013A2000-memory.dmp
                    Filesize

                    4.0MB

                  • memory/2228-236-0x00000000004F0000-0x0000000000502000-memory.dmp
                    Filesize

                    72KB

                  • memory/2404-228-0x0000000002490000-0x00000000024A2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2404-227-0x0000000000E90000-0x0000000000EA2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2404-226-0x00000000008B0000-0x0000000000CB2000-memory.dmp
                    Filesize

                    4.0MB

                  • memory/2460-249-0x000000001B0D0000-0x000000001B0E2000-memory.dmp
                    Filesize

                    72KB

                  • memory/2476-138-0x0000000000E00000-0x0000000000E0A000-memory.dmp
                    Filesize

                    40KB