dcrat | 1a95e485f4ae28b3526839f632e2d199d0652ba9e05215138a8e6fc9df0299ac

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HAKPYTKA.exe
Size 10.8MB
Sample240625-yem9psyerc
SHA256 1a95e485f4ae28b3526839f632e2d199d0652ba9e05215138a8e6fc9df0299ac
MD5 9814abbdbe367ec137f8b8343220def8
SHA1 338f121e293f6c4c71c7796d3d843ba75082aa13
SHA512 7ddbcbe0dc09d92f79fa7f427e357e767e3f093013768028ce4c3fea48290f4249916e7bc09086ee35ab3d23094ae42b9e2341ce175fef802f295b646b5c64d8
SSDEEP 196608:ZqwXwi468T8Xc9tlwNy9hxmAudIbq0aCV4uyR6fb8ofmr8ej9gI7+N3N:RR4XT8sblw+BH8MfbLWgI7+hN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023491-4.dat	dcrat
behavioral2/files/0x0007000000023490-21.dat	dcrat
behavioral2/files/0x000a00000002348a-26.dat	dcrat
behavioral2/files/0x0007000000023492-35.dat	dcrat

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	HAKPYTKA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	temp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	appdata.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	system.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	kiler.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe	kiler.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.exe	kiler.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kiler.url	kiler.exe

Executes dropped EXE 10 IoCs

pid	Process
1472	C.exe
1968	appdata.exe
3312	temp.exe
2588	system.exe
5000	TRXLoader.exe
4000	kiler.exe
3884	TRXLoader.exe
4004	kiler.exe
4988	kiler.exe
3128	kiler.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .."	kiler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiler.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kiler.exe\" .."	kiler.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240607437	HAKPYTKA.exe
File opened for modification	C:\Windows\appdata.exe	HAKPYTKA.exe
File opened for modification	C:\Windows\C.exe	HAKPYTKA.exe
File created	C:\Windows\bat.bat	HAKPYTKA.exe
File opened for modification	C:\Windows\TRXLoader.exe	HAKPYTKA.exe
File created	C:\Windows\C.exe	HAKPYTKA.exe
File created	C:\Windows\system.exe	HAKPYTKA.exe
File created	C:\Windows\temp.exe	HAKPYTKA.exe
File opened for modification	C:\Windows\temp.exe	HAKPYTKA.exe
File created	C:\Windows\kiler.exe	HAKPYTKA.exe
File opened for modification	C:\Windows\kiler.exe	HAKPYTKA.exe
File created	C:\Windows\appdata.exe	HAKPYTKA.exe
File opened for modification	C:\Windows\system.exe	HAKPYTKA.exe
File created	C:\Windows\TRXLoader.exe	HAKPYTKA.exe
File opened for modification	C:\Windows\bat.bat	HAKPYTKA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4396	5000	WerFault.exe	90
2648	3884	WerFault.exe	106

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2944	timeout.exe
3964	timeout.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
3844	TASKKILL.exe
4000	TASKKILL.exe
2364	TASKKILL.exe
4248	taskkill.exe
5024	TASKKILL.exe
1496	TASKKILL.exe
4932	TASKKILL.exe
3352	TASKKILL.exe
1220	TASKKILL.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	temp.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	appdata.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	system.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	C.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe
4000	kiler.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4000	kiler.exe
Token: SeDebugPrivilege	1496	TASKKILL.exe
Token: SeDebugPrivilege	4932	TASKKILL.exe
Token: SeDebugPrivilege	4004	kiler.exe
Token: SeDebugPrivilege	3352	TASKKILL.exe
Token: SeDebugPrivilege	1220	TASKKILL.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: SeDebugPrivilege	3844	TASKKILL.exe
Token: SeDebugPrivilege	5024	TASKKILL.exe
Token: SeDebugPrivilege	4988	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: SeDebugPrivilege	3128	kiler.exe
Token: SeDebugPrivilege	2364	TASKKILL.exe
Token: SeDebugPrivilege	4000	TASKKILL.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe
Token: 33	4004	kiler.exe
Token: SeIncBasePriorityPrivilege	4004	kiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1472	4468	HAKPYTKA.exe	83
PID 4468 wrote to memory of 1472	4468	HAKPYTKA.exe	83
PID 4468 wrote to memory of 1472	4468	HAKPYTKA.exe	83
PID 4468 wrote to memory of 1968	4468	HAKPYTKA.exe	85
PID 4468 wrote to memory of 1968	4468	HAKPYTKA.exe	85
PID 4468 wrote to memory of 1968	4468	HAKPYTKA.exe	85
PID 4468 wrote to memory of 3312	4468	HAKPYTKA.exe	86
PID 4468 wrote to memory of 3312	4468	HAKPYTKA.exe	86
PID 4468 wrote to memory of 3312	4468	HAKPYTKA.exe	86
PID 4468 wrote to memory of 2588	4468	HAKPYTKA.exe	87
PID 4468 wrote to memory of 2588	4468	HAKPYTKA.exe	87
PID 4468 wrote to memory of 2588	4468	HAKPYTKA.exe	87
PID 4468 wrote to memory of 4572	4468	HAKPYTKA.exe	88
PID 4468 wrote to memory of 4572	4468	HAKPYTKA.exe	88
PID 4468 wrote to memory of 5000	4468	HAKPYTKA.exe	90
PID 4468 wrote to memory of 5000	4468	HAKPYTKA.exe	90
PID 4468 wrote to memory of 5000	4468	HAKPYTKA.exe	90
PID 4468 wrote to memory of 4000	4468	HAKPYTKA.exe	91
PID 4468 wrote to memory of 4000	4468	HAKPYTKA.exe	91
PID 4468 wrote to memory of 4000	4468	HAKPYTKA.exe	91
PID 4000 wrote to memory of 1496	4000	kiler.exe	92
PID 4000 wrote to memory of 1496	4000	kiler.exe	92
PID 4000 wrote to memory of 1496	4000	kiler.exe	92
PID 4000 wrote to memory of 4932	4000	kiler.exe	93
PID 4000 wrote to memory of 4932	4000	kiler.exe	93
PID 4000 wrote to memory of 4932	4000	kiler.exe	93
PID 3312 wrote to memory of 1220	3312	temp.exe	97
PID 3312 wrote to memory of 1220	3312	temp.exe	97
PID 3312 wrote to memory of 1220	3312	temp.exe	97
PID 2588 wrote to memory of 2628	2588	system.exe	99
PID 2588 wrote to memory of 2628	2588	system.exe	99
PID 2588 wrote to memory of 2628	2588	system.exe	99
PID 1968 wrote to memory of 3196	1968	appdata.exe	95
PID 1968 wrote to memory of 3196	1968	appdata.exe	95
PID 1968 wrote to memory of 3196	1968	appdata.exe	95
PID 1472 wrote to memory of 996	1472	C.exe	98
PID 1472 wrote to memory of 996	1472	C.exe	98
PID 1472 wrote to memory of 996	1472	C.exe	98
PID 4572 wrote to memory of 2944	4572	cmd.exe	102
PID 4572 wrote to memory of 2944	4572	cmd.exe	102
PID 4572 wrote to memory of 3964	4572	cmd.exe	105
PID 4572 wrote to memory of 3964	4572	cmd.exe	105
PID 4572 wrote to memory of 3884	4572	cmd.exe	106
PID 4572 wrote to memory of 3884	4572	cmd.exe	106
PID 4572 wrote to memory of 3884	4572	cmd.exe	106
PID 4000 wrote to memory of 4004	4000	kiler.exe	119
PID 4000 wrote to memory of 4004	4000	kiler.exe	119
PID 4000 wrote to memory of 4004	4000	kiler.exe	119
PID 4000 wrote to memory of 3080	4000	kiler.exe	120
PID 4000 wrote to memory of 3080	4000	kiler.exe	120
PID 4000 wrote to memory of 3080	4000	kiler.exe	120
PID 4004 wrote to memory of 3352	4004	kiler.exe	122
PID 4004 wrote to memory of 3352	4004	kiler.exe	122
PID 4004 wrote to memory of 3352	4004	kiler.exe	122
PID 4004 wrote to memory of 1220	4004	kiler.exe	123
PID 4004 wrote to memory of 1220	4004	kiler.exe	123
PID 4004 wrote to memory of 1220	4004	kiler.exe	123
PID 3080 wrote to memory of 3020	3080	cmd.exe	126
PID 3080 wrote to memory of 3020	3080	cmd.exe	126
PID 3080 wrote to memory of 3020	3080	cmd.exe	126
PID 4004 wrote to memory of 4248	4004	kiler.exe	130
PID 4004 wrote to memory of 4248	4004	kiler.exe	130
PID 4004 wrote to memory of 4248	4004	kiler.exe	130
PID 4004 wrote to memory of 2100	4004	kiler.exe	132

C:\Users\Admin\AppData\Local\Temp\HAKPYTKA.exe
"C:\Users\Admin\AppData\Local\Temp\HAKPYTKA.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\C.exe
  "C:\Windows\C.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\BlockproviderComponentweb\LzYuX9pzQxeIw.vbe"
    3⤵
    PID:996
- C:\Windows\appdata.exe
  "C:\Windows\appdata.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\BlockproviderComponentweb\FlrU2Sw3hI88Kq0oMKFqlJBcKKk7.vbe"
    3⤵
    PID:3196
- C:\Windows\temp.exe
  "C:\Windows\temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BlockproviderComponentweb\rLN2CzC2BGDm0saFwwqZ.vbe"
    3⤵
    PID:1220
- C:\Windows\system.exe
  "C:\Windows\system.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProviderwebRuntimebrokerDll\AzoUH9rmryPf4YVykgERWga1ZsG.vbe"
    3⤵
    PID:2628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\bat.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\timeout.exe
    timeout 5 nul
    3⤵
    - Delays execution with timeout.exe
    PID:2944
- - C:\Windows\system32\timeout.exe
    timeout 3 nul
    3⤵
    - Delays execution with timeout.exe
    PID:3964
- - C:\Windows\TRXLoader.exe
    TRXLOADER
    3⤵
    - Executes dropped EXE
    PID:3884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 1056
      4⤵
      Program crash
      PID:2648
- C:\Windows\TRXLoader.exe
  "C:\Windows\TRXLoader.exe"
  2⤵
  - Executes dropped EXE
  PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1068
    3⤵
    - Program crash
    PID:4396
- C:\Windows\kiler.exe
  "C:\Windows\kiler.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\kiler.exe
    "C:\Users\Admin\AppData\Local\Temp\kiler.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3352
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f im Wireshark.exe
      4⤵
      Kills process with taskkill
      PID:4248
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\kiler.exe
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Windows\kiler.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 5
      4⤵
      PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5000 -ip 5000
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3884 -ip 3884
1⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\kiler.exe
C:\Users\Admin\AppData\Local\Temp\kiler.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4988
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5024

C:\Users\Admin\AppData\Local\Temp\kiler.exe
C:\Users\Admin\AppData\Local\Temp\kiler.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LzYuX9pzQxeIw.vbe

Path C:\BlockproviderComponentweb\LzYuX9pzQxeIw.vbe
Size 224B
SHA256 b0ebc32dafa29a57b91c73ac0b89242da68d40cd470c262d4cc0361ba0cd8b95
MD5 ac65a75f2ee29bca1ced3f4279f35192
SHA1 905f99dc033b80377da593dfaa03ca9dea86521b
SHA512 8ddfbc73ce949e48b270fd1717fe42d035c54d14cbb17f1764e98ae17305d26bc246deb254b0d439f314133e574b6c2bd8b1f1611cbf07eecbb569251f4c6206
MD5 SHA1 SHA512

Submit Download

AzoUH9rmryPf4YVykgERWga1ZsG.vbe

Path C:\ProviderwebRuntimebrokerDll\AzoUH9rmryPf4YVykgERWga1ZsG.vbe
Size 227B
SHA256 c21e88d44eb247ab02667e37de05d2e10ecc27bdfdc0f380778494570b5377db
MD5 4a854cad3f93b3e5c68443bedd1f8de1
SHA1 b71b93f98f49c7d334a09c80bac424db005913de
SHA512 b5a0db320eeecb1ab7c72376d3cf42f1c2c9aa659456dcad1f66696b6d0c0b83daa46b04e993d69aa7f0ac8ad4324a1a86e3e3d7dbd41d39d8e727e80a6c7541
MD5 SHA1 SHA512

Submit Download

kiler.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\kiler.exe.log
Size 319B
SHA256 d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03
MD5 824ba7b7eed8b900a98dd25129c4cd83
SHA1 54478770b2158000ef365591d42977cb854453a1
SHA512 ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e
MD5 SHA1 SHA512

Submit Download

rLN2CzC2BGDm0saFwwqZ.vbe

Path C:\Users\Admin\AppData\Local\Temp\BlockproviderComponentweb\rLN2CzC2BGDm0saFwwqZ.vbe
Size 214B
SHA256 25f85a5bcaed5fadfba4b5368f224468e602e8991225b1fc2176cec26672cd81
MD5 c6e17f78ef2cab853baa01a81f114972
SHA1 246165f27b7d3d2ac642c5230f7ca09e39dd36a6
SHA512 84384b504dfceb204d15b8961f25ac40b6747014a4a4eb7b1ed2948c5d90e36db782c11d034f18f8cf18e53d3c6635d7d0fc6bb43866a464a24e02695dc13061
MD5 SHA1 SHA512

Submit Download

FlrU2Sw3hI88Kq0oMKFqlJBcKKk7.vbe

Path C:\Users\Admin\AppData\Roaming\BlockproviderComponentweb\FlrU2Sw3hI88Kq0oMKFqlJBcKKk7.vbe
Size 215B
SHA256 32eaa92211f658207acdfa9cf61ffb6ec96330e6918d35943c3562a8323bcc37
MD5 f31a6303fa711859b55f1823d797c287
SHA1 8a56aaf8ed61bbee69334a1bdb6330351c448102
SHA512 a9e9b9ebe96e79cc49e441896eb80af50aafd378c9f52cf5bfd50feae7b2a54369ceb47fe186a054ee1f30e70bf0507189de71c871a55c05e9a92d0c2ac12d02
MD5 SHA1 SHA512

Submit Download

C.exe

Path C:\Windows\C.exe
Size 3.1MB
SHA256 fb1ad76b6875612578539b3bf70c93438165465dd6b4cd128a692cfed974e5f7
MD5 918f850b87799087aab3391985a3c81a
SHA1 9ff3cb6d0d3694d10acdda212826b9ffb7759f78
SHA512 ca1abdfc6a2007f516c46d8446c76e0e02c1087ceb38827e41c84f352b17175a7c4ffac18cc2283a7fb690324685a2acb1b310f234f755aafa1bcdc645bbbf1a
SSDEEP 98304:UbZVh6nMYilqdVyNNjOwn2cvPYNbtuc5p4Pw8l:UtQM3A+NjOOSLucXb8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

TRXLoader.exe

Path C:\Windows\TRXLoader.exe
Size 260KB
SHA256 0b58a2bed7d9d44e29ad6988250456c49863a23adeb9b5ab59763352187104b3
MD5 34c74de92902c31e066659a644b18e1d
SHA1 e368167e728bb5e8abb98c3a9cd2f8711f98a74d
SHA512 0f620b097464ad66870d2a00525ae7f93dbae6a665578d90ec0c6499f431afb4265a20b57e25cd8a0cb11aadf4486d1307546265112bbbfe9c583bc6afce6e19
SSDEEP 6144:vVXHnvPNmT1POp3Zy8kOvRVP1sfanHJK/GA8lkroufAHzzi5aFn1k7IZO535rx9n:dXHHNmT1Gp3Zy8kOvRVP1sfanHJK/GAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

appdata.exe

Path C:\Windows\appdata.exe
Size 3.1MB
SHA256 0813184d94537f7f52e27a48733ce01ab3f8a40c807f8b1e3e876a0857270b98
MD5 84d84c88f059dcc80c8b8269bda163d0
SHA1 94ca3cdba45a6961a19162cfc9eaa85a65be21ea
SHA512 778ee47a7ee2967ffaa101d2de287be8545adfbd26e1d7f9944d8b3f5c238751bb48aa73f64ea1d1180692b383792281504bd6d54ec9446f2396fed4090255fc
SSDEEP 49152:UbA30ZS5NxAsiy2UVy3GR8ST6YnrhVxhtoIOwI3Xbm4RR61yuqqm:UbdEqs4GLWywUI3q4RR9uhm
MD5 SHA1 SHA512 SSDEEP

Submit Download

bat.bat

Path C:\Windows\bat.bat
Size 119B
SHA256 00152452af8ee061522a67570238605f9c2e1d41a92bd49fd8e476f8e824cf1a
MD5 78882687e53597231c9f3d7934bdf9e8
SHA1 94f243e9656e53d4c7f50533733a2192c9d08b97
SHA512 e6c32ea8815c40456be3a1964c531e9a5352440a8e1f1b20230e1121c2447364b5dadfa455f3db614ebf44e7648540d830d444f8806758f3108b09907cd6941a
MD5 SHA1 SHA512

Submit Download

kiler.exe

Path C:\Windows\kiler.exe
Size 249KB
SHA256 77d822158965fe6c07d02d6fd22590f2fd5b67b0fb2f1f0b080bf8f627687c63
MD5 8bb7f3314ffb6329e0a2e94489df2579
SHA1 33abb1c5671a8a08e45712a7417ccba94cac8f61
SHA512 1ca4b92ded899e01550f0fbb362842692137f72e63301453880fb39e342d9b8be98c35b53cb50821009c33fe3a2ab986ecfdf4dee80e04f31669f20e2caa1193
SSDEEP 3072:oa8mjXNiz3XE1dXl9FAmAMvtF/2QyS+LD2Dv+GHF+aabl2d09vKKp2DFsqzV4IOw:Cm+8XvDv7gNILHg/bV9vKeLNw
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.exe

Path C:\Windows\system.exe
Size 3.1MB
SHA256 7d0a7d85531fa4e95cad06073ce5fc918c1a1607f8b7c3da9ea0d765d3ab9dad
MD5 3a8e20e9b2e9f923d8c7f73e0a4cf725
SHA1 300070b3025f282e63af63a4751762e6309dbd95
SHA512 8892c7cce62bd29d40b66415a1847fec2cf75c181ec3ddcc8e628db4775cf2fb5de0505eb61ce44c36813462c48a18945ed53f9bf7c2734a202194ed3c932d8a
SSDEEP 49152:UbA30y7K1YHcrwOQ1rxqjSMk4fxiaJjvsZfFdFjLhe60EzvbntBYdN7N:Ubr17QxqWMDfcaJjUVdLhedETbnYdZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.exe

Path C:\Windows\temp.exe
Size 3.1MB
SHA256 3cb7f2e31e0d726f91631cdc0a44e8c97282e48a23a76521346df13f159d6e16
MD5 7d43fffdbeb71e7ff79251ebf8b558a7
SHA1 00ef8701369d0308bc50876e75db78f803cccaa0
SHA512 78971890e29f929bd9913ebbfff5f324590b82582be168427e939f123d9f9f1ee264643b0489deb12711e41d58e6bfd0678ab63fcfc4a945a01909aad8b04da4
SSDEEP 98304:UbqxjQCA6jUC0ktgFM2fvjj5NJL06TpWsGVt0Gg:U2xhUIWFM2fvx06TosWGt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5000-61-0x00000000009D0000-0x0000000000A16000-memory.dmp

Download