revengerat | e214f08d95ac7a1ef1b9b99283723d17deb663eaf5f5fe5625bb81e88cff37d6

Analysis

max time kernel
147s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe
Size 111KB
Sample240708-3afraathkp
SHA256 e214f08d95ac7a1ef1b9b99283723d17deb663eaf5f5fe5625bb81e88cff37d6
MD5 2e3037f15c76457e5390a7c5b540153f
SHA1 0c4cc2dff8d70af9280b3f8c79e693313e5f6d81
SHA512 9a526b7aa2a8b9ae0f68acab920de652a7e6f9e85757683b80560bf3b5aa18f01c49f1468648476eaf53e3fc6a5b928457915a696d6c69f6af6eeec0368b1ca5
SSDEEP 1536:OsVeuQ+fKE+Q2zvjd0ty9ZWWbLMpTnz1rAWXM4AAhrkSqyIt5vtdVZHMBpkGE:poEYzbdgy9ZWWbIh2AM4AgrBLIXJZJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat trampo_csharp persistence stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Trampo_csharp

queda2122.ddns.net:333

Mutex

RV_MUTEX-swUnoWrUUgHR

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/1480-5-0x0000000000CB0000-0x0000000000CBA000-memory.dmp	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation	2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rfkjkfjwwwwwwwwwwwwwkfjlfee.lnk	operadebor.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	operadebor.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\Documents\\operadebor.exe"	operadebor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe
Token: SeDebugPrivilege	1396	operadebor.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1396	1480	2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe	87
PID 1480 wrote to memory of 1396	1480	2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe	87
PID 1396 wrote to memory of 464	1396	operadebor.exe	90
PID 1396 wrote to memory of 464	1396	operadebor.exe	90
PID 464 wrote to memory of 4560	464	vbc.exe	92
PID 464 wrote to memory of 4560	464	vbc.exe	92
PID 1396 wrote to memory of 1216	1396	operadebor.exe	93
PID 1396 wrote to memory of 1216	1396	operadebor.exe	93
PID 1216 wrote to memory of 556	1216	vbc.exe	95
PID 1216 wrote to memory of 556	1216	vbc.exe	95
PID 1396 wrote to memory of 216	1396	operadebor.exe	96
PID 1396 wrote to memory of 216	1396	operadebor.exe	96
PID 216 wrote to memory of 4836	216	vbc.exe	98
PID 216 wrote to memory of 4836	216	vbc.exe	98
PID 1396 wrote to memory of 4544	1396	operadebor.exe	99
PID 1396 wrote to memory of 4544	1396	operadebor.exe	99
PID 4544 wrote to memory of 4600	4544	vbc.exe	101
PID 4544 wrote to memory of 4600	4544	vbc.exe	101
PID 1396 wrote to memory of 5032	1396	operadebor.exe	102
PID 1396 wrote to memory of 5032	1396	operadebor.exe	102
PID 5032 wrote to memory of 852	5032	vbc.exe	104
PID 5032 wrote to memory of 852	5032	vbc.exe	104
PID 1396 wrote to memory of 1384	1396	operadebor.exe	105
PID 1396 wrote to memory of 1384	1396	operadebor.exe	105
PID 1384 wrote to memory of 4632	1384	vbc.exe	107
PID 1384 wrote to memory of 4632	1384	vbc.exe	107
PID 1396 wrote to memory of 4760	1396	operadebor.exe	108
PID 1396 wrote to memory of 4760	1396	operadebor.exe	108
PID 4760 wrote to memory of 1944	4760	vbc.exe	110
PID 4760 wrote to memory of 1944	4760	vbc.exe	110
PID 1396 wrote to memory of 748	1396	operadebor.exe	111
PID 1396 wrote to memory of 748	1396	operadebor.exe	111
PID 748 wrote to memory of 1256	748	vbc.exe	113
PID 748 wrote to memory of 1256	748	vbc.exe	113
PID 1396 wrote to memory of 4840	1396	operadebor.exe	114
PID 1396 wrote to memory of 4840	1396	operadebor.exe	114
PID 4840 wrote to memory of 3832	4840	vbc.exe	116
PID 4840 wrote to memory of 3832	4840	vbc.exe	116
PID 1396 wrote to memory of 4664	1396	operadebor.exe	117
PID 1396 wrote to memory of 4664	1396	operadebor.exe	117
PID 4664 wrote to memory of 1664	4664	vbc.exe	119
PID 4664 wrote to memory of 1664	4664	vbc.exe	119

C:\Users\Admin\AppData\Local\Temp\2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e3037f15c76457e5390a7c5b540153f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\Documents\operadebor.exe
  "C:\Users\Admin\Documents\operadebor.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fugwhkph.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES97F5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5EB622F3634541919A88326DC6A859B5.TMP"
      4⤵
      PID:4560
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mv4_vn5v.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9853.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43B504CD9013468598867CDE1E821C.TMP"
      4⤵
      PID:556
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rhibyfen.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5713B0D877D242499514AD34787B04B.TMP"
      4⤵
      PID:4836
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zykdkte0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES992E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38EDFFDD1E174F74885423BCE51D122.TMP"
      4⤵
      PID:4600
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xoi2ewi8.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES998C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB4D25E003A141BF8376DB4C3C691EE3.TMP"
      4⤵
      PID:852
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wv-qul8x.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99F9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc853481E3D7B84DB5A4C2E0D2CD32BF2F.TMP"
      4⤵
      PID:4632
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n6kffjzu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A66.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc54DDA166F13C44BBAE3157CCA33DABEA.TMP"
      4⤵
      PID:1944
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z1pmehzp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AC4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD74BDF901D14482696D9FE2236AD8D4.TMP"
      4⤵
      PID:1256
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aqbqnmy_.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B31.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4EEF4CBCCF2D4CCDBC1BFBD349FFFBFC.TMP"
      4⤵
      PID:3832
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dhu42rhh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B9F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C313A7E6D7D480CAB67F667A815EDAB.TMP"
      4⤵
      PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES97F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES97F5.tmp
Size 1KB
SHA256 8db15c3902a5e91728d8b212d24f497d390d9a29cd64071d37828db66a1eaf83
MD5 262534bd56e69de641fa413388d61e4a
SHA1 1929035a895f0a9336bc4f7e58c7213b914c6333
SHA512 bd0dd5a989c1b3dae7332fbb82dedae3681bc4d87efc842ffb8473d94ebfa4cf7ee30fdc1ffa7774ef7d42475eec4a13963a19467f1a09265c3d0260a7a04387
MD5 SHA1 SHA512

Submit Download

RES9853.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9853.tmp
Size 1KB
SHA256 87432c980db17ebbbe27c5236726af9cd68314f5ea79de2c9c0b093b4c452a78
MD5 cd3a93ce09b1e8a3255b6eac0866089e
SHA1 bb6dfc1583d303c358440ec8e4e2b7c952ec5bdc
SHA512 f3deaf3e52f7ef08475e58fee2acf05d30924f538bf7146746cffbf8d34f5c038fc5c51e3afd798074208af25720744576edbeedc576138888281a8ba7417cb6
MD5 SHA1 SHA512

Submit Download

RES98C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES98C0.tmp
Size 1KB
SHA256 66d8b1279c2eeca977137ea24d8dd9e1fe189e4afdd104b1e8be5e442cdf3fd3
MD5 861aed573a0fd7f2044b43e41e048165
SHA1 beede5cff5f584860bbf8bd62f96397895b11cd3
SHA512 7f643b1a891036b9b8d9e0be74446a9cbc9e67e96ac7daf00402576ce0d948ef7ceda1bc2d8f255489d3560d1e18291563d7bd52fb9f606a2011b77953572992
MD5 SHA1 SHA512

Submit Download

RES992E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES992E.tmp
Size 1KB
SHA256 fb03fc17b44ad5b06f789f3aa8a859a8682db9e460f2aedc9ccd176862ac9cb2
MD5 2a3456c70974237c16141f921c4ad9b6
SHA1 bff75a477cff3c03c2fc7a495f1c768c1b1fd8c2
SHA512 e8728c90ae5e32df91378c0032317cb2d563dcf513287914796cef8e517db643e921c5e095d72982e7a45f5549b45bc7160eb77e0eb8e2b8555c9f66e074f401
MD5 SHA1 SHA512

Submit Download

RES998C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES998C.tmp
Size 1KB
SHA256 03f648cb6baa7fb62c1e901ce92801ec503fc8ec316bbd8e2736cf8d43ac24f0
MD5 69a91bb589e555f228d34da2d49d474a
SHA1 9353e5eece510f3316b690d3908ced96b4cee19e
SHA512 b6e9b78b20e229b8e42d9df56db24607575164a6100407dc8a36432c82d05872ac48c5ea93e7467f8b42cb26835053c120cecfb9b85028ae3faa133fbdbad098
MD5 SHA1 SHA512

Submit Download

RES99F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES99F9.tmp
Size 1KB
SHA256 d390dad0902ed255ea9b1d9e35dc7125ab43867ce1a40fee460675176438b664
MD5 498a8ae6a61898f53de4f3eb8a90a357
SHA1 c09952fa582c232828d9549925ed552d4e904d2c
SHA512 ea167c15bf2908f6429e236ad798c8445f10dc62c389d1d7140af9df613332ac86d21f204836796bc3e58602d06cf112ebf671774b98d7f8e9a9a3d7ba547ad7
MD5 SHA1 SHA512

Submit Download

RES9A66.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9A66.tmp
Size 1KB
SHA256 87a5bdba390158e112bbe6aec5dabfce471de6ed5b5fdb862eccb75f3522f2fa
MD5 2aa5995ccb7f08a6de83ef0180bf3c0f
SHA1 af9a9978ee4e77301717ae1a9469f959a384d7ed
SHA512 f0b6ab30fc7b3b0ce4bc7e7dd1261c989f4ed3080b2533c6c51e4135b8da68fcd8c7045308d087a00826da69bd25d382df42584b479e1f79d9d368b1b85420c3
MD5 SHA1 SHA512

Submit Download

RES9AC4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9AC4.tmp
Size 1KB
SHA256 1d8063e899c853d26bb8b0cbe60bae38eddd6c02d3c37c38c1dc96e996b17890
MD5 f6fdb9c4e903ab84c8bdebe61fdc3558
SHA1 ca02def30ec77504b8e1962e8f261b8384acda2b
SHA512 3c33963d84923024e4d7844d34fcad710b80eb54b0ec585de9b7cb1d32b75554cd861bb7f0a39d4de89b08ef630fc3bf827601157e3b11ff01275df90e88bfc5
MD5 SHA1 SHA512

Submit Download

RES9B31.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9B31.tmp
Size 1KB
SHA256 c3230521e30dc11de5adda55c093a7fbebd1b15d2f5d7649394c9aba65614155
MD5 6ba37949b458e4ba2da6dd7602f5f51d
SHA1 052d520428b7f560bd63c76322291deace7b9d72
SHA512 2dba2cf6c7cbf4b67d4d63422997dba2130b518d6e4041a1dd0360918ccd9b04dc6d7b62a8924257e3fee0a046f33dc5461f55129d8bfcd3c5952cd513673ff7
MD5 SHA1 SHA512

Submit Download

RES9B9F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9B9F.tmp
Size 1KB
SHA256 4bd0d6a2f217d8b29f1019e14f6ce047ca4ecc0a6099c136dfebb69d4184aca9
MD5 2831bedcc3482deb15c4f51e2d934dc1
SHA1 fb533d6ce57da8a663c1142ed710b13f8a8b636c
SHA512 ab3bfbe5f7f041d1725413303dabd66f783a30e1c97a34ac428583064a328d58666381274aa780c2cb247ab76ccecdbc3e697043a0d6d43d3c95c2984e4365b1
MD5 SHA1 SHA512

Submit Download

aqbqnmy_.0.vb

Path C:\Users\Admin\AppData\Local\Temp\aqbqnmy_.0.vb
Size 288B
SHA256 f62f75f8780d60e09195ba636e7bc475cb2bc9d3ee50fc43c16b60797fec2eae
MD5 d3694b6e582ea560351b2ad385d78fcd
SHA1 b56f1f04702e3140231a7e0fee60184441249833
SHA512 3c0cf6ca3d4bdcc80da08be80f79d20d6c224ff57ddd2fb2e7b16a704cde377ebb8b41cdc4e1d4fbd121c58290149c25e8f4cb998cfa216c764ca380d3efd9ab
MD5 SHA1 SHA512

Submit Download

aqbqnmy_.cmdline

Path C:\Users\Admin\AppData\Local\Temp\aqbqnmy_.cmdline
Size 180B
SHA256 46981928553b4b59603ed4f0e6da3b13da758eb3eab62846ba41fc88f2cedac6
MD5 43ba810f3450a00af08e77b0559fbef0
SHA1 8fd621624d5f2780b723a706bcc3ed89e108333f
SHA512 27d9974ee46996a058b863bf0e6df789462303475c981a06e5cba35e913984cb272b0924b07484ae701adf0f280090d0083366c91a02832b4d32d3e81d689f7f
MD5 SHA1 SHA512

Submit Download

dhu42rhh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\dhu42rhh.0.vb
Size 291B
SHA256 86102b30a8c984e2be11df050267bcc1ff7ac8f5496699195783b783b896df62
MD5 2608adf0ec1b1cfcddac6f242b60bf34
SHA1 ec63206bf58c820e8a73c44571b97bfe0a1a16e5
SHA512 573ef64a64738c069d936d7a7e92a7acb983e3c2fe53a6e77c1eb06b634e6c9ba0289ab1c2b3608f66ba10a7e962f9f4dbbbff8354c5aa868359564e726df2da
MD5 SHA1 SHA512

Submit Download

dhu42rhh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\dhu42rhh.cmdline
Size 183B
SHA256 0d452cadb87407a0ecb1a2b01add6e72599c07ea724f58bc0b67fee072d349f8
MD5 7dbd303f92716b0819e643d379bb2f1c
SHA1 d105be78628cf7dbddc5847ba9436990f4a3ce1f
SHA512 35ca3f1d5d0955ad24bf5fe7145e419af8c632cce7191da82d217a39d0cf7b0cfe21d0f78fa532fdbaab032f4d41292cc08706e4c516e90367797566576282cd
MD5 SHA1 SHA512

Submit Download

fugwhkph.0.vb

Path C:\Users\Admin\AppData\Local\Temp\fugwhkph.0.vb
Size 269B
SHA256 9bccc164f895cc6ca1c9bade3ef45969eaf76c3395c4e355f7adf623c80319f9
MD5 88e991bab2f8158cda4c3314ade7eb68
SHA1 927395d8a61e8721767d738013c072e18af7cf58
SHA512 85ec412e1def4e634b5c7358f132afc8a8913035027080dca58b9b2c258ef8335ab631716f730ad912d27e2071583b752d2ce7b5a43d658df01c88416edf4c82
MD5 SHA1 SHA512

Submit Download

fugwhkph.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fugwhkph.cmdline
Size 161B
SHA256 66098dc37d89168aaf4430dd0b82e39634dbf28116c2b8c8e21858a62d9c1c0d
MD5 8f8b9d8759c95b7cf973dd93b9706ac8
SHA1 44866b68745e96496a8dc01594a00daf49fa672e
SHA512 720f8497fce9db5934160e802d6addba74132a126a782cb0b4769a00eadb99f1a7d453e87d116b69f31d5441ef610d3d294fb90674f2bce006eeb591b50dedb5
MD5 SHA1 SHA512

Submit Download

mv4_vn5v.0.vb

Path C:\Users\Admin\AppData\Local\Temp\mv4_vn5v.0.vb
Size 275B
SHA256 c13eecb5cd2d7c906d6c86f7e417ac97f6e3b221e448318c962c6c1a7813634c
MD5 25df4fadde1de1173e199dbdc0cbe4b5
SHA1 50d3668b19ad8e74f673e210752f65aff3c8bdc5
SHA512 de5e1a3bd5f5c9559e621cda8023301384c0200d365e052539fdd46327eb7454a578984f100335c59bc530365d42a5d747524a86c051e9ea5fb15f27ac695e4c
MD5 SHA1 SHA512

Submit Download

mv4_vn5v.cmdline

Path C:\Users\Admin\AppData\Local\Temp\mv4_vn5v.cmdline
Size 167B
SHA256 591e5784462c560b5718ed6ce794713c0fdf76e10749ca251d368a352b9ac1b1
MD5 85cdb78a20c97d63e543b073fae17aba
SHA1 29a8afe9afd6956dc2131a300b90f147fb530b1a
SHA512 5588ac2d5afc441e86804e39db9f89f5cca38df9fc524af3bd4c57e785fad405654fd1da9ada369e7d4601b7d713b9243a0c1da72c2eca548a53b664675a45f4
MD5 SHA1 SHA512

Submit Download

n6kffjzu.0.vb

Path C:\Users\Admin\AppData\Local\Temp\n6kffjzu.0.vb
Size 292B
SHA256 1fd70e526640c2a5772c3560bce3f5408871e04775abde30b4e17f6a9bf7521e
MD5 68cb43c03faad176d66a561b5f88a7fd
SHA1 a6ad43945d9db59f1fa16ef1123b1a53834dba42
SHA512 a620df5769a9c378ef425c4abe588a1c13aee1364b5ecab1a66833b3c3c1c837abff17eac2c0f386dc6a288eee46976842a8233cfdabc99d535d224596d6a1b5
MD5 SHA1 SHA512

Submit Download

n6kffjzu.cmdline

Path C:\Users\Admin\AppData\Local\Temp\n6kffjzu.cmdline
Size 184B
SHA256 977d0df76d1a9fd4aeab7a27c18959a241e7c9a8659034be89345bebddc617a9
MD5 47b1d3bba0d84a8d95c35ebe0001fa50
SHA1 3928a53649f444ea1d573b4cac986179745bc741
SHA512 77a4f072800457c7469bc8eb972b8f4e8478d4b906aa1d7126ea080e99b6613eb67cac39aa8f66280bc28a87b5e99de469f5b43fd32d42479a66c701252411d0
MD5 SHA1 SHA512

Submit Download

rhibyfen.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rhibyfen.0.vb
Size 276B
SHA256 5c343254fd41ebf4062ccce07aa2e95f5aa4bf2bf91ecdcfc1edcdb09beb7f38
MD5 3ccaf230b29d03f1e908430e0dc397ce
SHA1 6444abff3fb17364b0d7bff6ad1095ec00288dab
SHA512 14d9fbce424d8ab2672fad1828dfafb80a287a1931bb64c00c0d8d96ac395f7f3eca7274a8aa332edb57bd238049810a11a8a814cdcbd96308366c2a94e74667
MD5 SHA1 SHA512

Submit Download

rhibyfen.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rhibyfen.cmdline
Size 168B
SHA256 9d74d7bfdabc8228e03667b7723b4b06bcdf317f23c962e7824d8096630eebc6
MD5 3d9caadc78d54479b44734743767d45f
SHA1 f02d527e9bbbae9e69e660869930c3647666ef17
SHA512 eec630f794f00223f81fecf218800df2533d83e8945506b3df0337c01207a9649acbe41cc8ebf4dd0425c653a526560f212f616731882220e51ea61ac9366b0d
MD5 SHA1 SHA512

Submit Download

vbc1C313A7E6D7D480CAB67F667A815EDAB.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1C313A7E6D7D480CAB67F667A815EDAB.TMP
Size 684B
SHA256 453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
MD5 7a707b422baa7ca0bc8883cbe68961e7
SHA1 addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA512 81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
MD5 SHA1 SHA512

Submit Download

vbc43B504CD9013468598867CDE1E821C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc43B504CD9013468598867CDE1E821C.TMP
Size 668B
SHA256 0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
MD5 3906bddee0286f09007add3cffcaa5d5
SHA1 0e7ec4da19db060ab3c90b19070d39699561aae2
SHA512 0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
MD5 SHA1 SHA512

Submit Download

vbc54DDA166F13C44BBAE3157CCA33DABEA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc54DDA166F13C44BBAE3157CCA33DABEA.TMP
Size 684B
SHA256 e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
MD5 8135713eeb0cf1521c80ad8f3e7aad22
SHA1 1628969dc6256816b2ab9b1c0163fcff0971c154
SHA512 a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4
MD5 SHA1 SHA512

Submit Download

vbc5713B0D877D242499514AD34787B04B.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc5713B0D877D242499514AD34787B04B.TMP
Size 676B
SHA256 f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
MD5 85c61c03055878407f9433e0cc278eb7
SHA1 15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA512 7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756
MD5 SHA1 SHA512

Submit Download

vbc5EB622F3634541919A88326DC6A859B5.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc5EB622F3634541919A88326DC6A859B5.TMP
Size 644B
SHA256 2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
MD5 dac60af34e6b37e2ce48ac2551aee4e7
SHA1 968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA512 1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
MD5 SHA1 SHA512

Submit Download

wv-qul8x.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wv-qul8x.0.vb
Size 289B
SHA256 aa25d6d24a6d28290a7ef141e059efca34392c307a54f62374050f3e5113d966
MD5 27f019228a64e9310756975e226995a9
SHA1 aeff2782708985366f636f65de7f9d426b9a41a5
SHA512 3b929ee7e55f12462cf692f82426132cc2afa577f805114d2b72f8af85da6afb840981c4fe78b3799fbf8cef6c5790d7e96e1a29b5a00b38f172d364d2219b71
MD5 SHA1 SHA512

Submit Download

wv-qul8x.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wv-qul8x.cmdline
Size 181B
SHA256 f87aab0db42906453a3e6f7ab6f33fc5463cd5fc0e95f7e09c04d25b78b6b145
MD5 e89e4266509c6942b3622102522056dc
SHA1 26203df01059bc48c6efcc970006e277eed9a1f0
SHA512 719a8c7ad02c08ec59d2ccc0bfe0acd560d651ad850fcf32564ebfb0b534957e339c472f39059a080ec6d389a6f1dcaa7c50a580452851bd77612c4a657a1ca6
MD5 SHA1 SHA512

Submit Download

xoi2ewi8.0.vb

Path C:\Users\Admin\AppData\Local\Temp\xoi2ewi8.0.vb
Size 289B
SHA256 94a79f3eec25b6d562bdaf3d9ffb562fc9adb956a99560bfb358c18184b92b16
MD5 93c4f3d98c9e0ebeb3d50c9fb65fa8c7
SHA1 0293fb88e98a9907e9fde7d3e6487b86de4b4a33
SHA512 9d8da142209f5b1f7bcadeb240fded588c20486aeb32d417ef5be75a879072c37acf31cd7b700e0398fd638be5261a65b2f952d63ec8bade67dcc42179adb5bf
MD5 SHA1 SHA512

Submit Download

xoi2ewi8.cmdline

Path C:\Users\Admin\AppData\Local\Temp\xoi2ewi8.cmdline
Size 181B
SHA256 985dd0f5e360c0f97ab423ec359319fb7e24aacb87ee421290b9b765de754423
MD5 5bb355b1fa60087661b45443541fab3e
SHA1 bbe0896f5c4e32c1c6fac18bc8508ecc352cf964
SHA512 e602ab30eb08541bd66b372c3235f7fe107d2e25386abc9b0be0d30110b66cee4f813eed47dd7553f2dd6f8ef828f8d3d465b620baf8b8929dc839a1590c807b
MD5 SHA1 SHA512

Submit Download

z1pmehzp.0.vb

Path C:\Users\Admin\AppData\Local\Temp\z1pmehzp.0.vb
Size 282B
SHA256 68341e860a2925fb28d983d313e6314eeb1b8cd2b801feeaecaf651648dbb8b2
MD5 fe984f600d54a5111936ab8fc94cbd7d
SHA1 1446a029859e2e49ff058f8d534c6773e69aab98
SHA512 c65a45af045a3ce26209e71a0ff4e10f9892a115371593e3c18d8a3d563c2bf6018bf48de7307305a5f931797d7319c7ffe7401946f237c2994ec2147b726bb6
MD5 SHA1 SHA512

Submit Download

z1pmehzp.cmdline

Path C:\Users\Admin\AppData\Local\Temp\z1pmehzp.cmdline
Size 174B
SHA256 cf87bf952554e48754da53a9803a5cbfabe7fe9cacbcbae9002478cc4e1ca0b1
MD5 54fb38fdcad80a15d9c141b7d7f21d3c
SHA1 efc54af85f5ff5acff5e8128a017a892bbfc6484
SHA512 90d2ef7304f9b96368728f81526a011ccede8eee66fbc55d7afdf719241df8eb79c6b43f557fe6e2a4201a896e6e7f6b019ef54efc8ebc852e35fa1e47fd7e47
MD5 SHA1 SHA512

Submit Download

zykdkte0.0.vb

Path C:\Users\Admin\AppData\Local\Temp\zykdkte0.0.vb
Size 288B
SHA256 458f9f69ef54512e6159ee080ffd45a4c1486d7ce68e557f15da9312a16e58d7
MD5 d9ac56cd0e428b228f6c8d134d4f1968
SHA1 e9799abb9ba7391748f19c31e24805d0cb79fbb8
SHA512 d50ceba3a299f70ca84fc0804fbe6272612ab630869a83265617e8a598a122b1c4d44507184eb7f7e04fc34cfa12c9040259b90e0a1de37b3b2e716ebf2dae53
MD5 SHA1 SHA512

Submit Download

zykdkte0.cmdline

Path C:\Users\Admin\AppData\Local\Temp\zykdkte0.cmdline
Size 180B
SHA256 0bb423e3b2288335f78c97caceb302b5029dae25977c1ebc70f7ba824356676c
MD5 c76c3e0f49bb6222674b79eac37149f7
SHA1 c116ec211a619951f53c23d7ea810ed768e772e5
SHA512 f481297a63e0efc63ab4b7e2fb84cb7a1ee0722f965da6d5eb831848c1a34ed05b6368370e06d32dfefd0c8b83b717f917a78541f2ceac5d06dd10e1d88cb123
MD5 SHA1 SHA512

Submit Download

operadebor.exe

Path C:\Users\Admin\Documents\operadebor.exe
Size 111KB
SHA256 e214f08d95ac7a1ef1b9b99283723d17deb663eaf5f5fe5625bb81e88cff37d6
MD5 2e3037f15c76457e5390a7c5b540153f
SHA1 0c4cc2dff8d70af9280b3f8c79e693313e5f6d81
SHA512 9a526b7aa2a8b9ae0f68acab920de652a7e6f9e85757683b80560bf3b5aa18f01c49f1468648476eaf53e3fc6a5b928457915a696d6c69f6af6eeec0368b1ca5
SSDEEP 1536:OsVeuQ+fKE+Q2zvjd0ty9ZWWbLMpTnz1rAWXM4AAhrkSqyIt5vtdVZHMBpkGE:poEYzbdgy9ZWWbIh2AM4AgrBLIXJZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1396-24-0x00007FF959400000-0x00007FF959DA1000-memory.dmp

Download

memory/1396-23-0x00007FF959400000-0x00007FF959DA1000-memory.dmp

Download

memory/1480-22-0x00007FF959400000-0x00007FF959DA1000-memory.dmp

Download

memory/1480-9-0x00007FF959400000-0x00007FF959DA1000-memory.dmp

Download

memory/1480-0-0x00007FF9596B5000-0x00007FF9596B6000-memory.dmp

Download

memory/1480-8-0x00007FF9596B5000-0x00007FF9596B6000-memory.dmp

Download

memory/1480-7-0x000000001C1A0000-0x000000001C202000-memory.dmp

Download

memory/1480-6-0x000000001CA20000-0x000000001CEEE000-memory.dmp

Download

memory/1480-5-0x0000000000CB0000-0x0000000000CBA000-memory.dmp

Download

memory/1480-4-0x00007FF959400000-0x00007FF959DA1000-memory.dmp

Download

memory/1480-3-0x000000001BB50000-0x000000001C05E000-memory.dmp

Download

memory/1480-2-0x000000001B590000-0x000000001B636000-memory.dmp

Download

memory/1480-1-0x00007FF959400000-0x00007FF959DA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads