njrat | 64787cd5380092f4842918dde01f0bfe92c133a925cdaef9f7289e6e53af4eed

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10-07-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d.exe
Size

7.7MB
MD5

6ca08efccb785d2b8c23c54a05930356
SHA1

c4de56535545a5a6555af998b2b3fbb254637625
SHA256

64787cd5380092f4842918dde01f0bfe92c133a925cdaef9f7289e6e53af4eed
SHA512

8da14f29989d5c99b0335be45951e4e87dccabefccae73a8e5cf13d91e6d47fcf1408b9020a965015b15175239f6d732d8cd4b6b11e07b232386827984b77b14
SSDEEP

196608:p9xmKlBELQL73HTSddEVnvbG3eVvMJxOf2X6QDpTrTMA:Yf03QdEc3eJMJxOf25VT3D

Score

10^/10

njrat umbral xworm evasion execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1255561908631900262/FBfFOJC5RNZ6gSVwbGsinrWT1Tk0AcX2fxXrs9EMYvCvgKrDx5R4TOUhy9LGN7mz_JKs

Extracted

Family

xworm

Version

5.0

testarosa.duckdns.org:7110

Mutex

5ZpeoOe6AtQfr6wU

Attributes

Install_directory
%AppData%
install_file
Ondrive.exe

aes.plain

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000002ab70-65.dat	family_umbral
behavioral2/memory/4192-68-0x0000019FA4370000-0x0000019FA43B0000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/492-69-0x0000000000C80000-0x0000000000C90000-memory.dmp	family_xworm
behavioral2/files/0x000100000002ab72-70.dat	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
4960	powershell.exe
3740	powershell.exe
3236	powershell.exe
2244	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1464	netsh.exe

Executes dropped EXE 10 IoCs

pid	Process
2708	Server.exe
4776	3.exe
1436	Server.exe
1468	msxml6.EXE
492	conhost.exe
4192	3.exe
3956	conhost.exe
4624	server.exe
3036	Ondrive.exe
2680	Ondrive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Windows\CurrentVersion\Run\6a8a3b6e5450a823d542e748a454aa4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6a8a3b6e5450a823d542e748a454aa4c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
22	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3420	wmic.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1736	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1560	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
492	conhost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4192	3.exe
3740	powershell.exe
3740	powershell.exe
4980	powershell.exe
4980	powershell.exe
4068	powershell.exe
4068	powershell.exe
4352	powershell.exe
4352	powershell.exe
3236	powershell.exe
3236	powershell.exe
2244	powershell.exe
2244	powershell.exe
5072	powershell.exe
5072	powershell.exe
4972	powershell.exe
4972	powershell.exe
4960	powershell.exe
4960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	d.exe
Token: SeDebugPrivilege	492	conhost.exe
Token: SeDebugPrivilege	3956	conhost.exe
Token: SeDebugPrivilege	4192	3.exe
Token: SeIncreaseQuotaPrivilege	4040	wmic.exe
Token: SeSecurityPrivilege	4040	wmic.exe
Token: SeTakeOwnershipPrivilege	4040	wmic.exe
Token: SeLoadDriverPrivilege	4040	wmic.exe
Token: SeSystemProfilePrivilege	4040	wmic.exe
Token: SeSystemtimePrivilege	4040	wmic.exe
Token: SeProfSingleProcessPrivilege	4040	wmic.exe
Token: SeIncBasePriorityPrivilege	4040	wmic.exe
Token: SeCreatePagefilePrivilege	4040	wmic.exe
Token: SeBackupPrivilege	4040	wmic.exe
Token: SeRestorePrivilege	4040	wmic.exe
Token: SeShutdownPrivilege	4040	wmic.exe
Token: SeDebugPrivilege	4040	wmic.exe
Token: SeSystemEnvironmentPrivilege	4040	wmic.exe
Token: SeRemoteShutdownPrivilege	4040	wmic.exe
Token: SeUndockPrivilege	4040	wmic.exe
Token: SeManageVolumePrivilege	4040	wmic.exe
Token: 33	4040	wmic.exe
Token: 34	4040	wmic.exe
Token: 35	4040	wmic.exe
Token: 36	4040	wmic.exe
Token: SeIncreaseQuotaPrivilege	4040	wmic.exe
Token: SeSecurityPrivilege	4040	wmic.exe
Token: SeTakeOwnershipPrivilege	4040	wmic.exe
Token: SeLoadDriverPrivilege	4040	wmic.exe
Token: SeSystemProfilePrivilege	4040	wmic.exe
Token: SeSystemtimePrivilege	4040	wmic.exe
Token: SeProfSingleProcessPrivilege	4040	wmic.exe
Token: SeIncBasePriorityPrivilege	4040	wmic.exe
Token: SeCreatePagefilePrivilege	4040	wmic.exe
Token: SeBackupPrivilege	4040	wmic.exe
Token: SeRestorePrivilege	4040	wmic.exe
Token: SeShutdownPrivilege	4040	wmic.exe
Token: SeDebugPrivilege	4040	wmic.exe
Token: SeSystemEnvironmentPrivilege	4040	wmic.exe
Token: SeRemoteShutdownPrivilege	4040	wmic.exe
Token: SeUndockPrivilege	4040	wmic.exe
Token: SeManageVolumePrivilege	4040	wmic.exe
Token: 33	4040	wmic.exe
Token: 34	4040	wmic.exe
Token: 35	4040	wmic.exe
Token: 36	4040	wmic.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeIncreaseQuotaPrivilege	3404	wmic.exe
Token: SeSecurityPrivilege	3404	wmic.exe
Token: SeTakeOwnershipPrivilege	3404	wmic.exe
Token: SeLoadDriverPrivilege	3404	wmic.exe
Token: SeSystemProfilePrivilege	3404	wmic.exe
Token: SeSystemtimePrivilege	3404	wmic.exe
Token: SeProfSingleProcessPrivilege	3404	wmic.exe
Token: SeIncBasePriorityPrivilege	3404	wmic.exe
Token: SeCreatePagefilePrivilege	3404	wmic.exe
Token: SeBackupPrivilege	3404	wmic.exe
Token: SeRestorePrivilege	3404	wmic.exe
Token: SeShutdownPrivilege	3404	wmic.exe
Token: SeDebugPrivilege	3404	wmic.exe
Token: SeSystemEnvironmentPrivilege	3404	wmic.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2708	4708	d.exe	84
PID 4708 wrote to memory of 2708	4708	d.exe	84
PID 4708 wrote to memory of 4776	4708	d.exe	85
PID 4708 wrote to memory of 4776	4708	d.exe	85
PID 2708 wrote to memory of 1436	2708	Server.exe	87
PID 2708 wrote to memory of 1436	2708	Server.exe	87
PID 2708 wrote to memory of 1436	2708	Server.exe	87
PID 4708 wrote to memory of 1468	4708	d.exe	86
PID 4708 wrote to memory of 1468	4708	d.exe	86
PID 2708 wrote to memory of 492	2708	Server.exe	89
PID 2708 wrote to memory of 492	2708	Server.exe	89
PID 4776 wrote to memory of 4192	4776	3.exe	90
PID 4776 wrote to memory of 4192	4776	3.exe	90
PID 4776 wrote to memory of 3956	4776	3.exe	91
PID 4776 wrote to memory of 3956	4776	3.exe	91
PID 4192 wrote to memory of 4040	4192	3.exe	92
PID 4192 wrote to memory of 4040	4192	3.exe	92
PID 4192 wrote to memory of 5060	4192	3.exe	97
PID 4192 wrote to memory of 5060	4192	3.exe	97
PID 4192 wrote to memory of 3740	4192	3.exe	122
PID 4192 wrote to memory of 3740	4192	3.exe	122
PID 4192 wrote to memory of 4980	4192	3.exe	101
PID 4192 wrote to memory of 4980	4192	3.exe	101
PID 4192 wrote to memory of 4068	4192	3.exe	103
PID 4192 wrote to memory of 4068	4192	3.exe	103
PID 4192 wrote to memory of 4352	4192	3.exe	105
PID 4192 wrote to memory of 4352	4192	3.exe	105
PID 4192 wrote to memory of 3404	4192	3.exe	107
PID 4192 wrote to memory of 3404	4192	3.exe	107
PID 492 wrote to memory of 3236	492	conhost.exe	109
PID 492 wrote to memory of 3236	492	conhost.exe	109
PID 4192 wrote to memory of 1416	4192	3.exe	111
PID 4192 wrote to memory of 1416	4192	3.exe	111
PID 4192 wrote to memory of 3676	4192	3.exe	113
PID 4192 wrote to memory of 3676	4192	3.exe	113
PID 492 wrote to memory of 2244	492	conhost.exe	115
PID 492 wrote to memory of 2244	492	conhost.exe	115
PID 4192 wrote to memory of 5072	4192	3.exe	117
PID 4192 wrote to memory of 5072	4192	3.exe	117
PID 4192 wrote to memory of 3420	4192	3.exe	119
PID 4192 wrote to memory of 3420	4192	3.exe	119
PID 492 wrote to memory of 4972	492	conhost.exe	121
PID 492 wrote to memory of 4972	492	conhost.exe	121
PID 492 wrote to memory of 4960	492	conhost.exe	123
PID 492 wrote to memory of 4960	492	conhost.exe	123
PID 4192 wrote to memory of 1204	4192	3.exe	125
PID 4192 wrote to memory of 1204	4192	3.exe	125
PID 1204 wrote to memory of 1736	1204	cmd.exe	127
PID 1204 wrote to memory of 1736	1204	cmd.exe	127
PID 492 wrote to memory of 1560	492	conhost.exe	128
PID 492 wrote to memory of 1560	492	conhost.exe	128
PID 1436 wrote to memory of 4624	1436	Server.exe	130
PID 1436 wrote to memory of 4624	1436	Server.exe	130
PID 1436 wrote to memory of 4624	1436	Server.exe	130
PID 4624 wrote to memory of 1464	4624	server.exe	131
PID 4624 wrote to memory of 1464	4624	server.exe	131
PID 4624 wrote to memory of 1464	4624	server.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5060	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d.exe
"C:\Users\Admin\AppData\Local\Temp\d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\Server.exe
  "C:\Users\Admin\AppData\Local\Temp\Server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Roaming\Server.exe
    "C:\Users\Admin\AppData\Roaming\Server.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1464
- - C:\Users\Admin\AppData\Roaming\conhost.exe
    "C:\Users\Admin\AppData\Roaming\conhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\conhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'conhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Ondrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4972
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ondrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4960
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Ondrive" /tr "C:\Users\Admin\AppData\Roaming\Ondrive.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1560
- C:\Users\Admin\AppData\Local\Temp\3.exe
  "C:\Users\Admin\AppData\Local\Temp\3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Roaming\3.exe
    "C:\Users\Admin\AppData\Roaming\3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4040
  - - C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\3.exe"
      4⤵
      Views/modifies file attributes
      PID:5060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4352
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3404
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:1416
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:3676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5072
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3420
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\3.exe" && pause
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        Runs ping.exe
        
        PID:1736
- - C:\Users\Admin\AppData\Roaming\conhost.exe
    "C:\Users\Admin\AppData\Roaming\conhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- C:\Users\Admin\AppData\Local\Temp\msxml6.EXE
  "C:\Users\Admin\AppData\Local\Temp\msxml6.EXE"
  2⤵
  - Executes dropped EXE
  PID:1468

C:\Users\Admin\AppData\Roaming\Ondrive.exe
C:\Users\Admin\AppData\Roaming\Ondrive.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Users\Admin\AppData\Roaming\Ondrive.exe
C:\Users\Admin\AppData\Roaming\Ondrive.exe
1⤵
- Executes dropped EXE
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log

Filesize
319B

MD5
e7df52bc2fea4cb49c9c749bd9f8d618

SHA1
fd956953e48f15d113f59be5e6a6534d32f2a25a

SHA256
65a906ff066056f5d93198115645da23ab4f880aad5d85f2fab41248b5831373

SHA512
538d0e3958b2b6a2d876e64ed70518aeba857b4effece13c930417754e2df23b612c7368bc4d8344bb9b10b721916d4ff2529cbac86142993170aa1d1918bae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
fa21dd50b4e64421076f843031c8ccf7

SHA1
2c56e94f130c0d8d77116e939ffee4e37cf982bd

SHA256
e4f21aca1e12aafa8de7af24b79a75526e902c7d4b3fea5bdb6e723976997be3

SHA512
b8de2bfeb7af06c587dd1f424d410cf83471f31a55a3ea4c4481ce07ffd9bf66ddc1f7775ecd6ac65ac33baaec90ba5a208a9aefc84f31125a50dfb919982687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7332074ae2b01262736b6fbd9e100dac

SHA1
22f992165065107cc9417fa4117240d84414a13c

SHA256
baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

SHA512
4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5ea3327eacf4267694da8db0a3e1ae01

SHA1
81331a00784b84e045225ba8f90247933e1a6fa0

SHA256
65ab24a37883a340cad2c240fbb5b76c48de5a76b60759fb223e353854f678b5

SHA512
6c90e220d6fa68b0db76f5f890d19264e56139c7eb280caf14d865c18d7cbf08f41fdf155f9ae09c16bab21bec69106ad19ebf94018f6bac8403e8803cd4d24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77054a8c47be5d56f41c4c7437744953

SHA1
346a911a417c9274ebce3facb9a7cdec68472f45

SHA256
45a3b051d45e1d0a7ec9b22a38075a8cc6f587500a0ea58551391482c6f8a8ab

SHA512
dba2341b212cf92b8644788a7cef57bc369df2980c4864a7863c93c09f928ad5782a527be1d322102ca11bff5ce859ddf2c5923b317e1967c578f644cea204d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
050567a067ffea4eb40fe2eefebdc1ee

SHA1
6e1fb2c7a7976e0724c532449e97722787a00fec

SHA256
3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e

SHA512
341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0b59f3fa12628f63b5713c4833570d7f

SHA1
badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb

SHA256
2332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d

SHA512
01724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.exe

Filesize
274KB

MD5
ed59c6590b199b2ee53eec444322472b

SHA1
6c91f4e2489a9869ab971061fdd67a0eeb1e7007

SHA256
aa4abbb1305525b1703a23521db1e817dfd39f014527c319a16a153d2d9dcb0f

SHA512
7dd903995d2c673a3778c5f4f5006cdf3e177ad9093649e5e953894e49f386049ae1e58103095874f09b91d4e21d963d05f02ea9644ed67dd3054aa10b47ba97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Server.exe

Filesize
71KB

MD5
f9b08bd21b40a938122b479095b7c70c

SHA1
eb925e3927b83c20d8d24bdab2e587c10d6ac8cd

SHA256
c96cde2e96021c266a202286d644ceb28543d6347e21006d72b29b8a72c505e8

SHA512
fcc5784936b7f85a550883c472b99b5edfa7e5c6fd3872fd806b81c2ce1f195ca34342b230a89456066885579fe55aea46d91074ac08af192fbd04ea158473ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1nqzhqih.y0n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msxml6.EXE

Filesize
7.7MB

MD5
8b39a0c9d351c316ae38251db3e917da

SHA1
71c988393af62584e93ebe721a600c1a51fa7c29

SHA256
aacbefe172556a5df9e5bf52834aaa22893002edeb46533e1a85866cc7462a15

SHA512
092f06c5f373a65be4f4784357596422df1bb50dcd81c0056464c70f99a0845d71e6819f01c8e7a2ca3f663ad4125588b6e48d88ec0736e7305a70bd8c59e9af

Download Submit
C:\Users\Admin\AppData\Roaming\3.exe

Filesize
227KB

MD5
66d7e8125484efe9585adf807f3860ec

SHA1
aad54a84cc6bfcd422631bfce7b187b001ec0128

SHA256
9cc7b63b2a2c95cfdd1f0f9044f6f760d8dae0d622aa07cb18ce071d9c491d4e

SHA512
f0eabf14bab037689568dc6f7bb6126d1c5922e08432b650e338567c7ae2d70d1ac3420dfec0501453a0e8fece11482071434137e70d62e1136dd482a791d5d5

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe

Filesize
23KB

MD5
32fe01ccb93b0233503d0aaaa451f7b2

SHA1
58e5a63142150e8fb175dbb4dedea2ce405d7db0

SHA256
6988ee719a54c93a89303dcff277c62ae4890274cc45f074bc7effde315fbf43

SHA512
76945f23a49d594e325d80ffc0570341044ac0b97bd889c92f90bc56d3cdff5c1b29178be4f157c8c1bb9ce7cc311765309f2e6f7b08b24e7acf983ea67635a6

Download Submit
C:\Users\Admin\AppData\Roaming\conhost.exe

Filesize
37KB

MD5
b37dd1a1f0507baf993471ae1b7a314c

SHA1
9aff9d71492ffff8d51f8e8d67f5770755899882

SHA256
e58e8918a443c0061add029f8f211f6551a130202195cc2b9b529ea72553e0bc

SHA512
ac76d5b10540eb292341f30c7abfd81f03be65f6655c814aba6ac6a0ecf4f0f2c34c3b8e63ceef8c4579f98b7459e51b9fdd30d601c6d1930860ab7c154da460

Download Submit
memory/492-69-0x0000000000C80000-0x0000000000C90000-memory.dmp

Filesize
64KB

Download
memory/2708-25-0x0000000000D90000-0x0000000000DA8000-memory.dmp

Filesize
96KB

Download
memory/2708-72-0x00007FFE9E0C0000-0x00007FFE9EB82000-memory.dmp

Filesize
10.8MB

Download
memory/2708-29-0x00007FFE9E0C0000-0x00007FFE9EB82000-memory.dmp

Filesize
10.8MB

Download
memory/3740-81-0x000001B974AE0000-0x000001B974B02000-memory.dmp

Filesize
136KB

Download
memory/4192-68-0x0000019FA4370000-0x0000019FA43B0000-memory.dmp

Filesize
256KB

Download
memory/4192-96-0x0000019FBEBB0000-0x0000019FBEC26000-memory.dmp

Filesize
472KB

Download
memory/4192-97-0x0000019FBEA10000-0x0000019FBEA60000-memory.dmp

Filesize
320KB

Download
memory/4192-98-0x0000019FA6180000-0x0000019FA619E000-memory.dmp

Filesize
120KB

Download
memory/4192-132-0x0000019FA61C0000-0x0000019FA61CA000-memory.dmp

Filesize
40KB

Download
memory/4192-133-0x0000019FBEA60000-0x0000019FBEA72000-memory.dmp

Filesize
72KB

Download
memory/4708-73-0x00007FFE9E0C0000-0x00007FFE9EB82000-memory.dmp

Filesize
10.8MB

Download
memory/4708-0-0x00007FFE9E0C3000-0x00007FFE9E0C5000-memory.dmp

Filesize
8KB

Download
memory/4708-2-0x00007FFE9E0C0000-0x00007FFE9EB82000-memory.dmp

Filesize
10.8MB

Download
memory/4708-1-0x0000000000A40000-0x0000000001200000-memory.dmp

Filesize
7.8MB

Download
memory/4776-74-0x00007FFE9E0C0000-0x00007FFE9EB82000-memory.dmp

Filesize
10.8MB

Download
memory/4776-31-0x00007FFE9E0C0000-0x00007FFE9EB82000-memory.dmp

Filesize
10.8MB

Download
memory/4776-26-0x0000000000890000-0x00000000008DA000-memory.dmp

Filesize
296KB

Download