dcrat | 25676c8823526376763d08d0b7a835ca9f989676ad07e7dea8f1e66556ff7ac4

General

Target

2fd91fb204ecbf2d457ecba27ac0d150N.exe
Size

827KB
MD5

2fd91fb204ecbf2d457ecba27ac0d150
SHA1

e748460f2c9b8d4c95fe38b75b6ad7fa7709907d
SHA256

25676c8823526376763d08d0b7a835ca9f989676ad07e7dea8f1e66556ff7ac4
SHA512

ac1d50644567baf4f9e0bfef29297a992826fd2fec70ab9bc6243c666479a810372b768299545d64d15e4321ae75948ea1a6fb8d062eb6b475481b181822cd84
SSDEEP

12288:7sW6tROk7uzV48iOC4rmQTgki80axC06XQxBnLFxja1a40ms:7gT7uzVtrm8XC0f/Jxja1E

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	1388	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1388	schtasks.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1976-1-0x0000000001010000-0x00000000010E6000-memory.dmp	dcrat
C:\Program Files\Windows Mail\es-ES\Idle.exe	dcrat
behavioral1/memory/1336-31-0x0000000000BE0000-0x0000000000CB6000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

audiodg.exe

pid process

1336 audiodg.exe

pid	process
1336	audiodg.exe

Drops file in Program Files directory 8 IoCs

Processes:

2fd91fb204ecbf2d457ecba27ac0d150N.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\de-DE\42af1c969fbb7b	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Mail\es-ES\Idle.exe	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Mail\es-ES\6ccacd8608530f	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Defender\ja-JP\2fd91fb204ecbf2d457ecba27ac0d150N.exe	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Defender\ja-JP\ee10334ce657cf	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Journal\es-ES\wininit.exe	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Journal\es-ES\56085415360792	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Program Files\Windows Sidebar\de-DE\audiodg.exe	2fd91fb204ecbf2d457ecba27ac0d150N.exe

Drops file in Windows directory 3 IoCs

Processes:

2fd91fb204ecbf2d457ecba27ac0d150N.exe

description	ioc	process
File created	C:\Windows\RemotePackages\csrss.exe	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File opened for modification	C:\Windows\RemotePackages\csrss.exe	2fd91fb204ecbf2d457ecba27ac0d150N.exe
File created	C:\Windows\RemotePackages\886983d96e3d3e	2fd91fb204ecbf2d457ecba27ac0d150N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2332	schtasks.exe
2868	schtasks.exe
576	schtasks.exe
2864	schtasks.exe
2008	schtasks.exe
2852	schtasks.exe
2888	schtasks.exe
2712	schtasks.exe
2960	schtasks.exe
1776	schtasks.exe
1936	schtasks.exe
2236	schtasks.exe
2776	schtasks.exe
944	schtasks.exe
2924	schtasks.exe
1684	schtasks.exe
1600	schtasks.exe
1676	schtasks.exe
2872	schtasks.exe
2628	schtasks.exe
3068	schtasks.exe
2724	schtasks.exe
1496	schtasks.exe
2180	schtasks.exe
1700	schtasks.exe
1844	schtasks.exe
2072	schtasks.exe
1924	schtasks.exe
1624	schtasks.exe
2816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2fd91fb204ecbf2d457ecba27ac0d150N.exeaudiodg.exe

pid	process
1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe
1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe
1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe
1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe
1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe
1336	audiodg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2fd91fb204ecbf2d457ecba27ac0d150N.exeaudiodg.exe

description pid process

Token: SeDebugPrivilege 1976 2fd91fb204ecbf2d457ecba27ac0d150N.exe
Token: SeDebugPrivilege 1336 audiodg.exe

description	pid	process
Token: SeDebugPrivilege	1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe
Token: SeDebugPrivilege	1336	audiodg.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2fd91fb204ecbf2d457ecba27ac0d150N.execmd.exe

description	pid	process	target process
PID 1976 wrote to memory of 2580	1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe	cmd.exe
PID 1976 wrote to memory of 2580	1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe	cmd.exe
PID 1976 wrote to memory of 2580	1976	2fd91fb204ecbf2d457ecba27ac0d150N.exe	cmd.exe
PID 2580 wrote to memory of 2704	2580	cmd.exe	w32tm.exe
PID 2580 wrote to memory of 2704	2580	cmd.exe	w32tm.exe
PID 2580 wrote to memory of 2704	2580	cmd.exe	w32tm.exe
PID 2580 wrote to memory of 1336	2580	cmd.exe	audiodg.exe
PID 2580 wrote to memory of 1336	2580	cmd.exe	audiodg.exe
PID 2580 wrote to memory of 1336	2580	cmd.exe	audiodg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2fd91fb204ecbf2d457ecba27ac0d150N.exe
"C:\Users\Admin\AppData\Local\Temp\2fd91fb204ecbf2d457ecba27ac0d150N.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HmevWlG3uV.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:2704

C:\Program Files\Windows Sidebar\de-DE\audiodg.exe
"C:\Program Files\Windows Sidebar\de-DE\audiodg.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\RemotePackages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Journal\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\de-DE\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\de-DE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\es-ES\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\es-ES\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Links\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Links\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Links\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2fd91fb204ecbf2d457ecba27ac0d150N2" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\ja-JP\2fd91fb204ecbf2d457ecba27ac0d150N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2fd91fb204ecbf2d457ecba27ac0d150N" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\2fd91fb204ecbf2d457ecba27ac0d150N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2fd91fb204ecbf2d457ecba27ac0d150N2" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\ja-JP\2fd91fb204ecbf2d457ecba27ac0d150N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Mail\es-ES\Idle.exe
Filesize
827KB

MD5
2fd91fb204ecbf2d457ecba27ac0d150

SHA1
e748460f2c9b8d4c95fe38b75b6ad7fa7709907d

SHA256
25676c8823526376763d08d0b7a835ca9f989676ad07e7dea8f1e66556ff7ac4

SHA512
ac1d50644567baf4f9e0bfef29297a992826fd2fec70ab9bc6243c666479a810372b768299545d64d15e4321ae75948ea1a6fb8d062eb6b475481b181822cd84

Download Submit
C:\Users\Admin\AppData\Local\Temp\HmevWlG3uV.bat
Filesize
215B

MD5
351e3fb1eea1af91ad742ea5b6df95cc

SHA1
d9e57a6b48fe923274c2278fd9986bae91c97b6b

SHA256
08f4c54c51443f218a1b32269bd045d18de16811903ba0e9e5df1006f73bde88

SHA512
511039b60b863d01e685a808b084e63e1c7b34af46dd3e11b50728534ffc34ee9a5a72e913617545c2d89b24d614aab2635d6b7cbf6cce554c1ba13cc9cacaf9

Download Submit
memory/1336-31-0x0000000000BE0000-0x0000000000CB6000-memory.dmp

Filesize
856KB

Download
memory/1976-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/1976-1-0x0000000001010000-0x00000000010E6000-memory.dmp

Filesize
856KB

Download
memory/1976-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/1976-28-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads