dcrat | fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe
Size 93KB
Sample240725-16t8fa1emd
SHA256 fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee
MD5 bd3b053452658056878a387afc32144e
SHA1 fd07f4da3e7d3eed99cab4cc64de19d060a1fe2a
SHA512 35aa454e80ee5fb07fdf660bb697d125c352f8b21d30f363d6346ecd9ee0cddb9998cd062de25ffba4c04c26e91244db1480c9144ed3ad2c1d4325badb4040d2
SSDEEP 1536:L+k1GkeUqZJO5iNSimjEwzGi1dDlD5gS:L+PUqZJOQAOi1d52
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery evasion infostealer persistence privilege_escalation rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1608	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	4424	schtasks.exe	121
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	4424	schtasks.exe	121

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00090000000233f8-48.dat	dcrat
behavioral2/files/0x00080000000234ce-224.dat	dcrat
behavioral2/memory/4828-232-0x0000000000E60000-0x0000000000FCA000-memory.dmp	dcrat

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2236	netsh.exe
3128	netsh.exe
4880	netsh.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	server.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	tmp896A.tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	Русский Гусь.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe

Executes dropped EXE 7 IoCs

pid	Process
1688	server.exe
4968	tmp896A.tmp.exe
4212	NVIDIA Container.exe
5064	Русский Гусь.exe
3968	GooseDesktop.exe
4828	NVIDIA Container.exe
4948	fontdrvhost.exe

Loads dropped DLL 2 IoCs

pid	Process
3968	GooseDesktop.exe
3968	GooseDesktop.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	server.exe
File opened for modification	C:\autorun.inf	server.exe
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\es-ES\Licenses\Registry.exe	NVIDIA Container.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\ee2ad38f3d4382	NVIDIA Container.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\e1ef82546f0b02	NVIDIA Container.exe
File created	C:\Program Files\Windows Mail\TiWorker.exe	NVIDIA Container.exe
File created	C:\Program Files\Windows Mail\cd89ddd3d81b06	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\121e5b5079f7c0	NVIDIA Container.exe
File created	C:\Program Files\7-Zip\Lang\SppExtComObj.exe	NVIDIA Container.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Panther\SppExtComObj.exe	NVIDIA Container.exe
File created	C:\Windows\Panther\e1ef82546f0b02	NVIDIA Container.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GooseDesktop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NVIDIA Container.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Русский Гусь.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	NVIDIA Container.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	NVIDIA Container.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1108	schtasks.exe
2760	schtasks.exe
2740	schtasks.exe
1280	schtasks.exe
1068	schtasks.exe
1608	schtasks.exe
588	schtasks.exe
3228	schtasks.exe
2860	schtasks.exe
3276	schtasks.exe
1560	schtasks.exe
3404	schtasks.exe
3624	schtasks.exe
4580	schtasks.exe
4432	schtasks.exe
4928	schtasks.exe
4028	schtasks.exe
4980	schtasks.exe
2884	schtasks.exe
2576	schtasks.exe
3160	schtasks.exe
732	schtasks.exe
2624	schtasks.exe
4716	schtasks.exe
2536	schtasks.exe
3460	schtasks.exe
1844	schtasks.exe
1380	schtasks.exe
1696	schtasks.exe
3760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe
1688	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1688	server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: SeDebugPrivilege	4828	NVIDIA Container.exe
Token: 33	4428	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4428	AUDIODG.EXE
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe
Token: SeDebugPrivilege	4948	fontdrvhost.exe
Token: 33	1688	server.exe
Token: SeIncBasePriorityPrivilege	1688	server.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1688	2616	fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe	87
PID 2616 wrote to memory of 1688	2616	fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe	87
PID 2616 wrote to memory of 1688	2616	fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe	87
PID 1688 wrote to memory of 2236	1688	server.exe	88
PID 1688 wrote to memory of 2236	1688	server.exe	88
PID 1688 wrote to memory of 2236	1688	server.exe	88
PID 1688 wrote to memory of 3128	1688	server.exe	90
PID 1688 wrote to memory of 3128	1688	server.exe	90
PID 1688 wrote to memory of 3128	1688	server.exe	90
PID 1688 wrote to memory of 4880	1688	server.exe	91
PID 1688 wrote to memory of 4880	1688	server.exe	91
PID 1688 wrote to memory of 4880	1688	server.exe	91
PID 1688 wrote to memory of 4968	1688	server.exe	111
PID 1688 wrote to memory of 4968	1688	server.exe	111
PID 4968 wrote to memory of 4212	4968	tmp896A.tmp.exe	112
PID 4968 wrote to memory of 4212	4968	tmp896A.tmp.exe	112
PID 4968 wrote to memory of 4212	4968	tmp896A.tmp.exe	112
PID 4968 wrote to memory of 5064	4968	tmp896A.tmp.exe	113
PID 4968 wrote to memory of 5064	4968	tmp896A.tmp.exe	113
PID 4968 wrote to memory of 5064	4968	tmp896A.tmp.exe	113
PID 4212 wrote to memory of 3960	4212	NVIDIA Container.exe	114
PID 4212 wrote to memory of 3960	4212	NVIDIA Container.exe	114
PID 4212 wrote to memory of 3960	4212	NVIDIA Container.exe	114
PID 5064 wrote to memory of 3968	5064	Русский Гусь.exe	115
PID 5064 wrote to memory of 3968	5064	Русский Гусь.exe	115
PID 5064 wrote to memory of 3968	5064	Русский Гусь.exe	115
PID 3960 wrote to memory of 1764	3960	WScript.exe	117
PID 3960 wrote to memory of 1764	3960	WScript.exe	117
PID 3960 wrote to memory of 1764	3960	WScript.exe	117
PID 1764 wrote to memory of 4828	1764	cmd.exe	119
PID 1764 wrote to memory of 4828	1764	cmd.exe	119
PID 4828 wrote to memory of 964	4828	NVIDIA Container.exe	152
PID 4828 wrote to memory of 964	4828	NVIDIA Container.exe	152
PID 964 wrote to memory of 1020	964	cmd.exe	154
PID 964 wrote to memory of 1020	964	cmd.exe	154
PID 964 wrote to memory of 4948	964	cmd.exe	155
PID 964 wrote to memory of 4948	964	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe
"C:\Users\Admin\AppData\Local\Temp\fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2236
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3128
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\tmp896A.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp896A.tmp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
      "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3960
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xS4YV2t6uw.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1020
        
        C:\Users\Admin\fontdrvhost.exe
        
        "C:\Users\Admin\fontdrvhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Русский Гусь.exe
      "C:\Users\Admin\AppData\Local\Temp\Русский Гусь.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3968

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c4 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\NVIDIA\DisplayDriver\535.21\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\NVIDIA\DisplayDriver\535.21\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Panther\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\NVIDIA\DisplayDriver\535.21\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\TiWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\TiWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\TiWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\es-ES\Licenses\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SysWOW64\es-ES\Licenses\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\SysWOW64\es-ES\Licenses\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NVIDIA Container.exe

Path C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
Size 1.4MB
SHA256 b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd
MD5 4a591f46c87b49a7de93f5ac771cd4ab
SHA1 e0992350818e5c56d3f2e3a6db340d1f5b8f3314
SHA512 b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955
SSDEEP 24576:gi39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yv+aX7:gwRVQysEUCHaiy9Gvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxJne99RtKqQDunPUGdos.bat

Path C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat
Size 53B
SHA256 0385dbf94fc27705560cf0b6b04e9a37181db486ee8f7573c5ad2217d18f4ca0
MD5 7784d810f5ff3afa8df50e360eb90e7d
SHA1 f04802a991ff6461aa1c35b7c0f68e43d5a114c6
SHA512 80038ae2bfd5f8ca3f4812ab5c342878f98978007125c9dca5edb915701a5383916131cdc3082c054c49c508cd210aff70319ac0fc498cbdd6cee776df672cac
MD5 SHA1 SHA512

Submit Download

zajaYJ4rqwpmDK2a6yrvwdV.vbe

Path C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe
Size 225B
SHA256 d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b
MD5 d7df2670ad0c6c7b9cc48122f20f086c
SHA1 e69bf8c214d8c4b768125ca03e402e1c871cc233
SHA512 05ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03
MD5 SHA1 SHA512

Submit Download

NVIDIA Container.exe

Path C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
Size 1.8MB
SHA256 67942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a
MD5 531bf67134a7c1fb4096113ca58cc648
SHA1 99e0fc1fb7a07c0685e426b327921d3e6c34498c
SHA512 8facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4
SSDEEP 24576:92G/nvxW3WDGkIJ1i39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yvg:9bA3gy1wRVQysEUCHaiy9Gvkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Honk1.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\Sound\NotEmbedded\Honk1.mp3
Size 5KB
SHA256 56a240ddfbb494a6cb5c02a1271b5cc9a79217c53b481d9d3240b4973808d65b
MD5 db2b7cf36003b2b653df6f3ca986e007
SHA1 d61a94c7b965dec3daa6351d849fa22f646edf8b
SHA512 3c5ba0484567bd520334837c54df160b26d3a3be952474aedf23a946369bada58241dc43a471d8e9e652e0b682599f1c5dbd03e39fe8c1f6182b806b6939eef3
SSDEEP 96:y1tlnP78lTHmiyN/EyHhWt8BOh9N9fjbjRU/uAkorTVLnQMfkHNDa1QNOlpajdP9:iP78dxyN/FmoM+e6TVDfkD4QTjdP9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Honk4.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\Sound\NotEmbedded\Honk4.mp3
Size 3KB
SHA256 46aea3ca7321989695db5b15f7997802a6266512d6fe298a26dee9dd6a98ba87
MD5 9b24558524e7f3ec1dd7d123d10541fc
SHA1 d373cc754817870f18d640c6fa04627c74e8f518
SHA512 e6e0c4e77143e778599b4952c0e0741b8cd092d08179c4b4f1b63698562ec3bcf362888585e253cb53113d3c51b6225d8d4e43cd95b7122c7c2881828d392397
MD5 SHA1 SHA512

Submit Download

MudSquith.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\Sound\NotEmbedded\MudSquith.mp3
Size 13KB
SHA256 d5281ba99731fe3c443b6b2d18960a49e74b5b407956d3e1a3cde360f86573ba
MD5 b2354d238829d09c54e272d8b4f60189
SHA1 5a2731c04c50903d41f65d9fe5528a66cbefa289
SHA512 aafbc687b5eac32fe1b4d838ab1ac88103d7f59d0b5f51519845abdd9ae37147e73143e6039719c3d06915107397e3e0a666d0cb1677cdbe05bccebea69ecaf9
SSDEEP 192:dS3rAfHp0gP16UKYvH2e4l8IR3nXOwdRmMyOYcfGIKvHxLB35AwTzYJ2cb/:g3rOHZw1QWjl8YXDdByOYwLGRJCxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

i cause problems.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Assets\Text\NotepadMessages\i cause problems.txt
Size 44B
SHA256 4be1a269c2efad0f8fdb934819a55d8048d7cb7a78dab9eae162a3e5c10999e4
MD5 c3fd45b3e10af79b1e497ca4a08fe393
SHA1 c327ad06a53ccf88b322fb66c016765a6e44e65b
SHA512 914c326a17cf6022549e01d0fe46349185975af43965117bc8bc562fe8a80e165a9a26361c8bdba6fa8da277b42cc8fe322891d53b114c8d06dbedaadff72b08
MD5 SHA1 SHA512

Submit Download

GooseModdingAPI.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\FOR MOD-MAKERS\GooseMod_DefaultSolution\GooseModdingAPI\obj\Release\GooseModdingAPI.dll
Size 16KB
SHA256 fba607ccfd47e2b6ba04d449f1de10e3b66ba35b7d0e96f71e7c61d0c10486f4
MD5 6f6c8f80d6c36739147b38016bd4b469
SHA1 bf0f81a00ccc595242620b15ade2a0661424d9e3
SHA512 1b3d6da8eedc140f3836c60eadc5251870d01db99e72d33ec0b2a585e2e4b2f7e643e2a12ad42f8e6d8704e8af67ca1df728acdbe18c614a1b8f6746d0c3fbc6
SSDEEP 384:nBjGRs3XVRcYEPPPr/TXRTRGYK4swkqUICTy5o:BjGe3XVRvEPPPr/TXRTRGSCTy5o
MD5 SHA1 SHA512 SSDEEP

Submit Download

GooseModdingAPI.pdb

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\FOR MOD-MAKERS\GooseMod_DefaultSolution\GooseModdingAPI\obj\Release\GooseModdingAPI.pdb
Size 25KB
SHA256 4e4eb668831c91756eb030045d118ebd069fda0b0e0065ee2467c4c1c382cdd8
MD5 5e0ccb3bd78be9cd539fef6e4005e47a
SHA1 9a28756dffdef59d36bf42cb9cc8e02e454026d2
SHA512 4c58e1d9d77c42500c3d91314257f563a6b3af627ae0d5ec257b38a8b8008b47ad10b8b3a0661bc72a12bdaf549a33453a971802542f5c719fc979fa9f6c1372
SSDEEP 192:ViAQAAhmCU3WkdTw3lYiDIqMjT3GOit10fAUNDuY8Y0W74KhszVdSRyYjfYRNU29:Ehm8iTw1YxH3GOisNJzdc
MD5 SHA1 SHA512 SSDEEP

Submit Download

GooseDesktop.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe
Size 221KB
SHA256 943fd1ea44266c5d7fa02f2b292db095a4e6ba8027a1f6c73fd60d1165e63aff
MD5 c883e2c769ebe56240a71260b17f1b93
SHA1 4a831d4f48f6ea81db508c2a87cf860acd17edb1
SHA512 dae40d442794152285ce484b10095d11592a39cb1968bd38cc70ee23005bd1e04ad4312d7266107bdd375e10fa91ab9fd3d41d4d6ccd2268d052b343528c4376
SSDEEP 3072:gzebbi+ndU/n6u4WhGINz6tFvaxWt5H3ANdl3Mn4bqwyW13B26wqIl9nNwo3WdZj:gzQU/n6unYCW74bqwye3ijlDwocZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

GooseModdingAPI.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseModdingAPI.dll
Size 16KB
SHA256 efa31df7ab1394092395365805f913dd023cdcd21796603f133641524fb9ad79
MD5 9eb11041f2f11d939074e26b4b554088
SHA1 50deec7591fcc5db40939543fc9bf92109f2df05
SHA512 2d07f40f56ae0dcaba51bc65e4617a0bfd67be13be5156fd7c2850645a461f87b97e46b2c596c21752df2aa488f6e6c329534a523bd7f88234be956b8af13bd1
SSDEEP 384:4BjGRs3XVRcYEPPPr/TXRTRGYK4swkqUICTyeX:ajGe3XVRvEPPPr/TXRTRGSCTyeX
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.ini
Size 286B
SHA256 db74de308ed6c409c5460ba10ddb590ed1f5b5281a61e10934d004feba454ee9
MD5 0288c130074a043df404ac331b9842b3
SHA1 196355e0ac857082a32e36c4938fe22794b8c55b
SHA512 52af081fbf93803ab11b4ebc219371662613a9ca05980a045c6af258ea631f2462d6f932959f9d98777e18644a608e884757c5886e00bbbdaa138b3f8afeb07c
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 93KB
SHA256 fb73858ab13c8149347c31cc4c1e975dc1f9f34ab01078df74dd60b77f490bee
MD5 bd3b053452658056878a387afc32144e
SHA1 fd07f4da3e7d3eed99cab4cc64de19d060a1fe2a
SHA512 35aa454e80ee5fb07fdf660bb697d125c352f8b21d30f363d6346ecd9ee0cddb9998cd062de25ffba4c04c26e91244db1480c9144ed3ad2c1d4325badb4040d2
SSDEEP 1536:L+k1GkeUqZJO5iNSimjEwzGi1dDlD5gS:L+PUqZJOQAOi1d52
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp896A.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp896A.tmp.exe
Size 4.5MB
SHA256 d5e67f41a6a4da9d68c039c6abba98f9c4c80720e10ab32fda217430de97f27d
MD5 cbe263551fead5f9f24537c26e2672e3
SHA1 93792371b1383f5e7abfba204dcb712942512baf
SHA512 c2c7c41c071eb082a8da2204b104954c31578bd8e28ff6de72dcc849f286405650321370c7b10cd844d3653ca2e16125ad3130c8f04852320f548622b554eacd
SSDEEP 98304:mUTS5MLEpdahLic107uRp1O+AzfGNMgVwtUsD85V:mUTFOdELV1lR2+Az0MgVa/2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

xS4YV2t6uw.bat

Path C:\Users\Admin\AppData\Local\Temp\xS4YV2t6uw.bat
Size 195B
SHA256 cb9e7e8bd943264fce7d5a720e250fce6672046a2d3bfe25a1e3e5c4b8db7c05
MD5 7d034cd5f26d3ad5e9c9fca9b821d8ae
SHA1 b5aafff041009fda3d60fcbf060d853e6c74e12b
SHA512 3f1837d9583cc8145bc1912847d8055ae9ea5888695a4aa3a729fc49805c7fd21df91ea4743993913e4373467c229a68711e95a4186a2022fc58d1b64c8bf4d2
MD5 SHA1 SHA512

Submit Download

Русский Гусь.exe

Path C:\Users\Admin\AppData\Local\Temp\Русский Гусь.exe
Size 3.5MB
SHA256 ace4359d6932b06de3b2562a360a812a29e4d1ad66071a891849671d8497676d
MD5 71dca900fdc00f75e2b0f19b9bbbd7aa
SHA1 cb9160cefe3c5192f65ca4311047f38592ca9668
SHA512 8968f2dd43f7c8b554bf6e22515a605fedeacff79348821e34e995a7ea95a38545b3d841d2a7a15ff6c58047619230256d9e25d1f33105824d74f9a0dcca5ec4
SSDEEP 98304:azCuwuc1oVvXxT1vj+P3wM3TVfdb8tjL6ciacd:8C1SPxT1vqvbfdb8tjELd
MD5 SHA1 SHA512 SSDEEP

Submit Download

app

Path C:\Users\Admin\AppData\Roaming\app
Size 5B
SHA256 275918973c23ad700f278c69cc03c9c82ec9f4d9ed0f53111ad22bec197ff440
MD5 cac4598fdc0f92181616d12833eb6ca1
SHA1 80a7b7a46a0e8e674b782b9eb569e5430a69c84b
SHA512 01a7556bfcce6d9d8251aadc7f6e6169fdd0477d487ce88729c44bfe8b85b2eee500985d553c0479765ef5b5c6dc3517c0305efb9089814c3f8a9ea6fc51c713
MD5 SHA1 SHA512

Submit Download

memory/1688-31-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/1688-15-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/1688-14-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/2616-13-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/2616-0-0x0000000074C62000-0x0000000074C63000-memory.dmp

Download

memory/2616-2-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/2616-1-0x0000000074C60000-0x0000000075211000-memory.dmp

Download

memory/3968-212-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-229-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-214-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-213-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-215-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-216-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-218-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-204-0x0000000005410000-0x000000000541A000-memory.dmp

Download

memory/3968-223-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-227-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-222-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-203-0x0000000005A50000-0x0000000005FF4000-memory.dmp

Download

memory/3968-225-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-202-0x0000000005350000-0x00000000053E2000-memory.dmp

Download

memory/3968-221-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-208-0x0000000005580000-0x000000000558A000-memory.dmp

Download

memory/3968-230-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-201-0x0000000000A90000-0x0000000000ACE000-memory.dmp

Download

memory/3968-231-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/3968-228-0x00000000078E0000-0x00000000078F0000-memory.dmp

Download

memory/4828-233-0x00000000030E0000-0x00000000030FC000-memory.dmp

Download

memory/4828-235-0x0000000003100000-0x0000000003116000-memory.dmp

Download

memory/4828-234-0x000000001BB70000-0x000000001BBC0000-memory.dmp

Download

memory/4828-236-0x0000000003120000-0x0000000003130000-memory.dmp

Download

memory/4828-238-0x0000000003140000-0x000000000314E000-memory.dmp

Download

memory/4828-237-0x0000000003130000-0x000000000313E000-memory.dmp

Download

memory/4828-239-0x0000000003150000-0x000000000315C000-memory.dmp

Download

memory/4828-232-0x0000000000E60000-0x0000000000FCA000-memory.dmp

Download

memory/4968-43-0x00000000004B0000-0x000000000093E000-memory.dmp

Download