Malware Analysis Report

2025-04-13 12:35

Sample ID 240802-sn8zwayhnm
Target testoutput.exe
SHA256 ebbb1bcaa8c10a142bc149726fac6e4d235075dfd4acb33c83d419eba5b8f030
Tags
asyncrat xworm default execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ebbb1bcaa8c10a142bc149726fac6e4d235075dfd4acb33c83d419eba5b8f030

Threat Level: Known bad

The file testoutput.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat xworm default execution persistence rat trojan

Xworm

AsyncRat

Detect Xworm Payload

Async RAT payload

Command and Scripting Interpreter: PowerShell

Drops startup file

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-02 15:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-02 15:17

Reported

2024-08-02 15:20

Platform

win10-20240611-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\testoutput.exe"

Signatures

AsyncRat

rat asyncrat

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk C:\Users\Admin\AppData\Roaming\XClient.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Public\\discord.exe" C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\test124.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Infected.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4980 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\testoutput.exe C:\Users\Admin\AppData\Roaming\Infected.exe
PID 4980 wrote to memory of 3196 N/A C:\Users\Admin\AppData\Local\Temp\testoutput.exe C:\Users\Admin\AppData\Roaming\Infected.exe
PID 4980 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\testoutput.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 4980 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\testoutput.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3196 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Roaming\Infected.exe C:\Windows\System32\cmd.exe
PID 3196 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Roaming\Infected.exe C:\Windows\System32\cmd.exe
PID 3196 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\Infected.exe C:\Windows\system32\cmd.exe
PID 3196 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Roaming\Infected.exe C:\Windows\system32\cmd.exe
PID 4624 wrote to memory of 3732 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4624 wrote to memory of 3732 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 1276 wrote to memory of 4588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1276 wrote to memory of 4588 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 4160 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1276 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\test124.exe
PID 1276 wrote to memory of 768 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\test124.exe
PID 4160 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4160 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\schtasks.exe
PID 4160 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\testoutput.exe

"C:\Users\Admin\AppData\Local\Temp\testoutput.exe"

C:\Users\Admin\AppData\Roaming\Infected.exe

"C:\Users\Admin\AppData\Roaming\Infected.exe"

C:\Users\Admin\AppData\Roaming\XClient.exe

"C:\Users\Admin\AppData\Roaming\XClient.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "test124" /tr '"C:\Users\Admin\AppData\Roaming\test124.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE119.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "test124" /tr '"C:\Users\Admin\AppData\Roaming\test124.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Users\Admin\AppData\Roaming\test124.exe

"C:\Users\Admin\AppData\Roaming\test124.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\discord.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Public\discord.exe"

C:\Users\Public\discord.exe

C:\Users\Public\discord.exe

C:\Users\Public\discord.exe

C:\Users\Public\discord.exe

C:\Users\Public\discord.exe

C:\Users\Public\discord.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 and-statements.gl.at.ply.gg udp
US 147.185.221.21:43442 and-statements.gl.at.ply.gg tcp
US 8.8.8.8:53 21.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 form-fly.gl.at.ply.gg udp
US 147.185.221.21:41810 form-fly.gl.at.ply.gg tcp
US 8.8.8.8:53 8.167.79.40.in-addr.arpa udp

Files

memory/4980-0-0x00007FFF49BA3000-0x00007FFF49BA4000-memory.dmp

memory/4980-1-0x0000000000060000-0x00000000000B8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Infected.exe

MD5 4ab63aeb8e93aa7784281b8692d25ff3
SHA1 877e3e2f4729438ffdf7bfae3c7c261111e9dc6a
SHA256 1b4ca2ea6683fa110a3409227361b8c29e00aa656ff197291b06105b36ec2fee
SHA512 3623a467a97627b9d43660e2cfc9ed0334e1544a4bc68f9f1cb9cdfe8f365728fbaf9a5eec85e257c8d767aa4ac058b7a0e2eb0e1177514cd8a53d67be008885

C:\Users\Admin\AppData\Roaming\XClient.exe

MD5 29880fdfd8b10f74d36f06ec4c8f1a6b
SHA1 ec270024271689267dc7e9403edfd86c40a9680b
SHA256 37592a9608faacaecffa81f02c20d90e7bfff12fdeaa2f25ef8dfbd6b9ea94b7
SHA512 293f2e11ed6afd0cbf5bbe8e0b7b8a496cfbf17f9fcc79ce0501f3b96bd9e983f87e4d1de00678c30b336f13b7a10db677a803b0fd95fdb41abe2662f85c0675

memory/3196-13-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

memory/4160-14-0x0000000000810000-0x0000000000854000-memory.dmp

memory/3196-15-0x00007FFF49BA0000-0x00007FFF4A58C000-memory.dmp

memory/4160-16-0x00007FFF49BA0000-0x00007FFF4A58C000-memory.dmp

memory/3196-22-0x00007FFF49BA0000-0x00007FFF4A58C000-memory.dmp

memory/4160-21-0x00007FFF49BA0000-0x00007FFF4A58C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpE119.tmp.bat

MD5 ed2bc0616c8d718ce7365249aa59bc9c
SHA1 99e4882406018082285bcf2dcda39df6e080828a
SHA256 723e978dfb930314d20b74f7c3d9faf08ce97c9fb9dfa29a04d256403ad484e3
SHA512 617a88de594c40b18f9638a3051c0783b04891d5e81f24a8205dfb5683e74f2fbd3f73922316d64614a8526526420dd38e2f0ff3b9ff847e2e84f3482a63d296

memory/4724-28-0x000001D7D41D0000-0x000001D7D41F2000-memory.dmp

memory/4724-31-0x000001D7EC990000-0x000001D7ECA06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h4dzz2o4.2py.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 36714f5f9ca060122d89e8e7ff102339
SHA1 7e83181dff892c48016d16da90acb7bf98684d25
SHA256 3f6ea6e3b26ca9a2e2b8a315838db6dc35154a7cf111c38d2710d6dbe428a5fe
SHA512 9e46f09831a399104a402783a236dc0a618342ee489a2459a92309e3ac31e5a45a9178ddb2500c8a52fcdd4ca31c8800bb5993b8ef3402b7bb94dfa9f56e2a13

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 53b597c66b2e16c19c26196f2bb30e38
SHA1 7f95d8c80420cd18240563c98f10e44c784b2373
SHA256 8f793f93054056e9340472ea839e0b112a15f2d26e737314aa6f82b78e081157
SHA512 ba1c12675c764c80bdd2fb568648aee202dfe589fc50cf723d5c93541e1dc0794f250c3c433f6f3491968d3dae6abb180e45d6854ab1d43d774b4ab1b70ba9af

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8bb1bfbc4bc1bcd31239f9b3d35b93f2
SHA1 2351e9f8c5fdb73d7e7cc1a8453043fcf4e2fcb8
SHA256 0258704c72d891e7942b8879a0347dc432b468bb7f12c6307e2a4634654e0eba
SHA512 50915400e734c39a9af142117479ddb032a5855e718236fc36d39fa718c826db6b3f8eee6412731e7164efeca9fa5ca88df3c2ae29653a4ba21804dbfe85a3e9

memory/4160-210-0x00007FFF49BA0000-0x00007FFF4A58C000-memory.dmp

memory/4160-212-0x00007FFF49BA0000-0x00007FFF4A58C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\discord.exe.log

MD5 16c5fce5f7230eea11598ec11ed42862
SHA1 75392d4824706090f5e8907eee1059349c927600
SHA256 87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151
SHA512 153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc