asyncrat | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
181s
max time network
209s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-08-2024 00:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Downloaders.zip
Size

12KB
MD5

94fe78dc42e3403d06477f995770733c
SHA1

ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA256

16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
SHA512

add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP

384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB

Score

10^/10

asyncrat redline snakekeylogger xworm default collection credential_access discovery execution infostealer keylogger persistence privilege_escalation pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Password: )NYyffR0 1
Email To:
[email protected]

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1604

127.0.0.1:22253

eu-central-7075.packetriot.net:6606

eu-central-7075.packetriot.net:7707

eu-central-7075.packetriot.net:8808

eu-central-7075.packetriot.net:1604

eu-central-7075.packetriot.net:22253

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Extracted

Family

redline

185.215.113.9:12617

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000200000002a9c4-99.dat	family_xworm
behavioral1/memory/2340-106-0x0000000000080000-0x00000000000C8000-memory.dmp	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000200000002a9ea-242.dat	family_redline
behavioral1/memory/2624-264-0x00000000009F0000-0x0000000000A42000-memory.dmp	family_redline

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

resource	yara_rule
behavioral1/memory/2020-52-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/4940-449-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000300000002a9cd-112.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4632	powershell.exe
4300	powershell.exe
4832	powershell.exe
3652	powershell.exe
1692	powershell.exe
664	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
2180	robotic.exe
1000	asusns.exe
3772	asusns.exe
2020	asusns.exe
2340	msedge.exe
3076	stub.exe
3144	build2.exe
420	keylogger.exe
2068	networks_profile.exe
2132	backdoor.exe
4480	networks_profile.exe
2428	wahost.exe
2408	regasm.exe
2624	cookie250.exe

Loads dropped DLL 6 IoCs

pid	Process
4480	networks_profile.exe
4480	networks_profile.exe
4480	networks_profile.exe
4480	networks_profile.exe
4480	networks_profile.exe
4480	networks_profile.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	asusns.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	asusns.exe
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	asusns.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
54	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 2020	1000	asusns.exe	113

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000100000002a9d0-152.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asusns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asusns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keylogger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backdoor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2584	netsh.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2948	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	cookie250.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	cookie250.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4524	schtasks.exe
1576	schtasks.exe
2880	schtasks.exe
3376	schtasks.exe
1660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2180	robotic.exe
1000	asusns.exe
1000	asusns.exe
2020	asusns.exe
4632	powershell.exe
4632	powershell.exe
2020	asusns.exe
4300	powershell.exe
4300	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3076	stub.exe
3652	powershell.exe
3652	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	New Text Document mod.exe
Token: SeDebugPrivilege	2180	robotic.exe
Token: SeBackupPrivilege	2180	robotic.exe
Token: SeSecurityPrivilege	2180	robotic.exe
Token: SeSecurityPrivilege	2180	robotic.exe
Token: SeSecurityPrivilege	2180	robotic.exe
Token: SeSecurityPrivilege	2180	robotic.exe
Token: SeDebugPrivilege	1000	asusns.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	2020	asusns.exe
Token: SeDebugPrivilege	2340	msedge.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	3076	stub.exe
Token: SeDebugPrivilege	3652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2180	3536	New Text Document mod.exe	101
PID 3536 wrote to memory of 2180	3536	New Text Document mod.exe	101
PID 3536 wrote to memory of 1000	3536	New Text Document mod.exe	105
PID 3536 wrote to memory of 1000	3536	New Text Document mod.exe	105
PID 3536 wrote to memory of 1000	3536	New Text Document mod.exe	105
PID 1000 wrote to memory of 4632	1000	asusns.exe	108
PID 1000 wrote to memory of 4632	1000	asusns.exe	108
PID 1000 wrote to memory of 4632	1000	asusns.exe	108
PID 1000 wrote to memory of 4524	1000	asusns.exe	110
PID 1000 wrote to memory of 4524	1000	asusns.exe	110
PID 1000 wrote to memory of 4524	1000	asusns.exe	110
PID 1000 wrote to memory of 3772	1000	asusns.exe	112
PID 1000 wrote to memory of 3772	1000	asusns.exe	112
PID 1000 wrote to memory of 3772	1000	asusns.exe	112
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 1000 wrote to memory of 2020	1000	asusns.exe	113
PID 3536 wrote to memory of 2340	3536	New Text Document mod.exe	114
PID 3536 wrote to memory of 2340	3536	New Text Document mod.exe	114
PID 3536 wrote to memory of 3076	3536	New Text Document mod.exe	116
PID 3536 wrote to memory of 3076	3536	New Text Document mod.exe	116
PID 3536 wrote to memory of 3076	3536	New Text Document mod.exe	116
PID 3536 wrote to memory of 3144	3536	New Text Document mod.exe	117
PID 3536 wrote to memory of 3144	3536	New Text Document mod.exe	117
PID 3536 wrote to memory of 3144	3536	New Text Document mod.exe	117
PID 3536 wrote to memory of 420	3536	New Text Document mod.exe	118
PID 3536 wrote to memory of 420	3536	New Text Document mod.exe	118
PID 3536 wrote to memory of 420	3536	New Text Document mod.exe	118
PID 2340 wrote to memory of 4300	2340	msedge.exe	120
PID 2340 wrote to memory of 4300	2340	msedge.exe	120
PID 3536 wrote to memory of 2068	3536	New Text Document mod.exe	122
PID 3536 wrote to memory of 2068	3536	New Text Document mod.exe	122
PID 2340 wrote to memory of 4832	2340	msedge.exe	124
PID 2340 wrote to memory of 4832	2340	msedge.exe	124
PID 3536 wrote to memory of 2132	3536	New Text Document mod.exe	126
PID 3536 wrote to memory of 2132	3536	New Text Document mod.exe	126
PID 3536 wrote to memory of 2132	3536	New Text Document mod.exe	126
PID 2068 wrote to memory of 4480	2068	networks_profile.exe	128
PID 2068 wrote to memory of 4480	2068	networks_profile.exe	128
PID 4480 wrote to memory of 2740	4480	networks_profile.exe	129
PID 4480 wrote to memory of 2740	4480	networks_profile.exe	129
PID 4480 wrote to memory of 2584	4480	networks_profile.exe	130
PID 4480 wrote to memory of 2584	4480	networks_profile.exe	130
PID 3536 wrote to memory of 2428	3536	New Text Document mod.exe	131
PID 3536 wrote to memory of 2428	3536	New Text Document mod.exe	131
PID 3536 wrote to memory of 2428	3536	New Text Document mod.exe	131
PID 3076 wrote to memory of 2296	3076	stub.exe	132
PID 3076 wrote to memory of 2296	3076	stub.exe	132
PID 3076 wrote to memory of 2296	3076	stub.exe	132
PID 3536 wrote to memory of 2408	3536	New Text Document mod.exe	133
PID 3536 wrote to memory of 2408	3536	New Text Document mod.exe	133
PID 3536 wrote to memory of 2408	3536	New Text Document mod.exe	133
PID 3076 wrote to memory of 1280	3076	stub.exe	134
PID 3076 wrote to memory of 1280	3076	stub.exe	134
PID 3076 wrote to memory of 1280	3076	stub.exe	134
PID 3536 wrote to memory of 2624	3536	New Text Document mod.exe	137
PID 3536 wrote to memory of 2624	3536	New Text Document mod.exe	137
PID 3536 wrote to memory of 2624	3536	New Text Document mod.exe	137
PID 2296 wrote to memory of 1576	2296	cmd.exe	138

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	asusns.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	asusns.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloaders.zip
1⤵
PID:3372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1780

C:\Users\Admin\Desktop\New Text Document mod.exe
"C:\Users\Admin\Desktop\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\Desktop\a\robotic.exe
  "C:\Users\Admin\Desktop\a\robotic.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Users\Admin\Desktop\a\asusns.exe
  "C:\Users\Admin\Desktop\a\asusns.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKmzKrla.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKmzKrla" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C92.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4524
- - C:\Users\Admin\Desktop\a\asusns.exe
    "C:\Users\Admin\Desktop\a\asusns.exe"
    3⤵
    - Executes dropped EXE
    PID:3772
- - C:\Users\Admin\Desktop\a\asusns.exe
    "C:\Users\Admin\Desktop\a\asusns.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2020
- C:\Users\Admin\Desktop\a\msedge.exe
  "C:\Users\Admin\Desktop\a\msedge.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1692
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\ProgramData\msedge.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- C:\Users\Admin\Desktop\a\stub.exe
  "C:\Users\Admin\Desktop\a\stub.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp542C.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1280
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2948
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      PID:3284
- C:\Users\Admin\Desktop\a\build2.exe
  "C:\Users\Admin\Desktop\a\build2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3144
- C:\Users\Admin\Desktop\a\keylogger.exe
  "C:\Users\Admin\Desktop\a\keylogger.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:420
- C:\Users\Admin\Desktop\a\networks_profile.exe
  "C:\Users\Admin\Desktop\a\networks_profile.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\Desktop\a\networks_profile.exe
    "C:\Users\Admin\Desktop\a\networks_profile.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2740
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2584
- C:\Users\Admin\Desktop\a\backdoor.exe
  "C:\Users\Admin\Desktop\a\backdoor.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Users\Admin\Desktop\a\wahost.exe
  "C:\Users\Admin\Desktop\a\wahost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2428
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    PID:3692
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    PID:2740
- - C:\Users\Admin\Desktop\a\wahost.exe
    "C:\Users\Admin\Desktop\a\wahost.exe"
    3⤵
    PID:3524
- C:\Users\Admin\Desktop\a\regasm.exe
  "C:\Users\Admin\Desktop\a\regasm.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2408
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eVoVlc.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:664
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVoVlc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9869.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- - C:\Users\Admin\Desktop\a\regasm.exe
    "C:\Users\Admin\Desktop\a\regasm.exe"
    3⤵
    PID:4940
- C:\Users\Admin\Desktop\a\cookie250.exe
  "C:\Users\Admin\Desktop\a\cookie250.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:2624
- C:\Users\Admin\Desktop\a\sahost.exe
  "C:\Users\Admin\Desktop\a\sahost.exe"
  2⤵
  PID:4184
- C:\Users\Admin\Desktop\a\out_test_sig.exe
  "C:\Users\Admin\Desktop\a\out_test_sig.exe"
  2⤵
  PID:1088
- C:\Users\Admin\Desktop\a\TTF.exe
  "C:\Users\Admin\Desktop\a\TTF.exe"
  2⤵
  PID:2000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5036
- C:\Users\Admin\Desktop\a\T9.exe
  "C:\Users\Admin\Desktop\a\T9.exe"
  2⤵
  PID:3976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    PID:2516
- C:\Users\Admin\Desktop\a\c7.exe
  "C:\Users\Admin\Desktop\a\c7.exe"
  2⤵
  PID:1620
- C:\Users\Admin\Desktop\a\mservice64.exe
  "C:\Users\Admin\Desktop\a\mservice64.exe"
  2⤵
  PID:3428
- C:\Users\Admin\Desktop\a\T7.exe
  "C:\Users\Admin\Desktop\a\T7.exe"
  2⤵
  PID:1780
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    PID:2884
- C:\Users\Admin\Desktop\a\nano.exe
  "C:\Users\Admin\Desktop\a\nano.exe"
  2⤵
  PID:3460
- C:\Users\Admin\Desktop\a\request.exe
  "C:\Users\Admin\Desktop\a\request.exe"
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\asusns.exe.log

Filesize
1KB

MD5
7e1ed0055c3eaa0bbc4a29ec1ef15a6a

SHA1
765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d

SHA256
4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce

SHA512
de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
0ab33c506ea38670935fe58b1b643625

SHA1
fdb073ec76e4c61ed7a4b1de55282fc713c867e2

SHA256
5d59d4f4361cc1c7315e2f795e06a65491e0bc3d25af817c0ba1b632634bfdb4

SHA512
bc58faf58da4fcf81fdeef543ef56cd8dd63276901eccc3d3f20f5e7dcf223f4f2a75206e85e9143f2ebb59c6249a8a50488c7e114d94e9804869263643600f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6344564097353c8e7e68991fffa80d88

SHA1
2ac4d108a30ec3fbd2938b0563eb912415ea7c62

SHA256
d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da

SHA512
e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f1ed0ca7585ba163098d9e724addbab2

SHA1
1bfbaa9b7e1d4211c65a421bc4a760d4eb72c196

SHA256
1ab4ae61b4737b190193187b1aeab9be32401753022b5e739023bea857edd9c7

SHA512
0738b9346203da57bd44a34c289e7b2013bb7e6de398cd8e859bbab6971e40ef0ff5b41a9c5a24ffb889564e730cc16b275272917841a61cb87790bbb69af573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8cb7f4b4ab204cacd1af6b29c2a2042c

SHA1
244540c38e33eac05826d54282a0bfa60340d6a1

SHA256
4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

SHA512
7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp57B6.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\VCRUNTIME140.dll

Filesize
94KB

MD5
18049f6811fc0f94547189a9e104f5d2

SHA1
dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6

SHA256
c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db

SHA512
38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\_ctypes.pyd

Filesize
124KB

MD5
7322f8245b5c8551d67c337c0dc247c9

SHA1
5f4cb918133daa86631211ae7fa65f26c23fcc98

SHA256
4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763

SHA512
52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\_socket.pyd

Filesize
78KB

MD5
478abd499eefeba3e50cfc4ff50ec49d

SHA1
fe1aae16b411a9c349b0ac1e490236d4d55b95b2

SHA256
fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb

SHA512
475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\base_library.zip

Filesize
763KB

MD5
c6b38adf85add9f9a7ea0b67eea508b4

SHA1
23a398ffdae6047d9777919f7b6200dd2a132887

SHA256
77479f65578cf9710981255a3ad5495d45f8367b2f43c2f0680fce0fed0e90fb

SHA512
d6abc793a7b6cc6138b50305a8c1cad10fa1628ca01a2284d82222db9bd1569959b05bdf4581d433ff227438131e43eec98bf265e746b17e76b1c9e9e21d447d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\python39.dll

Filesize
4.3MB

MD5
1d5e4c20a20740f38f061bdf48aaca4f

SHA1
de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

SHA256
f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

SHA512
9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20682\select.pyd

Filesize
28KB

MD5
fed3dae56f7c9ea35d2e896fede29581

SHA1
ae5b2ef114138c4d8a6479d6441967c170c5aa23

SHA256
d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931

SHA512
3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e05x3gvf.2s2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7860.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc7860.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1C92.tmp

Filesize
1KB

MD5
e8b1af1a015e9b4a002892d236572628

SHA1
0b62d45ec030c4622fa3510876a2efd4541ecb77

SHA256
f7d2554e98c77ea01f05c7780fe808423ebd0620e379f0df4a9163d82fe26cf8

SHA512
ee414df33fa9193841c08c80309a4c140d362f4dd26932afbdfe46f6ee566304d582d99459b9881c60d79591ad8358deb27a671562a007f1dbbede20acd9c48e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp542C.tmp.bat

Filesize
151B

MD5
cc9cbbe1f6be485acbf78a81d60e6788

SHA1
5d4b15990df62309bd9dbdf5df777618f29485d9

SHA256
fb70fa286f7428c5ced6fa5654ed0036eb969efab0ef61fa096efe1b3e67ca62

SHA512
babc36f68dab29a937de4cbbfc41e80c704966244b80c25e6e1018c48fb68b78427c19180989ff3c7d58322fbddd137a57336a4487962c3505826a54f4dd0eff

Download Submit
C:\Users\Admin\Desktop\a\T7.exe

Filesize
13KB

MD5
106317cd019b63fde3dc44b2e365d0e6

SHA1
cf8158e8e6433a5ddd81f68558632bbad3d33db6

SHA256
a288d0d898c7729037ab07a8ab05713862a3b74aba2c5fc55ec2cd590d547a7b

SHA512
b1eff4c179096157252ae383860862fc53394094d76459d18568b669290c150291f671f8d80f7e741c436466e66cb0db197f79d9a9a9282961b3baa101f9d5a6

Download Submit
C:\Users\Admin\Desktop\a\T9.exe

Filesize
13KB

MD5
762e2c938ec4a35e6b67fafb977fd05c

SHA1
2082b2a1b33adcc4aae73cbc072eaac50f72ab7e

SHA256
8b2951ff344d2fcaeb0045269c93e0ced5402ff53efe685cde78fba2293e6283

SHA512
c688320e12ca1536217282a42c02dd4d19b97d2dc96ea206b1327866fd496f277c21426fe9cb3e894fdf3bd59d0da6f4ab787bfa4e53d010d038e1d3156f9dfc

Download Submit
C:\Users\Admin\Desktop\a\TTF.exe

Filesize
13KB

MD5
b5fe23cf43111d7500a18d432d1a9307

SHA1
e3b7dc412ce069a4262522b7c8e791278fc130dc

SHA256
2d187bb4a0d2a51dbe68e4085815167c952803f310c323bfe6f39b2cfc9f6532

SHA512
54ee18272c9d3e700452a69a7a0d56cd9ab32196878f059e3ab3fbce0558183c5fbc06eae7b7b0def3636ec6747867a138b1350cd8a9a2ec046e704453f4db26

Download Submit
C:\Users\Admin\Desktop\a\asusns.exe

Filesize
701KB

MD5
0e3ed8b5e5952cffc0e119b6082a6599

SHA1
b8275da931abd327fb0ad3b102a5917aa950c636

SHA256
e5797ef4bea22b1d24a9147c48726e9960ffa1b5866e04c11de117531483fe9d

SHA512
15e06c4a477984dac67d7301d8019935af32e7a5fc47c6d69533f00e7aa3992cd8e496d02f05f9c2f4c43f3a928fe070276bdcb18f86bcab43faae3709522beb

Download Submit
C:\Users\Admin\Desktop\a\backdoor.exe

Filesize
68KB

MD5
698f5896ec35c84909344dc08b7cae67

SHA1
4c3eb447125f74f2eef63e14a5d97a823fa8d4e9

SHA256
9cc2e2d5feeb360b2ea9a650809468f08e13c0e997ebadf5baa69ae3c27a958e

SHA512
2230abef3f2ac7fff21f2af8a1df79a0ab3f7b1153ce696745ff5cef7f677bfe562dc820eb36be8e4819210ffa565d52e3b940f0cad5427d30a3aa05a4bcde2b

Download Submit
C:\Users\Admin\Desktop\a\build2.exe

Filesize
481KB

MD5
f9a4f6684d1bf48406a42921aebc1596

SHA1
c9186ff53de4724ede20c6485136b4b2072bb6a6

SHA256
e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042

SHA512
67294a47dfef6aba404939497c403f93318841e9c5ee28b706f7506b5dff2630381e28e86f6dcbfdff2427092a515db1dc0a04e334e7f8de8b0b682269ff88fd

Download Submit
C:\Users\Admin\Desktop\a\c7.exe

Filesize
316KB

MD5
819ea2d1b7f70aa3fab1a5eefd8928fd

SHA1
c13b663ec677b95631a845d2627e12d71ca96fdd

SHA256
e00f4b1980537b569386c1e5d37410b11aa74a4f771311cec06d60130d7aa1c5

SHA512
3e8261f470ddc9a06077ad352fd5d34f3c999f168e7e53b9d5c8c2d4ab9691af89ab208c09767b27519bcf9cd6fdf4e4df949ec219bca4fda1165b178efad113

Download Submit
C:\Users\Admin\Desktop\a\cookie250.exe

Filesize
304KB

MD5
1b099f749669dfe00b4177988018fc40

SHA1
c007e18cbe95b286b146531a01dde05127ebd747

SHA256
f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262

SHA512
87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd

Download Submit
C:\Users\Admin\Desktop\a\keylogger.exe

Filesize
51KB

MD5
fbbc99e0b5c7a5f4b76886520f5a4f63

SHA1
361b841c52643792c26868f90e0330ba2ab131ae

SHA256
6054e52edc7112fcecaaf39f37c6bdaa35f98bfaff45d4e01802b9a8bedd2eef

SHA512
5de0b99a9d3f7cdee1d9ed8122c62f096b59cca93c9ad4c4eb15da6bb08d5ea07c09f2864e8a841dcc4095e890e47dd595f51c535ab37713f807a151de52cb11

Download Submit
C:\Users\Admin\Desktop\a\msedge.exe

Filesize
271KB

MD5
c2ec3c7d003e11d0db8aab918df1e47a

SHA1
9c1c3421a1d0207bec271b9cd38a48cb0a1fb285

SHA256
97b1441bd0a459186311604d3cf3fc2b212dff334f4640d9171189080698c940

SHA512
bb43cf35712213ec0643a48451791da6cd8e9c4f1281980dd972e8483ddba7f56b55d23cd4fc9eca91b1ca4e1bc7370769b71cdc3e250c9f1941eb72ce278170

Download Submit
C:\Users\Admin\Desktop\a\mservice64.exe

Filesize
668KB

MD5
c1915f095d3e7b2ad07b5aadc21be2e3

SHA1
9643864f45e15e14e95545cfae9462c977933ba4

SHA256
b0d8f20c0bb09ab90c44281d372e98520c94cecaba6a374be64dc4fdd45f1c89

SHA512
e1dbd8501409dab0537b9afdb8961c3031280e0968f0dc0bc3339e14af3e1f009bdfa0c5425f62590f1db6c8c33fc65b95da65cacdc83338128a7887676bee13

Download Submit
C:\Users\Admin\Desktop\a\nano.exe

Filesize
552KB

MD5
1873f27a43f63c02800d6c80014c0235

SHA1
3441bba24453db09fb56e02a9d56cdf775886f07

SHA256
4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e

SHA512
9f2b663afc1cc3dbc8eba3278f61ffb41c19e42f94ee4c8a60eff83c8846b81d34e4ff869b643434a8ad5657c46bd06a712f0598062b62802ba6f0ee6f4fb8f2

Download Submit
C:\Users\Admin\Desktop\a\networks_profile.exe

Filesize
6.6MB

MD5
7306abcf62c8ee10a1692a6a85af9297

SHA1
69900ccc2400e685b981b3654af57c062ffb44e2

SHA256
37c9a26faec0bb21171b3968d2e4254f6ae10ff7ae0d0b1493226685bc5d3b4b

SHA512
cd00a60387e06fcc6f14242adb97a54575a49cf1e9b22c74aa5d8bb7617e571fc194049691e4ee0fcff8bdd659b04de62f46d07e2f3330c18ac7035134e183d1

Download Submit
C:\Users\Admin\Desktop\a\out_test_sig.exe

Filesize
5.0MB

MD5
47f2701f1d1f6645baccced737e8e20c

SHA1
56e90cc7888e2cc74916ce10148a10c9261fdf2f

SHA256
3d37b55464bded5c54903c5328e695d9b08b483e65cf6bdadd4ecf93954dfc9e

SHA512
1b3f47fa75b041e8a2e144d3e98d103e90ed119b530ab7f7ac61ada3c4cad9abfac93a480b2236f1f6c9093f2ea9529acace77ac15f851450f5e16015735b045

Download Submit
C:\Users\Admin\Desktop\a\regasm.exe

Filesize
593KB

MD5
f74f2df998219d602185c46107329e82

SHA1
a0f8eeb2e5c712e690923fdaf3b7cefc64f3d63e

SHA256
5f569c72db9c31528daf2e907938b9bb711ea3a050efe5bf5d514dc962c5415c

SHA512
b28e1eafefaf4f71666bf6c216c8672eb615a5e369bd913b85d99b2774df76ffaa489f145722a93f80f2afcb76eef40e62dcf246793bcf867d696487e9343a9f

Download Submit
C:\Users\Admin\Desktop\a\request.exe

Filesize
307KB

MD5
ef8320eace6f753231666c61104bdd49

SHA1
0166aceb79a7d6b4a041fd7595fc1d75404a4419

SHA256
8e2fa428fa5e7092d117dadf10529a35f415a0b8fa27cd17607e23dd913ffcdc

SHA512
354676c97fe1666920a75fdbffecfd0ac802613572b9e7d0dbc9a1ac24b3c771ca8fa3c1f3375f0a1c90364a07fa22469d2e7eb822196c0a2a1893931b62efe9

Download Submit
C:\Users\Admin\Desktop\a\robotic.exe

Filesize
538KB

MD5
6b1bbe4e391cdfd775780d8502ccbc41

SHA1
a910f7ac9ed8fd57f7455f04e99bcd732bc8241a

SHA256
2999b0ecf157b9f37dcfa1cb4a0ffff73092c416499a356fdb1558d66985e9a3

SHA512
9ad2ca4cc8af0b6185be87d9026da5cdac2c52ff15b0fd2ba333ff3a25016e06a294d7cf5cf32b1869a1f5e3692f071f582ba2151ac16f9be738ea7862ab57d3

Download Submit
C:\Users\Admin\Desktop\a\sahost.exe

Filesize
499KB

MD5
29e3de6b17d0fdfb360834f038b59a39

SHA1
1e3fdca7e4dec1ebb618f69675928363657ba064

SHA256
8cf6a3d7e5694a0453d85e67a038bb5804b6eb8969287f1d021bdb7b95234e9d

SHA512
ebf889085bb105182739d7a748d8b12b26de3e47f11535260adac23beee3d5b43aa572b6043ace7ac068cee36529c3cf448986f3218aec742ab6fce4db47440a

Download Submit
C:\Users\Admin\Desktop\a\stub.exe

Filesize
48KB

MD5
a7ed4ba445aa61c4632dd6579c212bf5

SHA1
a81d766d12a6dd8c3cec537387a089650b34e103

SHA256
91fb355fdc173c40fa77f8a252031d6bc32fab91c5e5573da28044494691c820

SHA512
2a0e0afdecf803657f2d67433399dc3119a3b4221334a9c8d7cb3e3e741457aaa26d2edd32377a102f1c539a4ef065cb5296d4cdfe7657993223e675e3fd4bae

Download Submit
C:\Users\Admin\Desktop\a\wahost.exe

Filesize
712KB

MD5
14b98daca4a9912ad416eb7c0231cc21

SHA1
58328f022b71c8b3001449e87f91fbad4ac973ea

SHA256
850752cfce58c44ce5d48735f4d53ccc1f8d12b7e1ae00d367d9c42103d9ad99

SHA512
1169760e0245b4b1f2676271e0e56b62db0157a08ada4098d7dfacbf5c1e2d6cac29275c04a2d59471d7a9d9420425c07387c63fd3bc9bc4f91a9b3d5addcb0a

Download Submit
memory/664-459-0x0000000005710000-0x0000000005A67000-memory.dmp

Filesize
3.3MB

Download
memory/1000-38-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/1000-43-0x000000000A780000-0x000000000A7E8000-memory.dmp

Filesize
416KB

Download
memory/1000-36-0x0000000000A80000-0x0000000000B36000-memory.dmp

Filesize
728KB

Download
memory/1000-37-0x0000000005AD0000-0x0000000006076000-memory.dmp

Filesize
5.6MB

Download
memory/1000-39-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/1000-40-0x0000000005780000-0x000000000581C000-memory.dmp

Filesize
624KB

Download
memory/1000-41-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Filesize
120KB

Download
memory/1000-42-0x0000000005AA0000-0x0000000005AB6000-memory.dmp

Filesize
88KB

Download
memory/1780-423-0x0000000000B70000-0x0000000000B7A000-memory.dmp

Filesize
40KB

Download
memory/2000-371-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Filesize
40KB

Download
memory/2020-93-0x00000000064E0000-0x0000000006530000-memory.dmp

Filesize
320KB

Download
memory/2020-94-0x0000000006700000-0x00000000068C2000-memory.dmp

Filesize
1.8MB

Download
memory/2020-52-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2180-21-0x000000001D530000-0x000000001D54E000-memory.dmp

Filesize
120KB

Download
memory/2180-16-0x0000000000490000-0x000000000051C000-memory.dmp

Filesize
560KB

Download
memory/2180-17-0x000000001D560000-0x000000001D66A000-memory.dmp

Filesize
1.0MB

Download
memory/2180-18-0x000000001D470000-0x000000001D482000-memory.dmp

Filesize
72KB

Download
memory/2180-19-0x000000001D4D0000-0x000000001D50C000-memory.dmp

Filesize
240KB

Download
memory/2180-20-0x000000001DAF0000-0x000000001DB66000-memory.dmp

Filesize
472KB

Download
memory/2180-23-0x000000001F0A0000-0x000000001F5C8000-memory.dmp

Filesize
5.2MB

Download
memory/2180-22-0x000000001E9A0000-0x000000001EB62000-memory.dmp

Filesize
1.8MB

Download
memory/2340-107-0x00000000007E0000-0x00000000007E8000-memory.dmp

Filesize
32KB

Download
memory/2340-106-0x0000000000080000-0x00000000000C8000-memory.dmp

Filesize
288KB

Download
memory/2408-263-0x00000000052E0000-0x00000000052F2000-memory.dmp

Filesize
72KB

Download
memory/2408-237-0x0000000000420000-0x00000000004BA000-memory.dmp

Filesize
616KB

Download
memory/2408-413-0x0000000006290000-0x00000000062F8000-memory.dmp

Filesize
416KB

Download
memory/2428-391-0x00000000069F0000-0x0000000006A7C000-memory.dmp

Filesize
560KB

Download
memory/2428-220-0x0000000000CC0000-0x0000000000D74000-memory.dmp

Filesize
720KB

Download
memory/2428-229-0x0000000006D30000-0x0000000006D46000-memory.dmp

Filesize
88KB

Download
memory/2428-387-0x00000000069A0000-0x00000000069AE000-memory.dmp

Filesize
56KB

Download
memory/2624-288-0x0000000006B60000-0x0000000006B9C000-memory.dmp

Filesize
240KB

Download
memory/2624-280-0x0000000005F10000-0x0000000005F86000-memory.dmp

Filesize
472KB

Download
memory/2624-346-0x0000000008060000-0x000000000858C000-memory.dmp

Filesize
5.2MB

Download
memory/2624-289-0x0000000006CD0000-0x0000000006D1C000-memory.dmp

Filesize
304KB

Download
memory/2624-287-0x0000000006B00000-0x0000000006B12000-memory.dmp

Filesize
72KB

Download
memory/2624-286-0x0000000006BC0000-0x0000000006CCA000-memory.dmp

Filesize
1.0MB

Download
memory/2624-264-0x00000000009F0000-0x0000000000A42000-memory.dmp

Filesize
328KB

Download
memory/2624-285-0x0000000007070000-0x0000000007688000-memory.dmp

Filesize
6.1MB

Download
memory/2624-282-0x00000000067F0000-0x000000000680E000-memory.dmp

Filesize
120KB

Download
memory/2884-442-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2884-441-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3076-119-0x0000000000730000-0x0000000000742000-memory.dmp

Filesize
72KB

Download
memory/3524-412-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3536-4-0x00007FFE439A0000-0x00007FFE44462000-memory.dmp

Filesize
10.8MB

Download
memory/3536-3-0x00007FFE439A3000-0x00007FFE439A5000-memory.dmp

Filesize
8KB

Download
memory/3536-2-0x00007FFE439A0000-0x00007FFE44462000-memory.dmp

Filesize
10.8MB

Download
memory/3536-0-0x00007FFE439A3000-0x00007FFE439A5000-memory.dmp

Filesize
8KB

Download
memory/3536-1-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/3976-381-0x00000000007C0000-0x00000000007CA000-memory.dmp

Filesize
40KB

Download
memory/4300-141-0x0000023B63020000-0x0000023B63042000-memory.dmp

Filesize
136KB

Download
memory/4632-80-0x0000000006BA0000-0x0000000006BBE000-memory.dmp

Filesize
120KB

Download
memory/4632-56-0x00000000056B0000-0x00000000056D2000-memory.dmp

Filesize
136KB

Download
memory/4632-82-0x0000000007EE0000-0x000000000855A000-memory.dmp

Filesize
6.5MB

Download
memory/4632-71-0x0000000070CC0000-0x0000000070D0C000-memory.dmp

Filesize
304KB

Download
memory/4632-70-0x0000000006B60000-0x0000000006B94000-memory.dmp

Filesize
208KB

Download
memory/4632-69-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

Filesize
304KB

Download
memory/4632-68-0x0000000006570000-0x000000000658E000-memory.dmp

Filesize
120KB

Download
memory/4632-83-0x00000000078A0000-0x00000000078BA000-memory.dmp

Filesize
104KB

Download
memory/4632-67-0x00000000060D0000-0x0000000006427000-memory.dmp

Filesize
3.3MB

Download
memory/4632-57-0x00000000057D0000-0x0000000005836000-memory.dmp

Filesize
408KB

Download
memory/4632-58-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Filesize
408KB

Download
memory/4632-81-0x00000000077A0000-0x0000000007844000-memory.dmp

Filesize
656KB

Download
memory/4632-50-0x0000000005930000-0x0000000005F5A000-memory.dmp

Filesize
6.2MB

Download
memory/4632-48-0x0000000002D70000-0x0000000002DA6000-memory.dmp

Filesize
216KB

Download
memory/4632-84-0x0000000007920000-0x000000000792A000-memory.dmp

Filesize
40KB

Download
memory/4632-85-0x0000000007B30000-0x0000000007BC6000-memory.dmp

Filesize
600KB

Download
memory/4632-90-0x0000000007BE0000-0x0000000007BE8000-memory.dmp

Filesize
32KB

Download
memory/4632-86-0x0000000007AB0000-0x0000000007AC1000-memory.dmp

Filesize
68KB

Download
memory/4632-87-0x0000000007AE0000-0x0000000007AEE000-memory.dmp

Filesize
56KB

Download
memory/4632-88-0x0000000007AF0000-0x0000000007B05000-memory.dmp

Filesize
84KB

Download
memory/4632-89-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Filesize
104KB

Download
memory/4940-449-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/5036-408-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads