asyncrat | 8a3da2a07e82bf22f3cd239de861b2b8c50c9fe9ee2ba12a33564e1b5cc93fed

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BTC.exe
Size 1.1MB
Sample240903-jhflps1dnq
SHA256 8a3da2a07e82bf22f3cd239de861b2b8c50c9fe9ee2ba12a33564e1b5cc93fed
MD5 f1424e5b9810a4a9c33506aa784fca89
SHA1 4ad6287fe149832551afbcb1113db50cd133777b
SHA512 e03432137a7c12c03d34302fe4e1774a3a08935d39f665e4086fd8637f4ea961a645e2a8bb3cd85dd24c54861e4f01b0500a70641e2fa3a4a09e2e89a3b77380
SSDEEP 12288:JYYjzzONcuuIYsYNeaCbU6sKySaVQ4pBgncu7EKHCBbsCU/hpgmxCBbsCUXEGnF9:eg9uurUngnBU97EniCUppoiCUXfF9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat quasar stormkitty xworm default office04 credential_access discovery evasion persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7479631857:AAFuIUMNJYKHzJ3Bc9t4FSh9ZQXlqymhFnk/sendMessage?chat_id=6291749148
https://api.telegram.org/bot7074211690:AAFHdtGIEk1j3FpHjh6_p8Xjh9rfZDo4uSc/sendMessage?chat_id=6291749148

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

185.252.232.158:7812
64.23.232.116:7812

Mutex

vsvf

Attributes

delay
1
install
true
install_file
Windows Security Health Service.exe
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

146.190.29.250:7812

Mutex

VNM_MUTEX_h1gQxrpyccCFZq7JPS

Attributes

encryption_key
V5fWyT4tQqXFouaUUxe2
install_name
Windows Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
SubDir34

Extracted

Family

xworm

Version

146.190.29.250:7812
165.227.91.90:7812
167.99.94.206:7812

Mutex

4chIqEbR5Rq6U6EI

Attributes

Install_directory
%AppData%
install_file
Windows Defender Service Host.exe
telegram
https://api.telegram.org/bot7074211690:AAFHdtGIEk1j3FpHjh6_p8Xjh9rfZDo4uSc/sendMessage?chat_id=6291749148

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x00070000000234d7-63.dat	disable_win_def
behavioral2/memory/4768-75-0x00000000004E0000-0x000000000056C000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234d8-68.dat	family_xworm
behavioral2/memory/1444-76-0x0000000000770000-0x0000000000782000-memory.dmp	family_xworm

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Window Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Window Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Window Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Window Security.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234d7-63.dat	family_quasar
behavioral2/memory/4768-75-0x00000000004E0000-0x000000000056C000-memory.dmp	family_quasar

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 4 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234d6-37.dat	family_stormkitty
behavioral2/files/0x00070000000234d5-44.dat	family_stormkitty
behavioral2/memory/4784-73-0x0000000000750000-0x000000000078E000-memory.dmp	family_stormkitty
behavioral2/memory/3152-71-0x00000000000F0000-0x0000000000120000-memory.dmp	family_stormkitty

VenomRAT 2 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral2/files/0x00070000000234d4-16.dat	VenomRAT
behavioral2/memory/4780-64-0x00000000006F0000-0x0000000000708000-memory.dmp	VenomRAT

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/files/0x00070000000234d4-16.dat	family_asyncrat
behavioral2/files/0x00070000000234d6-37.dat	family_asyncrat
behavioral2/files/0x00070000000234d5-44.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	BTC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Cracked.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Windows Defender Service Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Window Security.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Service Host.lnk	Windows Defender Service Host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender Service Host.lnk	Windows Defender Service Host.exe

Executes dropped EXE 11 IoCs

pid	Process
1840	crack.exe
4780	Cracked.exe
3152	svchost.exe
4784	update.exe
4768	Window Security.exe
1444	Windows Defender Service Host.exe
220	Windows Security.exe
2976	Windows Security Health Service.exe
3992	Window Security.exe
1656	Windows Defender Service Host.exe
1220	Windows Defender Service Host.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Window Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Window Security.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Service Host = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender Service Host.exe"	Windows Defender Service Host.exe

Drops desktop.ini file(s) 14 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	svchost.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com
38	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Window Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Window Security.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4264	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3980	cmd.exe
632	netsh.exe
2564	cmd.exe
4492	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	update.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2564	timeout.exe
2364	timeout.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4264	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4704	schtasks.exe
2092	schtasks.exe
2336	schtasks.exe
1104	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1444	Windows Defender Service Host.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
4780	Cracked.exe
1708	powershell.exe
1708	powershell.exe
1444	Windows Defender Service Host.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe
2976	Windows Security Health Service.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	Cracked.exe
Token: SeDebugPrivilege	1444	Windows Defender Service Host.exe
Token: SeDebugPrivilege	4784	update.exe
Token: SeDebugPrivilege	3152	svchost.exe
Token: SeDebugPrivilege	4780	Cracked.exe
Token: SeDebugPrivilege	4768	Window Security.exe
Token: SeDebugPrivilege	1840	crack.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	220	Windows Security.exe
Token: SeDebugPrivilege	2976	Windows Security Health Service.exe
Token: SeDebugPrivilege	220	Windows Security.exe
Token: SeDebugPrivilege	2976	Windows Security Health Service.exe
Token: SeDebugPrivilege	3992	Window Security.exe
Token: SeDebugPrivilege	1656	Windows Defender Service Host.exe
Token: SeDebugPrivilege	1220	Windows Defender Service Host.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1444	Windows Defender Service Host.exe
220	Windows Security.exe
2976	Windows Security Health Service.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1840	1224	BTC.exe	83
PID 1224 wrote to memory of 1840	1224	BTC.exe	83
PID 1224 wrote to memory of 1840	1224	BTC.exe	83
PID 1224 wrote to memory of 4780	1224	BTC.exe	84
PID 1224 wrote to memory of 4780	1224	BTC.exe	84
PID 1224 wrote to memory of 3152	1224	BTC.exe	85
PID 1224 wrote to memory of 3152	1224	BTC.exe	85
PID 1224 wrote to memory of 3152	1224	BTC.exe	85
PID 1224 wrote to memory of 4784	1224	BTC.exe	86
PID 1224 wrote to memory of 4784	1224	BTC.exe	86
PID 1224 wrote to memory of 4784	1224	BTC.exe	86
PID 1224 wrote to memory of 4768	1224	BTC.exe	87
PID 1224 wrote to memory of 4768	1224	BTC.exe	87
PID 1224 wrote to memory of 4768	1224	BTC.exe	87
PID 1224 wrote to memory of 1444	1224	BTC.exe	88
PID 1224 wrote to memory of 1444	1224	BTC.exe	88
PID 4780 wrote to memory of 4356	4780	Cracked.exe	92
PID 4780 wrote to memory of 4356	4780	Cracked.exe	92
PID 4780 wrote to memory of 4368	4780	Cracked.exe	94
PID 4780 wrote to memory of 4368	4780	Cracked.exe	94
PID 4356 wrote to memory of 4704	4356	cmd.exe	97
PID 4356 wrote to memory of 4704	4356	cmd.exe	97
PID 4368 wrote to memory of 2564	4368	cmd.exe	98
PID 4368 wrote to memory of 2564	4368	cmd.exe	98
PID 4768 wrote to memory of 2092	4768	Window Security.exe	99
PID 4768 wrote to memory of 2092	4768	Window Security.exe	99
PID 4768 wrote to memory of 2092	4768	Window Security.exe	99
PID 4768 wrote to memory of 220	4768	Window Security.exe	101
PID 4768 wrote to memory of 220	4768	Window Security.exe	101
PID 4768 wrote to memory of 220	4768	Window Security.exe	101
PID 4768 wrote to memory of 1708	4768	Window Security.exe	102
PID 4768 wrote to memory of 1708	4768	Window Security.exe	102
PID 4768 wrote to memory of 1708	4768	Window Security.exe	102
PID 1840 wrote to memory of 2640	1840	crack.exe	104
PID 1840 wrote to memory of 2640	1840	crack.exe	104
PID 1840 wrote to memory of 2640	1840	crack.exe	104
PID 1444 wrote to memory of 2336	1444	Windows Defender Service Host.exe	106
PID 1444 wrote to memory of 2336	1444	Windows Defender Service Host.exe	106
PID 2640 wrote to memory of 2364	2640	cmd.exe	108
PID 2640 wrote to memory of 2364	2640	cmd.exe	108
PID 2640 wrote to memory of 2364	2640	cmd.exe	108
PID 4368 wrote to memory of 2976	4368	cmd.exe	109
PID 4368 wrote to memory of 2976	4368	cmd.exe	109
PID 220 wrote to memory of 1104	220	Windows Security.exe	110
PID 220 wrote to memory of 1104	220	Windows Security.exe	110
PID 220 wrote to memory of 1104	220	Windows Security.exe	110
PID 4768 wrote to memory of 1988	4768	Window Security.exe	115
PID 4768 wrote to memory of 1988	4768	Window Security.exe	115
PID 4768 wrote to memory of 1988	4768	Window Security.exe	115
PID 1988 wrote to memory of 2984	1988	cmd.exe	117
PID 1988 wrote to memory of 2984	1988	cmd.exe	117
PID 1988 wrote to memory of 2984	1988	cmd.exe	117
PID 4784 wrote to memory of 3980	4784	update.exe	119
PID 4784 wrote to memory of 3980	4784	update.exe	119
PID 4784 wrote to memory of 3980	4784	update.exe	119
PID 3980 wrote to memory of 1840	3980	cmd.exe	121
PID 3980 wrote to memory of 1840	3980	cmd.exe	121
PID 3980 wrote to memory of 1840	3980	cmd.exe	121
PID 3980 wrote to memory of 632	3980	cmd.exe	122
PID 3980 wrote to memory of 632	3980	cmd.exe	122
PID 3980 wrote to memory of 632	3980	cmd.exe	122
PID 3980 wrote to memory of 2780	3980	cmd.exe	123
PID 3980 wrote to memory of 2780	3980	cmd.exe	123
PID 3980 wrote to memory of 2780	3980	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BTC.exe
"C:\Users\Admin\AppData\Local\Temp\BTC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Roaming\crack.exe
  "C:\Users\Admin\AppData\Roaming\crack.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEBC7.tmp.cmd""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2364
- C:\Users\Admin\AppData\Roaming\Cracked.exe
  "C:\Users\Admin\AppData\Roaming\Cracked.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Windows Security Health Service" /tr '"C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE82D.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2564
  - - C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe
      "C:\Users\Admin\AppData\Roaming\Windows Security Health Service.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2976
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2564
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4492
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5108
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2500
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3628
- C:\Users\Admin\AppData\Roaming\update.exe
  "C:\Users\Admin\AppData\Roaming\update.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:632
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2184
- C:\Users\Admin\AppData\Roaming\Window Security.exe
  "C:\Users\Admin\AppData\Roaming\Window Security.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Window Security.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2092
- - C:\Users\Admin\AppData\Roaming\SubDir34\Windows Security.exe
    "C:\Users\Admin\AppData\Roaming\SubDir34\Windows Security.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir34\Windows Security.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZgDcwmAnxACu.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4264
  - - C:\Users\Admin\AppData\Roaming\Window Security.exe
      "C:\Users\Admin\AppData\Roaming\Window Security.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe
  "C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender Service Host" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2336

C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe
"C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe
"C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\Admin@KVIWLPUJ_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\11d9d4f3b4d40f0301d279a4756db7d8\msgid.dat
Size 4B
SHA256 05b4204a40b597ca2449330302681efbeaaf3b485936447381275e2b41fb6d64
MD5 06358599b7afb2506e063c1ea0a09fbd
SHA1 e1d8af6f181950b3fd114e82ca8b8703f84ebfa9
SHA512 21af2fe072757ada8e40e46ca9d6ed0310e7887e47e724046a5d31e0232609df85a5463954b2c13f55966c4fcc25e1fce5b93867c2b831f7d4ab6b9c22dc12f3
MD5 SHA1 SHA512

Submit Download

Windows Defender Service Host.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows Defender Service Host.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

Window Security.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Window Security.exe.log
Size 1KB
SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
MD5 10eab9c2684febb5327b6976f2047587
SHA1 a12ed54146a7f5c4c580416aecb899549712449e
SHA512 7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
MD5 SHA1 SHA512

Submit Download

ZgDcwmAnxACu.bat

Path C:\Users\Admin\AppData\Local\Temp\ZgDcwmAnxACu.bat
Size 209B
SHA256 f282c9e96514d889d1c772b3534ecae8b6242a7bf0a09c7e53cdca8877f8cab5
MD5 b57c5f0d10edd141103bbf2093192c99
SHA1 cbf9d8818dad0a447a08fd7613f6f8bddad8cb18
SHA512 79bbb10647770cad9c77e32d6862f5707b212b1067996315242aa20f4c77e63e99c03b2e1dbb61734afd5ce672123bd073493ee47527f81fe81fefd80e557228
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_nuxjyxyi.fuk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nuxjyxyi.fuk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpE82D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpE82D.tmp.bat
Size 175B
SHA256 0d7ef7623ec0191a98c158a4ea9b7afee7cf092666798ce8c969f2bfb31cd703
MD5 2ceab8e9e92f9cdb8cb17ee55ee00c52
SHA1 2bf8095f02eaabdce2b187f8ebf3bbed97f53bd6
SHA512 3537042dd15165746e37784114ed225f658f081a23a2151e48269f7ae9b564b1cfa7afecf30dff753ed576eb4426ad00946ad4c57fa77bf91baf90b38522b867
MD5 SHA1 SHA512

Submit Download

tmpEBC7.tmp.cmd

Path C:\Users\Admin\AppData\Local\Temp\tmpEBC7.tmp.cmd
Size 151B
SHA256 a8d83bc4acc94add1c86d6be9644778868bffd5e49f39bdcd66a8174e4b990e8
MD5 eb98d53301aae47f3b8c062ec8e8f261
SHA1 44f95a7dd52ca33c96a51f0c6d5d0fd55baefc8d
SHA512 44810fcf8759dbe7bb24244f0ee3ef2c2b4f07f1fdc6b78b15164260cac8c325677d67c7a93833204b76978f5e268e62372566dd3063b456a77cb7c979a95374
MD5 SHA1 SHA512

Submit Download

tmpFE1E.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpFE1E.tmp.dat
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpFE2B.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpFE2B.tmp.dat
Size 114KB
SHA256 9372c1ee21c8440368f6dd8f6c9aeda24f2067056050fab9d4e050a75437d75b
MD5 c3311360e96fcf6ea559c40a78ede854
SHA1 562ada1868020814b25b5dbbdbcb5a9feb9eb6ba
SHA512 fef308d10d04d9a3de7db431a9ab4a47dc120bfe0d7ae7db7e151802c426a46b00426b861e7e57ac4d6d21dde6289f278b2dbf903d4d1d6b117e77467ab9cf65
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cFqLVumf:I02m/lxhlnmhouHMVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpFE2E.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpFE2E.tmp.dat
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpFE70.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpFE70.tmp.dat
Size 5.0MB
SHA256 357e7a24b49900c79fc7cb36548dd6f0607a80dd7e852bf28ebd9a9e46335906
MD5 ae71e46d9a9c60a6fb840b70cad13b91
SHA1 2a213ae784f5242cc21d9b934706be25ce760f62
SHA512 625dca8ad62b6cc1572d3be14df6926d18129b66198be13e215dac77f2250ca5f0400cb74961cfd45a68ddda8766364ce7454d74b8315298d6f69ef0bf83bde5
SSDEEP 192:28rJQaXoMXp0VW9FxWHMF9nQ0orAGJCY:28r54w0VW3xWk9Kg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\b2a4129d590c5a0f13623e3ce4b6fd11\Admin@KVIWLPUJ_en-US\System\Process.txt
Size 4KB
SHA256 d592302396f5bdf1b8e2c64090d981b3aa336f32e3a1d82fdb336076dc53a997
MD5 f1e430943e6ef483c7230398fd4278ea
SHA1 be559685daf039a102ac00d186f0f4ef71529fd7
SHA512 b4f4fc5ddcac953330a7e5bebaab3c0f97c19e4bff82d5912ca5daa20eb0188a3714bf782cd311c3f348cbd58346cf77f212ee4d9676b3e25196f53f997f9663
SSDEEP 48:qBq71b1u75NzoBbcfsuyFM6HUEe/LUTdCf0I23EP:qBq71Bo5NzywByqPEe/LUTdCf0I23EP
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\fc7cdc24b837ca3d660e8a7c947b53b5\msgid.dat
Size 1B
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
MD5 SHA1 SHA512

Submit Download

Cracked.exe

Path C:\Users\Admin\AppData\Roaming\Cracked.exe
Size 74KB
SHA256 8d27369ffa8b29d561fa9daf485be14d2fc00287bb1c69d4c84d514891c8db5e
MD5 0dfa83a82f6418c73406d78296de61be
SHA1 dd7eceef8a434c43e0751e180bf714e08771d336
SHA512 9a4b026250b18c29ab7dd48203f321c2ef2f12695bd2dcb52ebbc15001c8ddf019d5a7e04da056c50c1881ce269d1810259bf6d04b61f471e8751b7192fc73d4
SSDEEP 1536:dU40cxhzjBCViPMVSe9VdQuDI6H1bf/6hQzceLVclN:dU1cxhzVCiPMVSe9VdQsH1bfoQ3BY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DataLogs.conf

Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
Size 8B
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
MD5 SHA1 SHA512

Submit Download

Window Security.exe

Path C:\Users\Admin\AppData\Roaming\Window Security.exe
Size 534KB
SHA256 b893220d33f9b8a0f98702bb577e4459792253ae651bdc18a93145ccd008af54
MD5 81b2c5c64951b603480d40d321540ff2
SHA1 314199ad92baeb203f5555ff3814e9b7a4f226f8
SHA512 3a57655bf7aa18a34364659553aad26a3d5b8946b957441f5fedebab5936b6bb2c71c6337837ead486a001b6a9227437cc5c4ec4a5de627f0e2db10dc6afdea6
SSDEEP 6144:78fG1BIgrx8kFYLTiMkbQEju0KoivMbi7DSVmh6Khe535h+GofOlblwXH/Gy3V8O:HPx7FYPiMQRcRDF4uy33ofAblwX2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Defender Service Host.exe

Path C:\Users\Admin\AppData\Roaming\Windows Defender Service Host.exe
Size 43KB
SHA256 4957d607c2984f94a258dba088fa1ab85e508bfaabe9279bf8b6bf6f4b97a9bb
MD5 5322a12cb24e83bfa9746fbde06d07e7
SHA1 5263a4f26bda073e9f82dd4fa612eb494dd771c7
SHA512 67bfaef1ddf4ad44218c82c5634e7f726304845fab1d5361353fdacd8d8d767fec32c871fa304f4199dde3f6224be76c67560a64c1d72bbe20e134c50d1bf058
SSDEEP 384:P/ixLdTHZGdG/lYbgZrExLM/mZ4+11FILihivQ7pkFMAMiLTg9ZZwd/mVvNVqEsh:HQPcGtpE9M/XAFHhIRFe9/4OChkiXr
MD5 SHA1 SHA512 SSDEEP

Submit Download

crack.exe

Path C:\Users\Admin\AppData\Roaming\crack.exe
Size 8KB
SHA256 a5390a297f14ef8f5be308009ec436d2a58598188dbb92d7299795a10ba1c541
MD5 9215015740c937980b6b53cee5087769
SHA1 a0bfe95486944f1548620d4de472c3758e95d36a
SHA512 5b9bbf1836466d803d3e160a38e10c8397aa3966c120ab6435a52b7d0a09eb664ef2172bf0e7e2de1cc3eae261167c9355fa7ac3b1b7e4504a7e07b82c4b90e2
SSDEEP 96:1xXv/rn2JKbqjV6IoG71k7PNnvIcckV579WbhRN6+fwls+VV7+bN+EhkBQET8lzj:z/rn2JKb6V6NGRk7Vwe9WbhRNEdwyJC
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 170KB
SHA256 4950eb74909bd6e739e38e57d8c6465c76ef108d65cac9f130d3f5c6d2fe943f
MD5 96014694a042d8344b910bc47d79337b
SHA1 9d19ab2f110ae58f30965a5a3d608cbf51986edb
SHA512 fe308c42b3ad2c3d73a834399aa12ea23f336103389181dface80a81da8be1ffd9a950cac802dc8a806ad318eb90a6bb6021d1acd9206a07749f83f2bb6cd03d
SSDEEP 3072:T+STW8djpN6izj8mZwlZbX5gD5sLIPu/i9bTJ2cJ+rj6+Wpn:w8XN6W8mmzmDWMPSi9b1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Roaming\update.exe
Size 225KB
SHA256 f243df692ee7552286d52b23e4993e07a27877aa86c63b84903a8e6cbd0d19f3
MD5 b8df7316cc35a0fb6fe3a326b4283010
SHA1 d49c11f5a95f72e37d6194df41178f2b7faa01ee
SHA512 3ef92be29123695820970a003fd0561a57f87c8c6adae86781729027ce40ede4b63da30d0b0cc75376bd9ae90accaf674fc7ff799a8b73ab4bb45b2ca65ff120
SSDEEP 3072:P+STW8djpN6izj8mZwDODZG6vmwTMUbBYeVUeE1dMGryePSuqKv65A8kC5A6+Wpn:E8XN6W8mmGmvUbGp54uVv6SHC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-119-0x0000000006670000-0x000000000667A000-memory.dmp

Download

memory/1224-0-0x00007FFEC1133000-0x00007FFEC1135000-memory.dmp

Download

memory/1224-1-0x0000000000890000-0x00000000009B0000-memory.dmp

Download

memory/1444-76-0x0000000000770000-0x0000000000782000-memory.dmp

Download

memory/1708-138-0x0000000006FC0000-0x0000000006FCE000-memory.dmp

Download

memory/1708-132-0x0000000006C40000-0x0000000006CE3000-memory.dmp

Download

memory/1708-95-0x0000000004BC0000-0x0000000004BE2000-memory.dmp

Download

memory/1708-96-0x0000000004C60000-0x0000000004CC6000-memory.dmp

Download

memory/1708-113-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Download

memory/1708-111-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Download

memory/1708-94-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Download

memory/1708-93-0x0000000000CD0000-0x0000000000D06000-memory.dmp

Download

memory/1708-120-0x00000000069F0000-0x0000000006A22000-memory.dmp

Download

memory/1708-121-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Download

memory/1708-131-0x00000000069D0000-0x00000000069EE000-memory.dmp

Download

memory/1708-141-0x00000000070B0000-0x00000000070B8000-memory.dmp

Download

memory/1708-133-0x00000000073E0000-0x0000000007A5A000-memory.dmp

Download

memory/1708-134-0x0000000006D90000-0x0000000006DAA000-memory.dmp

Download

memory/1708-135-0x0000000006E00000-0x0000000006E0A000-memory.dmp

Download

memory/1708-136-0x0000000007010000-0x00000000070A6000-memory.dmp

Download

memory/1708-137-0x0000000006F90000-0x0000000006FA1000-memory.dmp

Download

memory/1708-105-0x00000000054E0000-0x0000000005834000-memory.dmp

Download

memory/1708-139-0x0000000006FD0000-0x0000000006FE4000-memory.dmp

Download

memory/1708-140-0x00000000070D0000-0x00000000070EA000-memory.dmp

Download

memory/1840-74-0x0000000000180000-0x0000000000188000-memory.dmp

Download

memory/3152-463-0x0000000006010000-0x0000000006022000-memory.dmp

Download

memory/3152-71-0x00000000000F0000-0x0000000000120000-memory.dmp

Download

memory/3152-450-0x0000000005E00000-0x0000000005E0A000-memory.dmp

Download

memory/4768-87-0x00000000061C0000-0x00000000061FC000-memory.dmp

Download

memory/4768-77-0x0000000005390000-0x0000000005934000-memory.dmp

Download

memory/4768-78-0x0000000004E80000-0x0000000004F12000-memory.dmp

Download

memory/4768-79-0x0000000004F20000-0x0000000004F86000-memory.dmp

Download

memory/4768-75-0x00000000004E0000-0x000000000056C000-memory.dmp

Download

memory/4768-80-0x0000000005C80000-0x0000000005C92000-memory.dmp

Download

memory/4780-85-0x00007FFEC1130000-0x00007FFEC1BF1000-memory.dmp

Download

memory/4780-72-0x00007FFEC1130000-0x00007FFEC1BF1000-memory.dmp

Download

memory/4780-64-0x00000000006F0000-0x0000000000708000-memory.dmp

Download

memory/4784-73-0x0000000000750000-0x000000000078E000-memory.dmp

Download