Analysis

  • max time kernel
    86s
  • max time network
    88s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2024 08:23

General

  • Target

    https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777

Extracted

Family

asyncrat

Version

1.0.7

Botnet

RuntimeBroker

C2

37.18.62.18:8060

Mutex

RuntimeBroker.exe

Attributes
  • delay

    1

  • install

    false

  • install_file

    RuntimeBroker.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

159.146.103.132:5554

Mutex

mtx

Attributes
  • delay

    1

  • install

    true

  • install_file

    winfile.exe

  • install_folder

    %Temp%

aes.plain

Extracted

Family

gurcu

C2

https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • ToxicEye

    ToxicEye is a trojan written in C#.

  • Async RAT payload 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
      2⤵
        PID:4744
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
        2⤵
          PID:4980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3992
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
          2⤵
            PID:1084
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
            2⤵
              PID:552
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
              2⤵
                PID:1492
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
                2⤵
                  PID:5092
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3672
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
                  2⤵
                    PID:2228
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                    2⤵
                      PID:8
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                      2⤵
                        PID:4368
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                        2⤵
                          PID:2648
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5180 /prefetch:8
                          2⤵
                            PID:1688
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                            2⤵
                              PID:4820
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2280,4887298985462631481,11613224949663832629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5092
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:708
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2076
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:2344
                                • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe
                                  "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2312
                                  • C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe
                                    "C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe"
                                    2⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3172
                                    • C:\Windows\System32\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"
                                      3⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:5248
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1FC8.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1FC8.tmp.bat
                                      3⤵
                                        PID:5296
                                        • C:\Windows\system32\tasklist.exe
                                          Tasklist /fi "PID eq 3172"
                                          4⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5352
                                        • C:\Windows\system32\find.exe
                                          find ":"
                                          4⤵
                                            PID:5360
                                          • C:\Windows\system32\timeout.exe
                                            Timeout /T 1 /Nobreak
                                            4⤵
                                            • Delays execution with timeout.exe
                                            PID:5396
                                          • C:\Users\Static\wsappx.exe
                                            "wsappx.exe"
                                            4⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5412
                                            • C:\Windows\System32\schtasks.exe
                                              "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"
                                              5⤵
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5492
                                    • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe
                                      "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5624
                                    • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe
                                      "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"
                                      1⤵
                                        PID:5748
                                      • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulTaskV3.exe
                                        "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulTaskV3.exe"
                                        1⤵
                                          PID:5844
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeSrvAntivirus" /tr "C:\Users\%username%\AppData\Local\MicrosoftRuntimeServ.exe" /sc onstart /RL HIGHEST /f
                                            2⤵
                                              PID:5896
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /create /tn "RuntimeSrvAntivirus" /tr "C:\Users\Admin\AppData\Local\MicrosoftRuntimeServ.exe" /sc onstart /RL HIGHEST /f
                                                3⤵
                                                • Scheduled Task/Job: Scheduled Task
                                                PID:5912
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeBrkr" /tr "C:\Users\%username%\AppData\Local\temp\RuntimeBroker.exe" /sc onstart /RL HIGHEST /f
                                              2⤵
                                                PID:5928
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks /create /tn "RuntimeBrkr" /tr "C:\Users\Admin\AppData\Local\temp\RuntimeBroker.exe" /sc onstart /RL HIGHEST /f
                                                  3⤵
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:5944
                                            • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulTaskV3.exe
                                              "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulTaskV3.exe"
                                              1⤵
                                                PID:5968
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeSrvAntivirus" /tr "C:\Users\%username%\AppData\Local\MicrosoftRuntimeServ.exe" /sc onstart /RL HIGHEST /f
                                                  2⤵
                                                    PID:6020
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /create /tn "RuntimeSrvAntivirus" /tr "C:\Users\Admin\AppData\Local\MicrosoftRuntimeServ.exe" /sc onstart /RL HIGHEST /f
                                                      3⤵
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:6036
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeBrkr" /tr "C:\Users\%username%\AppData\Local\temp\RuntimeBroker.exe" /sc onstart /RL HIGHEST /f
                                                    2⤵
                                                      PID:6052
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /create /tn "RuntimeBrkr" /tr "C:\Users\Admin\AppData\Local\temp\RuntimeBroker.exe" /sc onstart /RL HIGHEST /f
                                                        3⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:6068
                                                  • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulTaskV3.exe
                                                    "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulTaskV3.exe"
                                                    1⤵
                                                      PID:5124
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeSrvAntivirus" /tr "C:\Users\%username%\AppData\Local\MicrosoftRuntimeServ.exe" /sc onstart /RL HIGHEST /f
                                                        2⤵
                                                          PID:5132
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /create /tn "RuntimeSrvAntivirus" /tr "C:\Users\Admin\AppData\Local\MicrosoftRuntimeServ.exe" /sc onstart /RL HIGHEST /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:2044
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeBrkr" /tr "C:\Users\%username%\AppData\Local\temp\RuntimeBroker.exe" /sc onstart /RL HIGHEST /f
                                                          2⤵
                                                            PID:1792
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /create /tn "RuntimeBrkr" /tr "C:\Users\Admin\AppData\Local\temp\RuntimeBroker.exe" /sc onstart /RL HIGHEST /f
                                                              3⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:2264
                                                        • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\SHDTSK.exe
                                                          "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\SHDTSK.exe"
                                                          1⤵
                                                            PID:5184
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Svchst" /tr "C:\Users\%username%\AppData\Local\Temp\PwMn.exe" /sc onlogon /RL HIGHEST /f
                                                              2⤵
                                                                PID:5196
                                                                • C:\Windows\system32\schtasks.exe
                                                                  schtasks /create /tn "Svchst" /tr "C:\Users\Admin\AppData\Local\Temp\PwMn.exe" /sc onlogon /RL HIGHEST /f
                                                                  3⤵
                                                                  • Scheduled Task/Job: Scheduled Task
                                                                  PID:3144
                                                            • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulServV2.exe
                                                              "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\ShedulServV2.exe"
                                                              1⤵
                                                                PID:4208
                                                                • C:\Users\Admin\AppData\Local\Temp\server.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:3048
                                                              • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\sff.exe
                                                                "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\sff.exe"
                                                                1⤵
                                                                  PID:5424
                                                                • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\seftali.exe
                                                                  "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\seftali.exe"
                                                                  1⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:5572
                                                                  • C:\Users\Admin\AppData\Local\Temp\disas.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\disas.exe"
                                                                    2⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5868
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "winfile" /tr '"C:\Users\Admin\AppData\Local\Temp\winfile.exe"' & exit
                                                                      3⤵
                                                                        PID:6060
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks /create /f /sc onlogon /rl highest /tn "winfile" /tr '"C:\Users\Admin\AppData\Local\Temp\winfile.exe"'
                                                                          4⤵
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:6124
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp96EC.tmp.bat""
                                                                        3⤵
                                                                          PID:5992
                                                                          • C:\Windows\system32\timeout.exe
                                                                            timeout 3
                                                                            4⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:4640
                                                                          • C:\Users\Admin\AppData\Local\Temp\winfile.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\winfile.exe"
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5132
                                                                    • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\RuntimeSV.exe
                                                                      "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\RuntimeSV.exe"
                                                                      1⤵
                                                                        PID:5720
                                                                        • C:\Users\Admin\AppData\Local\Temp\RuntimeSrv.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\RuntimeSrv.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:4128
                                                                      • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\rnp.exe
                                                                        "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\rnp.exe"
                                                                        1⤵
                                                                          PID:5780
                                                                        • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe
                                                                          "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"
                                                                          1⤵
                                                                            PID:4892
                                                                          • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe
                                                                            "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"
                                                                            1⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1416
                                                                          • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe
                                                                            "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"
                                                                            1⤵
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1820
                                                                          • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe
                                                                            "C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"
                                                                            1⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5320

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

                                                                            Filesize

                                                                            281B

                                                                            MD5

                                                                            f5e982fe5cd7667929b6ee19fcc62b10

                                                                            SHA1

                                                                            3e6a25ded44bf2e5eee6f04da4b21db4ca2e6798

                                                                            SHA256

                                                                            3b2cc981b27628b81ddfc6166d662ed2d068d2c9d3dc7a7c48bf78bb7d71718f

                                                                            SHA512

                                                                            3f9af0ece995302a04b1ec682efc2be444c3575f10ad3bbfcbb645dfd621d5ad55988d62ee6272b0bd6101989bc4bf6b95e486a27574cf44f460b69625c056b8

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            b8c45a4914a130bc2032187c751a1d91

                                                                            SHA1

                                                                            e50bdc59c5ffe16486bed99b2fc68fcc7578518d

                                                                            SHA256

                                                                            195b65fdd332ef51bda9c196bca7a00bf1723ff8a23cee744c6683811f419f6f

                                                                            SHA512

                                                                            483ae5118bbd2d28374e20bb0b680a15f8286c8f8c0ca45bc553844a4985234cc388c717d25af8392099d16f9fea15efe762e81bd79fe539dbac7d9518308826

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

                                                                            Filesize

                                                                            978B

                                                                            MD5

                                                                            50948e40664ec3fd5e57c1b3c51948c5

                                                                            SHA1

                                                                            02ae297d16d797987043f0e2da0e928073d424b0

                                                                            SHA256

                                                                            ff30ad39429887fe33d66cacace3d151c79026c1fa8e0f370ff4bd171db1dae4

                                                                            SHA512

                                                                            64a1f0b931d880571d6576f29b9df586d08a2d10020e2c32296547082b807f06aa1d54fb5059f775fc89f60081e8e207f09090fe112eb01bfbd789ff8d3e2243

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                            Filesize

                                                                            471B

                                                                            MD5

                                                                            451472a81f1fdf3228f75901df63a50a

                                                                            SHA1

                                                                            f7ca2600a39475f4c18b4d9737978d6692efc074

                                                                            SHA256

                                                                            9c71d11a0796bc755aa8dfea77da4afe79c99de5c809a4f939e0cbacaa63c621

                                                                            SHA512

                                                                            97acbd02883cd2f8a2b0a8f5b2c4d2a98d9f24030f50f7dbe3426a03d70716119df23855edf85014f92b0349de052cd262439de83f77ce99621b7089dae3ff8d

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

                                                                            Filesize

                                                                            480B

                                                                            MD5

                                                                            9cb550e7a8bd93b7ac209a5b324b82be

                                                                            SHA1

                                                                            09b1ba952c8c502766988e9c1db8a0ad0f931ffd

                                                                            SHA256

                                                                            93a4fbeddfaa1400607f2d7683803cde64ee3c810da4f26ab817df1c3224ca91

                                                                            SHA512

                                                                            eed3c5ec3f486cf079e37163ef3ff25345e95abc6b9dfa1fd9770e6299b0bf4cf308e63f89013e1816ce9f65dfdea08db9f18f6c6d2fdfd636c3b4daf52009b6

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

                                                                            Filesize

                                                                            482B

                                                                            MD5

                                                                            57968ee3678cc3f1bd8464fed48dc930

                                                                            SHA1

                                                                            681e29b8db497ecde8077dc50d5f6a73b1239283

                                                                            SHA256

                                                                            280098339be55f606f4b302e6619744a4456567f8036631d6eb879dda26b565b

                                                                            SHA512

                                                                            9f572eb72125e3d239484b3d4d1e06afa8cf4b77eaff1a68df6e9b98adb75081bffe31989e467d6f1728e6231ef62522773ac95f16721a629e8c5886eff7e7fa

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

                                                                            Filesize

                                                                            480B

                                                                            MD5

                                                                            fa25b51b5f094263b47bf52ad5c7d583

                                                                            SHA1

                                                                            4941e0d5eb831088458182748d1cbacd85e7de5d

                                                                            SHA256

                                                                            9af3df41ad102a3f4858fe8bc4d48c9a01888dcfe2a8607464e5386004264277

                                                                            SHA512

                                                                            95a6977f46cd9beb558ebb8ecfe61b76522a1d8ade689071fe618b51a091b889402b0517c9222f1e22b94c74cf34399653fd9a146962288b6b487f643733e0b5

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                            Filesize

                                                                            412B

                                                                            MD5

                                                                            538adac9714d4489703d3dac430934be

                                                                            SHA1

                                                                            3e163ec6dec03d2f406e2b294496d72f73c4bea8

                                                                            SHA256

                                                                            cb0e790309ff1972d3e42e3469cc806b07c24997117f9fdfa0798b857bc2aa27

                                                                            SHA512

                                                                            61c946fcb5e19d4017f4fd5a6b366e18ea06d8582d8669d1b89397d27b3cbc361a5680a2c6468b2912ace14b66e18042084eca33cc84a542a22eb38cee2e421e

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            ecf7ca53c80b5245e35839009d12f866

                                                                            SHA1

                                                                            a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                                            SHA256

                                                                            882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                                            SHA512

                                                                            706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                            Filesize

                                                                            152B

                                                                            MD5

                                                                            4dd2754d1bea40445984d65abee82b21

                                                                            SHA1

                                                                            4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                                            SHA256

                                                                            183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                                            SHA512

                                                                            92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            c4e98cfdd196493bc3c6e9a38f73a79a

                                                                            SHA1

                                                                            8464f4d8aef48d39fa93592e3dc269f1fbefafc7

                                                                            SHA256

                                                                            db0d3c0c289ee1bc59256708dd5fc10aa6f765f2a61430a7cb0462a46c0e37c0

                                                                            SHA512

                                                                            f5b7ec2dbf6a214bcca37b6f52e3c4b93277a98a293c28857487ae928e5b44cd7a30ba87da7690e83e71a8fa8e9c8558630f3f994a5431daa57eec5e8faa12ef

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                            Filesize

                                                                            573B

                                                                            MD5

                                                                            a6d346f58cbec0a6e4015327b25f1537

                                                                            SHA1

                                                                            750056e65a8b1c20b1a6051f5adcdf35821a6ac1

                                                                            SHA256

                                                                            1a715b1b5b62ef83ca8c62a18eddb3b5b6b738be2c654ab7a38cf22fdc8bea56

                                                                            SHA512

                                                                            74e563217a28cd6427739731f51ba2e35ee060c8ae6959d458d06a0416e17ffc6a49f8d0bbcb8d17cef144a45c36eb9f3b92305389ab0cfc5043f530d9f28d89

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            5KB

                                                                            MD5

                                                                            1d9e5a7b7e53e2cd88ca7a27bf3ddd9f

                                                                            SHA1

                                                                            f71da43c6f974b128ab81523142bfbdf5e941c23

                                                                            SHA256

                                                                            c9040a34b78943ebe6695be50a9293b7ef5203fa7a921bcff292368b3a808254

                                                                            SHA512

                                                                            b83a242567f169303eb765b7ffa82dc0fd8583fee74f8292d6d6c3494a537ba1a6f5685170b988579cfe658f5b425df996ed2f84ee9fba85bf024621a1b85028

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            094d5972513b77504695fadf02dd9397

                                                                            SHA1

                                                                            03c17ee07b6389201d725ee0ce63262db2e18756

                                                                            SHA256

                                                                            caf67a9df0ab8ac117185fe356c62fcca8fd9ffbe634aa0953c5bbc593141dc5

                                                                            SHA512

                                                                            dc407a642861865245b6298beebd6ac95e4735f7d680c4f9cb7b8dd940190e5f3e28c213ee6041d353d0d138b81de54cdea99768367bfc40cb95256deb9aa248

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            e779eca34711bb156fbab467ec1e4ec7

                                                                            SHA1

                                                                            eeadc3d7870d34ef9e0f6a6161c63e5614cc8614

                                                                            SHA256

                                                                            d4d79de74069f4908499b8602d4af14601c1ce664ef81411a7ad20a86af3ed9f

                                                                            SHA512

                                                                            a08bf83b562dae6dd9fcd54c5251f54f3ce9a61419d99cd88634ce7e2ee036e42d5ada5767374c35a372dd42473987756ed5b77ea1695238c53ce73fb794c513

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            1c89edc064f948216071be8e43af9f46

                                                                            SHA1

                                                                            3171f428382840337e75d084cab31e29c410713c

                                                                            SHA256

                                                                            bfec80436a668118d1dce305ef608689326858f9b0bad62956aa0c3de904d405

                                                                            SHA512

                                                                            63e0419ec2ca8e019917044ed22541aa284d4763b6c1e4f888f4d220ead68c512401723b7a78fdbfb6dc5b8f5969e39abf0ce17336db94b2c693c033a30a1576

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d1e6.TMP

                                                                            Filesize

                                                                            874B

                                                                            MD5

                                                                            cb368c4ad95078268dbcf8173c44526c

                                                                            SHA1

                                                                            e227ab4f5eace78efc094cc5498af94aa52ea4b9

                                                                            SHA256

                                                                            956619543c2a4d4109db06b8578d16faad155bf3c42f1d2b3680811baa22511b

                                                                            SHA512

                                                                            fcbdfa1fff965f1a4facafd1f3b7f92da6bdfcf1c55e97a08ef85143eea3382824b125b83a018a5e6ac79efbf6ba41aa71b801e052710d6ef046ecab9baaf993

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                            Filesize

                                                                            16B

                                                                            MD5

                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                            SHA1

                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                            SHA256

                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                            SHA512

                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            10KB

                                                                            MD5

                                                                            eda14a75211b0da02c715b17a97a60de

                                                                            SHA1

                                                                            124838228da0d33e46ca2d2265202f4ed9253e29

                                                                            SHA256

                                                                            49d5f6a1ab686d61e2bed17cf7ba73b994802a5cab91838ddf5fa30ba43a326a

                                                                            SHA512

                                                                            3a0bde14b23db9182a0d475d5796460ff8f94945d782b7e71f654124b602611861eeedbbe9569859010e027c5a9c6b9ba1ea193b0feedcd83bcfed548739b627

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                            Filesize

                                                                            10KB

                                                                            MD5

                                                                            7292fcb403c5387e945facbba461fb46

                                                                            SHA1

                                                                            2676eabdb770bb7177050e32fe550a51a80a13a0

                                                                            SHA256

                                                                            e14c931c0da67838530263c6cce6a5295bc926f976f474cd17ceff4cbda6bf46

                                                                            SHA512

                                                                            d786c07c3a35336cd79c54dde565a7a958b9afcc4179e6d86c9d2d88da17fea085e76ff0211ff4e51e14924580f96fe7b2cc0ac766286a9bf98753237efc934c

                                                                          • C:\Users\Admin\AppData\Local\Temp\1a5fdae6-8f46-4b8b-a738-d6572f690d43\AgileDotNetRT.dll

                                                                            Filesize

                                                                            94KB

                                                                            MD5

                                                                            14ff402962ad21b78ae0b4c43cd1f194

                                                                            SHA1

                                                                            f8a510eb26666e875a5bdd1cadad40602763ad72

                                                                            SHA256

                                                                            fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                                                                            SHA512

                                                                            daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                                                                          • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe

                                                                            Filesize

                                                                            261KB

                                                                            MD5

                                                                            77314c258bba292297b76c06007b94be

                                                                            SHA1

                                                                            97b5357d506d2bf7ddc902e5f4563618f8f92310

                                                                            SHA256

                                                                            1acfc1d432784490f601f19dff65ac63b920dd1fe4c9692b92988baab5d380d5

                                                                            SHA512

                                                                            361fd152b0d77ac75b89a42f36a34372421bb41d5755a97e4b817e2ab045925bddb1802acdbcf2dee346cd3ba4d31062c6d625fb77f4e6e05c3ed68f565c2818

                                                                          • C:\Users\Admin\AppData\Local\Temp\RuntimeSrv.exe

                                                                            Filesize

                                                                            32KB

                                                                            MD5

                                                                            b0115ffe9cf28a8155b95cc159d8def5

                                                                            SHA1

                                                                            55486d54f6e84dccfa626f18661856618a02aafb

                                                                            SHA256

                                                                            e3add632a49543c3a291615288e0c4585e49f3f9f2a73ccd42c9c0ff97d4f11e

                                                                            SHA512

                                                                            7757f61283d4143693855905d87991703dfa38b066b46ae202fc466d856627caeb25323cdae61599e2e96fd866f9caa1aebe76e0331a3811640c8d5a8b8e5ebb

                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tpkdfk2i.bv2.ps1

                                                                            Filesize

                                                                            60B

                                                                            MD5

                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                            SHA1

                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                            SHA256

                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                            SHA512

                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                          • C:\Users\Admin\AppData\Local\Temp\disas.exe

                                                                            Filesize

                                                                            47KB

                                                                            MD5

                                                                            90ef5e4f564a69f94e47955daecf5a7e

                                                                            SHA1

                                                                            8fd27d79d74a657fb6ecfcb0e1975f00a1cf417e

                                                                            SHA256

                                                                            41d486ecbc7e076dc64d603fb09dbf0cff934c9816e427d16450aedf95672e9d

                                                                            SHA512

                                                                            ad1e7b3c3776eae5448fe981520ca0c048000c13fd5c65d5c95dbd840ea56dfb8dbe164532fc9c013b96fd89ff3106170284de2ceb61c6907703299a5829365c

                                                                          • C:\Users\Admin\AppData\Local\Temp\server.exe

                                                                            Filesize

                                                                            43KB

                                                                            MD5

                                                                            fc347be85e7b7d8e7eb14770bb606b96

                                                                            SHA1

                                                                            461e25c14733e84cb7e8a3dd7f569e463ee32201

                                                                            SHA256

                                                                            7454f7f4d7fdbbb8d4136a9e338224b8da0618a0ad02ea76f766df94b285b0c4

                                                                            SHA512

                                                                            87e84c31f141d126b20b001f8bb4cedc2046118488b386598f1da007e0e6da79e198bcc62f082eb99722a9a833fa19a051bc95f8e4104bc4c272421d87699c19

                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp1FC8.tmp.bat

                                                                            Filesize

                                                                            195B

                                                                            MD5

                                                                            d5181a60d2ecf8e71cc3fe84f8116879

                                                                            SHA1

                                                                            4f7da3114f6b939b6aadc98ba6fb112c63b3fec8

                                                                            SHA256

                                                                            288d20c03163a23d6003a1c7d79e2993636055e4b05889354522861fd6c179d8

                                                                            SHA512

                                                                            d3fe701193395e3c66b505e92caf6c1809c0de222721534ecd5f2ccae09382d306dae9bf2412a36cd83943eb6d343b0a1ff8b16d3e9a1ff465a5f5e00244b228

                                                                          • C:\Users\Admin\AppData\Local\Temp\tmp96EC.tmp.bat

                                                                            Filesize

                                                                            154B

                                                                            MD5

                                                                            85226d5eca883622a67cf9ea609ae722

                                                                            SHA1

                                                                            f8d4416377750569b1630239076041ab946c661b

                                                                            SHA256

                                                                            735b5bd8c273dfb8441bd70806e55cc56011930209c7998d528020c6060c090f

                                                                            SHA512

                                                                            d6649020a22daf74d170a37154422c5e4324dbd78b7dea60db92a613b62294868a8e8345d8785ba587f11ec4ae3f5f928d4c9874f7e00cce5eb1817a79a005c0

                                                                          • C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe

                                                                            Filesize

                                                                            793KB

                                                                            MD5

                                                                            835d21dc5baa96f1ce1bf6b66d92d637

                                                                            SHA1

                                                                            e0fb2a01a9859f0d2c983b3850c76f8512817e2d

                                                                            SHA256

                                                                            e67f2b34ef647d59eb8ebd4a88f85dc072346ca5c275cba1ee2307b80a560319

                                                                            SHA512

                                                                            747a9b6cde0207c722a62904a2c8708188f7c9e65e94cf55667e90096f1d1852e145061bd8e764bf30aaca0fb0f4355668feccc951041af735677c4c644aba87

                                                                          • C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main.zip

                                                                            Filesize

                                                                            5.7MB

                                                                            MD5

                                                                            40fca7e63c83e68b138f51bb2e7695b5

                                                                            SHA1

                                                                            bcf22826e3976f4f511dfbcc357b0dddc3184f31

                                                                            SHA256

                                                                            d4d29c3d237cfd9ff8da8fa20f2ba020bd2cb4f96259e83744d467da32c029eb

                                                                            SHA512

                                                                            23b7474e30641f39cdbfb0a11572fc96ddd7dc5c3ddba374b1b76ceecc63d87a142652d0e333e7334c349995207d34dfd09568ab4c232ab6eed902b590ca5a0c

                                                                          • \??\pipe\LOCAL\crashpad_4860_OCKOWRBDPYPLDHMJ

                                                                            MD5

                                                                            d41d8cd98f00b204e9800998ecf8427e

                                                                            SHA1

                                                                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                            SHA256

                                                                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                            SHA512

                                                                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                          • memory/1820-369-0x0000000005890000-0x0000000005E34000-memory.dmp

                                                                            Filesize

                                                                            5.6MB

                                                                          • memory/1820-372-0x00000000054C0000-0x0000000005526000-memory.dmp

                                                                            Filesize

                                                                            408KB

                                                                          • memory/1820-382-0x0000000073AE0000-0x0000000073B69000-memory.dmp

                                                                            Filesize

                                                                            548KB

                                                                          • memory/1820-374-0x0000000006810000-0x0000000006A34000-memory.dmp

                                                                            Filesize

                                                                            2.1MB

                                                                          • memory/1820-368-0x0000000000880000-0x0000000000A6A000-memory.dmp

                                                                            Filesize

                                                                            1.9MB

                                                                          • memory/1820-373-0x00000000065C0000-0x00000000065CA000-memory.dmp

                                                                            Filesize

                                                                            40KB

                                                                          • memory/1820-370-0x0000000005380000-0x0000000005412000-memory.dmp

                                                                            Filesize

                                                                            584KB

                                                                          • memory/1820-371-0x0000000005420000-0x00000000054BC000-memory.dmp

                                                                            Filesize

                                                                            624KB

                                                                          • memory/2312-247-0x0000024B6C020000-0x0000024B6C02A000-memory.dmp

                                                                            Filesize

                                                                            40KB

                                                                          • memory/2312-244-0x0000024B6BFA0000-0x0000024B6BFC0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                          • memory/2312-233-0x0000024B51670000-0x0000024B519AE000-memory.dmp

                                                                            Filesize

                                                                            3.2MB

                                                                          • memory/3172-246-0x000002D8F5860000-0x000002D8F592C000-memory.dmp

                                                                            Filesize

                                                                            816KB

                                                                          • memory/5572-326-0x0000000000540000-0x0000000000548000-memory.dmp

                                                                            Filesize

                                                                            32KB

                                                                          • memory/5572-359-0x0000000000C10000-0x0000000000C29000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/5572-336-0x00000000027D0000-0x00000000027F2000-memory.dmp

                                                                            Filesize

                                                                            136KB

                                                                          • memory/5748-266-0x0000000000C60000-0x0000000000C72000-memory.dmp

                                                                            Filesize

                                                                            72KB

                                                                          • memory/5868-357-0x0000000000D50000-0x0000000000D62000-memory.dmp

                                                                            Filesize

                                                                            72KB