asyncrat | hxxps://github[.]com/0x9ini/VenomRAT-v6[.]0[.]3-SOURCE-[.]git

Analysis

max time kernel
297s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/0x9ini/VenomRAT-v6.0.3-SOURCE-.git

Score

10^/10

asyncrat gurcu toxiceye runtimebroker agilenet discovery rat stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

RuntimeBroker

37.18.62.18:8060

Mutex

RuntimeBroker.exe

Attributes

delay
1
install
false
install_file
RuntimeBroker.exe
install_folder
%AppData%

aes.plain

Extracted

Family

toxiceye

https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777

Extracted

Family

gurcu

https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
ToxicEye
ToxicEye is a trojan written in C#.
rat trojan toxiceye

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/files/0x0003000000022eaa-574.dat	family_asyncrat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

win-xworm-builder.exewsappx.exePwMn.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	win-xworm-builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	wsappx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	PwMn.exe

Executes dropped EXE 9 IoCs

Processes:

win-xworm-builder.exewsappx.exeRuntimeSrv.exeRuntimeBroker.exeshdtsk.exePwMn.exernp.exeRuntimeBroker.exeRuntimeBroker.exe

pid	Process
3180	win-xworm-builder.exe
3412	wsappx.exe
3216	RuntimeSrv.exe
3588	RuntimeBroker.exe
1460	shdtsk.exe
3944	PwMn.exe
1256	rnp.exe
3488	RuntimeBroker.exe
60	RuntimeBroker.exe

Loads dropped DLL 2 IoCs

Processes:

XHVNC.exeXHVNC.exe

pid	Process
1052	XHVNC.exe
916	XHVNC.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1052-542-0x0000000005F90000-0x00000000061B4000-memory.dmp	agile_net

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
137	raw.githubusercontent.com
106	camo.githubusercontent.com
131	raw.githubusercontent.com
132	raw.githubusercontent.com
135	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exe

pid	Process
2780	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

rnp.exe

description	pid	Process	procid_target
PID 1256 set thread context of 4800	1256	rnp.exe	170

Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

XHVNC.exeXHVNC.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVNC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVNC.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
1084	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3868	schtasks.exe
1544	schtasks.exe
3908	schtasks.exe
4156	schtasks.exe
4612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemspaint.exemsedge.exemsedge.exewsappx.exeRuntimeSrv.exePwMn.exe

pid	Process
1212	msedge.exe
1212	msedge.exe
2948	msedge.exe
2948	msedge.exe
4092	identity_helper.exe
4092	identity_helper.exe
840	msedge.exe
840	msedge.exe
3480	mspaint.exe
3480	mspaint.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
3704	msedge.exe
3704	msedge.exe
3412	wsappx.exe
3412	wsappx.exe
3412	wsappx.exe
3216	RuntimeSrv.exe
3216	RuntimeSrv.exe
3944	PwMn.exe
3944	PwMn.exe
3944	PwMn.exe
3216	RuntimeSrv.exe
3216	RuntimeSrv.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

XHVNC.exe

pid	Process
916	XHVNC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

XWorm-RAT-V2.1-builder.exewin-xworm-builder.exetasklist.exewsappx.exeXWorm-RAT-V2.1-builder.exePwMn.exe

description	pid	Process
Token: SeDebugPrivilege	3708	XWorm-RAT-V2.1-builder.exe
Token: SeDebugPrivilege	3180	win-xworm-builder.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	3412	wsappx.exe
Token: SeDebugPrivilege	2148	XWorm-RAT-V2.1-builder.exe
Token: SeDebugPrivilege	3944	PwMn.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

msedge.exe

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

mspaint.exeOpenWith.exewsappx.exeXHVNC.exeXHVNC.exe

pid	Process
3480	mspaint.exe
3480	mspaint.exe
3480	mspaint.exe
3480	mspaint.exe
2928	OpenWith.exe
3412	wsappx.exe
1052	XHVNC.exe
1052	XHVNC.exe
916	XHVNC.exe
916	XHVNC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2948 wrote to memory of 1972	2948	msedge.exe	82
PID 2948 wrote to memory of 1972	2948	msedge.exe	82
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 3500	2948	msedge.exe	83
PID 2948 wrote to memory of 1212	2948	msedge.exe	84
PID 2948 wrote to memory of 1212	2948	msedge.exe	84
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85
PID 2948 wrote to memory of 3448	2948	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/0x9ini/VenomRAT-v6.0.3-SOURCE-.git
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff379446f8,0x7fff37944708,0x7fff37944718
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,12329568060058730651,819138088037006039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2960

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\VenomRAT-v6.0.3-SOURCE--main\VenomRAT-v6.0.3-SOURCE--main\app.ico"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2928

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"
1⤵
PID:1496

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708
- C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe
  "C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3908
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpEDFB.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpEDFB.tmp.bat
    3⤵
    PID:4328
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 3180"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2780
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:1516
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1084
  - - C:\Users\Static\wsappx.exe
      "wsappx.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3412
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4156

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:916

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\RuntimeSV.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\RuntimeSV.exe"
1⤵
PID:2568
- C:\Users\Admin\AppData\Local\Temp\RuntimeSrv.exe
  C:\Users\Admin\AppData\Local\Temp\RuntimeSrv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- - C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\RuntimeBroker.exe
    RuntimeBroker.exe
    3⤵
    - Executes dropped EXE
    PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeSrv" /tr "%temp%\RuntimeSV.exe" /sc onlogon /rl highest /f
    3⤵
    PID:224
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "RuntimeSrv" /tr "C:\Users\Admin\AppData\Local\Temp\RuntimeSV.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "RuntimeBroker" /tr "%temp%\RuntimeBroker.exe" /sc onlogon /rl highest /f
    3⤵
    PID:4600
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3868

C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\disas.exe
"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\disas.exe"
1⤵
PID:1048
- C:\Users\Admin\AppData\Local\Temp\shdtsk.exe
  C:\Users\Admin\AppData\Local\Temp\shdtsk.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "Svchst" /tr "C:\Users\%username%\AppData\Local\Temp\PwMn.exe" /sc onlogon /RL HIGHEST /f
    3⤵
    PID:2312
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "Svchst" /tr "C:\Users\Admin\AppData\Local\Temp\PwMn.exe" /sc onlogon /RL HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1544
- C:\Users\Admin\AppData\Local\Temp\PwMn.exe
  C:\Users\Admin\AppData\Local\Temp\PwMn.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- - C:\Users\Admin\AppData\Local\Temp\rnp.exe
    "C:\Users\Admin\AppData\Local\Temp\rnp.exe" C:\\Users\\Admin\\AppData\\Local\\Temp\\sff.exe C:\Windows\System32\svchost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1256
  - - C:\Windows\System32\svchost.exe
      "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        
        C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        5⤵
        Executes dropped EXE
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        
        C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
        5⤵
        Executes dropped EXE
        
        PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
280B

MD5
9023341f91dc416eb1049456e4718c72

SHA1
f17fbe29b60068b56cb4d98b7533083a4a1f8af5

SHA256
2b4df3923a59ecb5b07f8ac040412fa37c3266b5e02c5665310228398afe07c7

SHA512
a09a5df1770b5066911c6dc90c37171df2dccc23895b576f6cbfe1aff9f29f6f486c2bd1aa995737df25292283cc41821299c19c97f5b64f3131045e731fca83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
810f3b48a6310566547ebcce0578644e

SHA1
4c31d860c54fee106ab38fb22ed576e38704b072

SHA256
8958557b0daeb46204ea6d49c78dea1547d7f963dfb1131ce2188280951c61b6

SHA512
9158777503ea3452dcc3a28afa7c6b24725df671ba0b8fe29313e2a6c3b50693fadea4df1a1bd0f945216ae9ea2ec7909b0cf364719c9d4f045b71cc02a62834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
979B

MD5
9f3e8c2907cd62e912e00b6140bad286

SHA1
dd0af1509676dd3e9e41a80c605e9a79002ac547

SHA256
1fe2e880f935d802ca1ae4e5fcb0fd12ab600193d8400527a7a7079e6833ceba

SHA512
fb8d0e264d0b430be3a34dd910bf8d04485543bff0855b704ce6ee4be168553d4dc38397770b7c4e8eb9033dadfdea4d538f7743719fd763b35e2f35fdc08c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
471B

MD5
732faa07daae6faf6270ddb27f62bcfb

SHA1
82e94aaa93ad61a4287b6db27c36b3ab7fab6fe0

SHA256
e2a2c9d21862241e74ca950510afbe8cf2fc82c107fbc7e21f271b73d225b044

SHA512
23723d645461a28cc7847d2e58721396e4528aecd3e801af442b8e87d23885c473f4a65eff7af8e8cb27472a5b05bb4fc376f8f28e3eca81f4a25422892b813b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C

Filesize
480B

MD5
ee16b9a5aefbdf6e215c90935b7f7a15

SHA1
c9bf723440debfcf60b4a26bbe834fd7c1dc5851

SHA256
27061dbec420a74e3a1765e97bcc717e9bb75e1092fab7342c48b5244308654c

SHA512
91565efd584f777c22a77b9dd7eb8502d6325d012a4ef7d38176654e2d554855a564b2238fb828feea15f6073532313860292cfb1bd50ddda6f54bf3a0bf067a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
c7d14d197e7e0c9e4e230fafd4ce08e9

SHA1
998fa6d13168d0c91cc04d50ea88eac4ea46e8a0

SHA256
9374730b654d5a19ad86534e3613546e3889792ffbe338f72433e6f9ef11dffa

SHA512
c7c120cda8eedc11d9d5e853d065869d088e9bc9bd1fb2ecfdf996aef2403946219eb5004b74b849dda0e3064a47de39b65eb85d804c811a521e3026c0c0c50e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

Filesize
480B

MD5
e745dbc3302feadc12b23819a3d6532f

SHA1
eb12ff07e1e3b7a8450689ea4cffbc9edb598e8d

SHA256
5826fd715ca50f673300a38024d41086e0039d6620d14ffa3f28c9368c0bd0e4

SHA512
725b88039b41fb3fc634b4fd69ea5deb80d1ede4fe0b06ab4d1d96fa071218ec343a66f6e5d5af2d9013a68707ff99e90dbbaa165814d74389200ecd412056d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Filesize
412B

MD5
18b12332fa4e2a2c3bcd85dcdc919d10

SHA1
6f355f3a8c302f470c4c1afc04a4042fe8f914e7

SHA256
2a9a206c50e560ebe267f5de54462fa0100df7ed1772113bc3fc9c278809d220

SHA512
4a4d89d33dd715aeb3855d23199365d7c38e4fb92b3a880d948c319476a874def8dc8b8df28a556d8699d8fe54b6b58b88ffbf001751fbfbeb95beaf21a8b4af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ff7b51d99447aef6d4dcaa547311ab27

SHA1
ea774d1a8fd31a0c30adb33d9e1a83ccf4cc03b5

SHA256
b670fee8bd9f25392496105b059844e1b778cbd83cafdb82d9b7fc30d3d0f820

SHA512
7901db00c62423c019ca1b0c517026ab230c9bce053dbed130733fffedb8809dc5b44e9c6ff8287ffb83bb36523a174ca8ee703a2bb26cc835a14865198f2579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
283e1f46ec8b901c82a617587b4b0d4f

SHA1
460b636db5c06bbe76516bdd7a7f0d7234b0d3ca

SHA256
31488e311c3fedad3c1495d1ebd571cf65e0c0b799ee7e58c3c7f0bccd5f6160

SHA512
9f7c8d67bf3a6f0c8348bd7e966ecfc7d53695c8786871b48b5efc7020d632495021b1c34721750d6bdbd69a8e32097fac1b723ca8cc7de6691858772516096f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8bd09c79688fdc806dc14f8768c8ec60

SHA1
713d358e07a1d1d90811a2135a7f7844c8805e40

SHA256
c63ecec4afd905957e824855749d661720503a5423bcb79fd8bee93a6f1d0c07

SHA512
cc967cb03f166f23eba53d8e6c93ee3696572e068c785bc1c474befc1b824ca8c6b2b204aff0eca9571f36fc91a9cb945af1105499bba285d89685170e72ed9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dee9273f33cd6d0ef5107c3d79147c0f

SHA1
c5f09d0d74b11c7f1cc52abc7cd57aa05b667877

SHA256
f9209f5ac5dc2aa8172054a5d11b16ed5e295bd75c15b3d7854cd20469acf190

SHA512
db2d9bcdd6288a86ae91bdb4ce6ae0fafc325c07e082a6fe2e565cd0a651d7a1f38709f4f67f3c4c59d4b557fbbacbf673f72329a0cc834d1f9e220ee61d0a7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
672B

MD5
21d3d1958a3803e351447c40335739cd

SHA1
43c5334989dd993e30a77376bc2ef0a426218ac4

SHA256
8e5c94a6a30aefb0f4c21bf20667c8b17cf860cd9081cc2e0bb6ce4cbc49fcca

SHA512
296f4a66cde2bc280367e792b1f3e4230f4617fd5eda16756602c5d456ff501ce5b76e5562a9c1a515fc11a77b0b3a3196eed13b54af6bbc0cc01a34615c4c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c50f70c72c8fb4084ae720f19421fa4e

SHA1
e5dbd88933fcdb2c2e3e08b7533fda43bb8ec9cc

SHA256
6d42ff4330c542e9733041e1cc9b537b672adaf2edb7e00b6857c6d6831277ff

SHA512
7cc699aea74791d8b30b590952617c3001df2f293b870d1d4edce1b0c13d1735af5bf4b2ce3b44033ff47ed583a1154c9606ae6f13451c0b2d2398e7861bad20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e7e289ce63ce0a29e27813462cb32b1c

SHA1
e708410c4bfbaf60aff66c419d317fa4f9d56efb

SHA256
24ef35101eeafa376c52074b5699f8eb6e06d7ad3c03fe657eabdbbd384f06c6

SHA512
2ea8dbdebee18b295186820617de6e8c6476f8cd3407efbe212252c95a383b022742e20969dfb488284e6cbf5fd8572f10c8cb4ec25d4b5807ea6b831e8ea526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2aeb7c33305c20086a419160782c1d02

SHA1
74f5b4c343bf331e2ad3c4688f60069c90032190

SHA256
9d4020b385afa76107abd801fee71a2dca6b9b534e9dc927b77b30e07aba2fc2

SHA512
3a50447f8b53c6003ab54e8ffcfceab99c4a10b07f618dee33c2dcbaab7bc09543e5b07dc1ebdb69035e99dabe67363743e83b02d5a83f701279b28da697b1bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ce01afb6fcf52e99dbc9a5e8158787c

SHA1
eded41aa7b5775318b3bb38c5a057d0b6b629a9e

SHA256
f7183cc9c87d95bc625e0c3a3c9b4297a3ade3df11ef6a509c300058083c1b21

SHA512
de56bcb974b706f03dcf630d86d5cc9cf616358383ec6229f470f3b984c6f37a1557bc2dfafdffb6fdfaacbe1ca720b786dc0f8a512ed3d260491845f3b6cd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d0f32b90d07e2fcb2ecf2903f47e65a1

SHA1
0248c403131a0d7d88a65c36c7387842743b2266

SHA256
7598764643ca541aeaf591df3697d21642ce693303c00de9627f8ad967038a38

SHA512
ce5b62f24eef4115c53057d99ac297a0fb6a230c2379a6dd832e60b037194ee69e66b4e3602c383f60cc0bf17b83d12ec01413a3056b3a845a4f4e694750a480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4a8d75ccea9a896c8b31310e6c95852e

SHA1
8cc6e503a72f0ef265de2e313ddebfa6f819a142

SHA256
a04d68cd5b96802d0182f5ea6e22b15a4b579058af1b8bbe3e746a213b9ad951

SHA512
06c29c868b6c6d102a798629c289bff7093bc91e5de95a6cf95d8417bf3c48bb9fd33f33c49e7488f6668a9bb044b8087b4d2719b1694e58c0b77b8db142f0f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bdfcb981a6d100a87e1ce73d879eb1a1

SHA1
b72415ce7a3205a05f39556cab05d2d3380c31a7

SHA256
6721ee579a71c9b775f4597bd99e7e37d7fe07bc21f14aef4920843c2a331cbe

SHA512
230cbd2acaa2826046fcb5e00d87ed56604e7f861d4ded95a06873afe16704c7e31653a7a1e16e26533b4b6a62403552bac4bd496d44082740c93fd35c6b0eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd74606bec75d1b5f175f220d756e513

SHA1
284ef3ddb243af0b69f6867c2e5c6f6177080377

SHA256
e53d74fc1ee198ac66c0be192bc9b604e5fde492b393f2795c653e8249acd8f3

SHA512
efd90d4bd0694fcd533e7017b261345577778c966611f8d90404d454a953b5c4c08c030b9b40318af3a5780e834d4a09b4a51c4e475930642f9107d7dfcabbb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c2763ffc23dfd6569077e5351e45915

SHA1
91e517921979ba185a8b228ab9929dfbdddc1b58

SHA256
caf4dd7e9df822e2276aea3829d34d6e66801862933b8917d5a143fa56c139f4

SHA512
6b0bae73cbf6c891ff20caf03e9342bcbf5ac4cb33caa7d898d5888125d5508de15634cfe4f789cd286cfc81068838185a0e853dfae05d1af02c77355bd2b76b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7cfa758a4b270bc180e761dff3b35066

SHA1
704b427b591c30b9451b0d5d066f17fc7d210cc7

SHA256
199840ebd97246408314dc7fe11a34f417f7d82d7be4ead0a0d24e2e7e83b616

SHA512
1f793f1e971e8599c798fd5497356b6c91fb76f1f48fc78804de1ae2f78e41ec3bbb6fde609aed7bf60a66b48c72d6d7470bce7481f4b21b006963a60fedb045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44d3de7b9b6d121ce0b6bf6b024c4ed8

SHA1
b18ebd5669dea8f770a5a26cd9ad2d22cf54ac4f

SHA256
d1a780cca9fcbcc217c87c47e60d621fa30450507f0c9570a94446479610f0d6

SHA512
0b2448064fb30efd4895f7bbb3f9c872f24d344a748a2496ec72afc697276ae92491de94300a66ab8a6260dca83be3468cc9bfb3e84cea5d8f82f4dc2beba7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb98.TMP

Filesize
1KB

MD5
8f6d314a354602ed6c6c4c38ab73f292

SHA1
2a03d1e196804df4c67da43d8c462644cc42f3a4

SHA256
8c5e343213e2533b68c2c145bf09dcc601fa4a81e74d10f99d0cb3d5bf380eca

SHA512
64f4320a005a837ece0683926607c0388a3e9fc739b851646df7d7bc0e53e43cc4ea2fae81c82277f5d2043fa712ea64b009019d235ccdbda5f77608ab15eeb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d17c5964e9e230df07a1331170dfabf9

SHA1
70a83d5818216985977de18cbe55f5aa8e646d5c

SHA256
cdd343b6bbd83abe06e7684259c2990a7dc7252c9b03650bf3ca1652d80074f6

SHA512
92f11af8542eb549d48ec7debb34bce5ad03576e145b9b8a2107ef4d470fda2477828a502c6e44581babfb826e7a5e3cd03fe0fd3791750b29ab468c8e197e03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
31930eb64bba7d7a89406766a5dcc4ad

SHA1
6e099f2ca507bd2f67fa2edbf2553df498348951

SHA256
1c87ab5126c744d3251a618ba9aa0b6a93ed3156c56bf05e055639d967945ed2

SHA512
ee24ef09155d6b86dd9660ad41c1d998fc6cf88ba9347f5d1639e9db89f8d376b0b779e1658f50dbca2ac5e21c51bb7fe490c256b595b04401fd55ef3602409f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
26282a4b35fae82a2b570b20794e3f1e

SHA1
57f230bc3b400c75f933380a1b2c15abb9eeccd3

SHA256
90681f65b0ca6a1c9cc857477a89b2a585469c1c4bd9b57901fa79a41aee726e

SHA512
d620a8dd8e7481c3ba8a25aea356bb0293e8109e25ecfe931dcbc20c0b3f8b22564ea133991bf1abc59b155b70e9aedd69001661416de1eacd1703b822cdc4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a5fdae6-8f46-4b8b-a738-d6572f690d43\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PwMn.exe

Filesize
12KB

MD5
9d12e15d0612b444a9c36b2c7bfee7f8

SHA1
3c0691c660f611c6beba666ed750e2ad5b9fd596

SHA256
19b3e9add496d34e4c314cbb9269857c22dc0ee50a04a0fecc0df24385d50b6b

SHA512
e1861a591635bb02185fd83a8dde3cce13e84edf868ef09ade1b657b429209265b0199f511d47edb215fc579e12bf35c51b729647232eeb722f050213779dd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\RuntimeSrv.exe

Filesize
32KB

MD5
b0115ffe9cf28a8155b95cc159d8def5

SHA1
55486d54f6e84dccfa626f18661856618a02aafb

SHA256
e3add632a49543c3a291615288e0c4585e49f3f9f2a73ccd42c9c0ff97d4f11e

SHA512
7757f61283d4143693855905d87991703dfa38b066b46ae202fc466d856627caeb25323cdae61599e2e96fd866f9caa1aebe76e0331a3811640c8d5a8b8e5ebb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rw1qiupr.noi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\rnp.exe

Filesize
20KB

MD5
69cf2ff495c90c2bdd9182e9d1d83467

SHA1
32111f59feb39824f1f8b7d1d541f483c120fc69

SHA256
915bec2968a2cda0014b6fbe20c14f2588059a1d730e8ec44e07c44e19ffe7bc

SHA512
3400facf84a0d68cf83a8ef94859bb032a00dc709987c7741767d0674f0d7069c7cf7cdb2469d18fd3e56f9ab9df391d208fb5071e6bc8d938873e013aee443f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sff.exe

Filesize
29KB

MD5
e40eb702f369e5decfb33b3d78bd4b0c

SHA1
3de25a909a7d8f20aaa4d9aba60aeb501c247f86

SHA256
16a2abe3f4f2c005e206318caf37a366e0084fa8ca8561f3642fa0b4f2f04a7e

SHA512
d015925072810f6ec5044ead32efc8ed6bee2d533c39915ceb526edce20edbc7fd3447423bd6ec608478eb87fdc70c9ad6dcce8b00b8328206adc9294137b60f

Download Submit
C:\Users\Admin\AppData\Local\Temp\shdtsk.exe

Filesize
11KB

MD5
6700d9956f27bd3e8d7ceede0f42b7be

SHA1
1fdc20dd9d2a9061bdd6abef5fe526d90b4bc5e0

SHA256
7053b8b75afb624c315e3f6a27fda8c07c54e4bb9eb83f49ca159a6bc6a9bb51

SHA512
a7f76a2cd47381af46099635325c09642a12cbd92c18e2c12593e0a77496d8e35e56238d98860b19656db0667228f2a404440b307a7e2558aafc8dc5a72f9529

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEDFB.tmp.bat

Filesize
195B

MD5
8a18a782c346762c0b7ff1225efe0f0c

SHA1
03569e23f466e2e6a5f295571bc9b9bc99786248

SHA256
45c2f37b6f1eb2e16173226e1a571bb738bf52a29c358914ab57629f28d889c1

SHA512
1c5381831524531bc4bfee754ecb7faaaabcb7976b53014dd89e8b185459b82581842ebbda86d039f1461475b05541ee87a3cf68baab0a6ea53f1e6325f7ca7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe

Filesize
793KB

MD5
835d21dc5baa96f1ce1bf6b66d92d637

SHA1
e0fb2a01a9859f0d2c983b3850c76f8512817e2d

SHA256
e67f2b34ef647d59eb8ebd4a88f85dc072346ca5c275cba1ee2307b80a560319

SHA512
747a9b6cde0207c722a62904a2c8708188f7c9e65e94cf55667e90096f1d1852e145061bd8e764bf30aaca0fb0f4355668feccc951041af735677c4c644aba87

Download Submit
C:\Users\Admin\Downloads\VenomRAT-v6.0.3-SOURCE--main.zip

Filesize
17KB

MD5
9cc539efb4bb1dcbbaf9defc5f7f6edb

SHA1
9a09a5256a79067935a798809e0f44f305662824

SHA256
bf2fc2715eaf7d6041ceace65399c326c978504fced2a35b8c5c1452f322b220

SHA512
e9573e9af7e737ff86e598593b5c6872a1f3bd02575e96ccd2da7632cd695232f9b4dfb79aa9664152293663cef66115b9380951f7dec96054fd14a80487602e

Download Submit
C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main.zip

Filesize
5.7MB

MD5
40fca7e63c83e68b138f51bb2e7695b5

SHA1
bcf22826e3976f4f511dfbcc357b0dddc3184f31

SHA256
d4d29c3d237cfd9ff8da8fa20f2ba020bd2cb4f96259e83744d467da32c029eb

SHA512
23b7474e30641f39cdbfb0a11572fc96ddd7dc5c3ddba374b1b76ceecc63d87a142652d0e333e7334c349995207d34dfd09568ab4c232ab6eed902b590ca5a0c

Download Submit
C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\RuntimeBroker.exe

Filesize
48KB

MD5
2c417b524aed1da84f185711e5a478f1

SHA1
48380b5cd38eb374f4b439552e84bca400d2008b

SHA256
8b703cd3353ca564a01ba71e1bd9a60f8dc0fa3ac8e93747a5adcdb04ce7c79b

SHA512
2032760a9625b3862dead17143bdc35926a68d7054ba96159123fc45e8ec12553e0c4ff8808f1ecc71ee3660b0c4bbc95b137363b4b5cd94d2e86dd7bfc4eb23

Download Submit
\??\pipe\LOCAL\crashpad_2948_JCDOTTMSBJDTOMEV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/916-553-0x0000000073330000-0x00000000733B9000-memory.dmp

Filesize
548KB

Download
memory/1052-536-0x0000000000250000-0x000000000043A000-memory.dmp

Filesize
1.9MB

Download
memory/1052-539-0x0000000004F20000-0x0000000004FBC000-memory.dmp

Filesize
624KB

Download
memory/1052-550-0x0000000073330000-0x00000000733B9000-memory.dmp

Filesize
548KB

Download
memory/1052-540-0x0000000004FC0000-0x0000000005026000-memory.dmp

Filesize
408KB

Download
memory/1052-542-0x0000000005F90000-0x00000000061B4000-memory.dmp

Filesize
2.1MB

Download
memory/1052-538-0x0000000004E30000-0x0000000004EC2000-memory.dmp

Filesize
584KB

Download
memory/1052-537-0x00000000054D0000-0x0000000005A74000-memory.dmp

Filesize
5.6MB

Download
memory/1052-541-0x0000000005D50000-0x0000000005D5A000-memory.dmp

Filesize
40KB

Download
memory/1496-513-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

Filesize
72KB

Download
memory/3180-527-0x000002489F410000-0x000002489F4DC000-memory.dmp

Filesize
816KB

Download
memory/3708-528-0x000001536AC80000-0x000001536AC8A000-memory.dmp

Filesize
40KB

Download
memory/3708-526-0x0000015352420000-0x0000015352440000-memory.dmp

Filesize
128KB

Download
memory/3708-514-0x00000153502D0000-0x000001535060E000-memory.dmp

Filesize
3.2MB

Download
memory/3944-606-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Filesize
32KB

Download
memory/3944-616-0x0000000002E60000-0x0000000002E82000-memory.dmp

Filesize
136KB

Download
memory/4800-622-0x00000269DE7F0000-0x00000269DE7FC000-memory.dmp

Filesize
48KB

Download
memory/4800-621-0x00000269DE7F0000-0x00000269DE7FC000-memory.dmp

Filesize
48KB

Download