asyncrat | hxxps://files-ld[.]s3[.]us-east-2[.]amazonaws[.]com/client[.]zip

Resubmissions

12-10-2024 17:33

241012-v4xynasdmd 10

12-10-2024 17:30

241012-v3arqswhjr 3

12-10-2024 16:44

241012-t8t7wszgnf 10

12-10-2024 16:40

241012-t6l4havbqn 10

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://files-ld.s3.us-east-2.amazonaws.com/client.zip

Score

10^/10

asyncrat new discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

New

147.185.221.19:22240

Mutex

komvqogocxtmko

Attributes

delay
1
install
true
install_file
new.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\new.exe	family_asyncrat

Executes dropped EXE 1 IoCs

Processes:

new.exe

pid process

3292 new.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3172 timeout.exe

pid	process
3292	new.exe

pid	process
3172	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133732280059664642"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings chrome.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

536 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	chrome.exe

pid	process
536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

chrome.exeClient.exenew.exechrome.exe

pid	process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
2712	Client.exe
3292	new.exe
3292	new.exe
3292	new.exe
3028	chrome.exe
3028	chrome.exe
3028	chrome.exe
3028	chrome.exe
3292	new.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

4452 chrome.exe
4452 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe
Token: SeShutdownPrivilege	4452	chrome.exe
Token: SeCreatePagefilePrivilege	4452	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

chrome.exe

pid	process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe
4452	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

new.exe

pid process

3292 new.exe

pid	process
3292	new.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4452 wrote to memory of 5024	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 5024	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3124	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3436	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 3436	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe
PID 4452 wrote to memory of 2060	4452	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://files-ld.s3.us-east-2.amazonaws.com/client.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc30decc40,0x7ffc30decc4c,0x7ffc30decc58
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1908 /prefetch:2
2⤵
PID:3124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2068 /prefetch:3
2⤵
PID:3436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2284 /prefetch:8
2⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
2⤵
PID:2000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3436 /prefetch:1
2⤵
PID:3468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4780,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:8
2⤵
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4448,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
2⤵
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5124,i,6035757177854616684,5116631214341968006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5192 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3028

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2712

C:\Users\Admin\Downloads\client\Client.exe
"C:\Users\Admin\Downloads\client\Client.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "new" /tr '"C:\Users\Admin\AppData\Roaming\new.exe"' & exit
2⤵
PID:1424

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "new" /tr '"C:\Users\Admin\AppData\Roaming\new.exe"'
3⤵
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp19C.tmp.bat""
2⤵
PID:1872

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3172

C:\Users\Admin\AppData\Roaming\new.exe
"C:\Users\Admin\AppData\Roaming\new.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Users\Admin\Downloads\client\Client.exe
"C:\Users\Admin\Downloads\client\Client.exe"
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6446f361152d3c835613bd578b47d1b2

SHA1
2d41acd3c3e761fcc9941506aa3bc51205ccc800

SHA256
f5564cb8318f61f42dab3034835cc95b5839cc4fba515851c26d1ffc4f366090

SHA512
9dc5bacc3a2b6d310d1ffb33f9480f33e2436fc27d9c70f8eb9e68c4c5b6d1850505a44f5cd942768d043f6401bc78d7758ad4ec7c029454de46701a5b3f1335

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
fd7675e4bd405680912bb08a02b02df8

SHA1
90b8f113bb803a8652c09b216739b455aaa0bf48

SHA256
c9c3ad79e39970713d7ef60bac961437b759d00868a69734b8f762e343fcc964

SHA512
fc14ccff0545d37f093429ae27156cd3c32941778e37006b0d8ad3ef50ce9c5bef686eb211597fe7ee3deb664a45e1c7a2891890d58bb798a5ffc689270f1281

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
093c3d7d3ffb3334309707e1912a119a

SHA1
cba3198ee7f38ca3746c32949903cfd978703f9c

SHA256
0c4b04c80a180e33064cf4b0e8405229ece4eb4ce84bc1d5c5cf210b607610e5

SHA512
d88df2e88df96e23b111c7ee6e5e5a3e341de73b6a6b2557498e62149e6972988add52442a342bf07f8e79283c61e531eb8caf060be319baee85225388844003

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
bcbaa45007252ed03748d49565f8ce17

SHA1
e8310cfd28de6c7c1fed98f7ce747c54fa9831d2

SHA256
d4fd2212ce0326142e24c40741a4ff5ded47139751ac946641b63f9cbbb52d30

SHA512
89429a00b71ef45faa846cd6bdd86495cce520431bc967e6d01fa0cb6547231995a29affcc58f36852e0e36ee5105b1e0dfc059859e1ea1c2a6b6e2e05472333

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
462442d4ef30bfd9553da68b1cd38e89

SHA1
50de304f08855b65bc0bba6fef8a43c6e898714e

SHA256
2dba78e65063bc058f1760f1333b88e8a4789a78168f2a5aa952174369dfb90a

SHA512
a640bf8371560703e9be88ab511830ccaf78882517332a5c3ce54bfd8d4975967fbf020d458b9bf20dfade4a0d837bc301c614121bd59990afd7e284cc02b612

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
96e8d2c84c115bdb1a4560ec84c1aa3a

SHA1
7d61d271ff13adb7931889277ffcff184a099eb3

SHA256
2e60969e9b3f4a7b845e9881463c48dfbe7835e22e36aa5885dd75f235bccd18

SHA512
3649d1320ca0a9c895b80c6e393814f9405d99f28108e77101fc17a12166fbe30e5bae86776d3502d00de904e6a8865d922a6a902709fed617b73bc8673f63b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
63e92250bcd296f6df1b8864d78b61c6

SHA1
8c0799323b04cffc1ccd677d449236ae74c2e5fb

SHA256
92ff806edce643af1f28b09ea2a37dd48a8c6116cbc6c8996aed2f7daae9d305

SHA512
07bb22aadb5c062c8121cdaf0e7eb9cd544c042f6c1af68e7c661a0e60f6a417c1dc2b2923cb2eb356c64897d1047fcd6b7949abad8868b940538f89f6236878

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2c68575ca14bbfd2e02a4388a80d205d

SHA1
786713739f6f800635a3fa1f98bbcf9582b28723

SHA256
1b72958c383a99ca7aec847fd7f8bf8a06ddd4427daaeaf24dd3a5feed3c13c2

SHA512
247625c4a9f7ba3fa95dcd5d6d6bcd1fd4975de265a5f2e25779b4321538a15c6e4921efb90bd674a410b783da4b540b17a9d49070d60da011ec85f50c73e751

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
e2d76e78b815eaf29e7ee416edc65b3b

SHA1
533f13c31e04ae7ee1def96ae2af7c26d49fcc1f

SHA256
2ce8b02ea69200a7e37b13ec94499c1bf8f1b18cc77ec0f4bb9da86005fcce5d

SHA512
eeff302c39ee211131738567765d12cb86c141811e84e7d33ed63037f9182c7ded1a457b816df9210ff75d77172a15c99d08d1113097c9aea3fea79545ac2c49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
032fa387ebde17e6d3b7e5a3cf7158db

SHA1
cbc1e93d9d491c58a7985207ec2fb4fde3700729

SHA256
e1076c2aad7cac7e6ca4ddd9b161c0fa9e205a5005e7cbc5fed43d88173f171f

SHA512
af97a16ca11b93e2f5b6c3afe6b817b67050d3d74fc268b79796704b2fa61f177613488649946bca38090207521f7f1bac0f92f2acc4028261446c1de29ce313

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6fd169be0c06191f16a7cc670e7b91d2

SHA1
c5a44957ea3788df7aa740e8a1e74f452120110f

SHA256
3afb52396c82cfe749e8c5494780a3f8dd558f61271cde50bdd06372e1bfb28a

SHA512
ef5cf3ec5ca4c55df64d385cd2abbba4ceb356b4be5bbe613a4d929f125c817feecc81b381a465de7f0381f2f479292111e26c38c0d769b5a363779d5b156a64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
c65c4d3fcb9ab6a0cb0ecb079b024d32

SHA1
740bc5f9af390baf742536ed6efdab8254aee99c

SHA256
143dc1db9d0c1c01f44e352c7960fd5751b07d4150380274f9e9da6068bb39fd

SHA512
4643039ecca3ea2aa9ae51e09c3ddc14b0426bacedf6982728f9ddc160c389a9ffaa8f4b96657b2959c3163d4caea992c1131002a9b1987c212b06a1cf3cae21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
99752356f8b6035fe48bf4833d4f2ada

SHA1
5e4e36e08a6603aa596609d4afda0d8b1e5a747b

SHA256
a7a979f666137f3b329066ea03674d759d56205518d9795d12bff2a7f95ced25

SHA512
9fef9c4407f34d6a29d0de975c25861a0acb621336a4be276db8ad76ceb33093c642bc0b985bb793efadaea81cdef47385eb5885605de560e4c1319b5e5643bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp19C.tmp.bat

Filesize
146B

MD5
44a35f7df98d5fe3040c67f205fd0aaf

SHA1
626320c1aee6ff1d089527bba8910a6a39817244

SHA256
7fe0d065d940c311d07f8b72950756b94192605a9d3e8d29b82362de86af6777

SHA512
f008decb1f55ecd24007c2e4bb5e54d8eae0a8700efa0d5163375bfb0ebd9d00baa46a2f7934d4fe4aeb8e5c2596e2304b458603f2f21ceed15f65c1f753c2a8

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\AppData\Roaming\new.exe

Filesize
74KB

MD5
7e98ce3829f6afc0318ac2deea0680ad

SHA1
2f63adade7fa8ada790dd8f30045db1f64ab575d

SHA256
994a3ffb6fdde0851e076dc9e42262538481e285979c8ead8ed00e7580b61b3b

SHA512
3507eeb3c8eac5cc1438e6dc9e259553537386b456a0883e13cfa691f80496d0e1b01177848c338d9e134bd40e1455551b5ee36f3a510c4cb2ac3aaf3f98d33b

Download Submit
C:\Users\Admin\Downloads\client.zip.crdownload

Filesize
34KB

MD5
487a9d6044844f9addd0a2379b2ced05

SHA1
873d6b1ba9a4712295faf82ab138e32746f58d1d

SHA256
99ff4121626b82849bdacb05e73c4fd747e6853eb3e96e3aec57bb1b8153ce1d

SHA512
6b46ccb475c810e79b4605a3b49aa6bd955d80b851dd16ea71064cf03b65efacd804d725d4aa717669b2d3fe3c55ed0656d50ad74c8d091b233e6dd96a203cd2

Download Submit
\??\pipe\crashpad_4452_UZRXAUSLRRVBKHWX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2712-111-0x00007FFC2B8E0000-0x00007FFC2C3A1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-112-0x00007FFC2B8E0000-0x00007FFC2C3A1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-106-0x00007FFC2B8E0000-0x00007FFC2C3A1000-memory.dmp

Filesize
10.8MB

Download
memory/2712-104-0x0000000000900000-0x0000000000918000-memory.dmp

Filesize
96KB

Download
memory/2712-103-0x00007FFC2B8E3000-0x00007FFC2B8E5000-memory.dmp

Filesize
8KB

Download