xworm | hxxps://gofile[.]io/d/UgL9SO

Analysis

max time kernel
668s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/UgL9SO

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

3.0

Mutex

5XqKXWhXVVToq3SM

Attributes

Install_directory
%AppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/WRBbRL2Z

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023d07-128.dat	family_xworm
behavioral1/memory/5240-131-0x0000000000E20000-0x0000000000E30000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rootkit By BULLET.lnk	Rootkit By BULLET.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rootkit By BULLET.lnk	Rootkit By BULLET.exe

Executes dropped EXE 2 IoCs

pid	Process
5176	63bQ8snFSjHKvEay.exe
5240	Rootkit By BULLET.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
56	pastebin.com
55	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0009000000023d04-113.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 442069.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
4660	msedge.exe
4660	msedge.exe
4592	identity_helper.exe
4592	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
5240	Rootkit By BULLET.exe
5240	Rootkit By BULLET.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5176	63bQ8snFSjHKvEay.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5240	Rootkit By BULLET.exe
Token: SeDebugPrivilege	5240	Rootkit By BULLET.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5176	63bQ8snFSjHKvEay.exe
5240	Rootkit By BULLET.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1228	4660	msedge.exe	83
PID 4660 wrote to memory of 1228	4660	msedge.exe	83
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 1028	4660	msedge.exe	84
PID 4660 wrote to memory of 2076	4660	msedge.exe	85
PID 4660 wrote to memory of 2076	4660	msedge.exe	85
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86
PID 4660 wrote to memory of 5052	4660	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/UgL9SO
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93e2546f8,0x7ff93e254708,0x7ff93e254718
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2300460671234587478,1056652698983068494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

C:\Users\Admin\Desktop\BYBULLET.exe
"C:\Users\Admin\Desktop\BYBULLET.exe"
1⤵
PID:312
- C:\Users\Admin\AppData\Local\Temp\63bQ8snFSjHKvEay.exe
  "C:\Users\Admin\AppData\Local\Temp\63bQ8snFSjHKvEay.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5176
- C:\Users\Admin\AppData\Local\Temp\Rootkit By BULLET.exe
  "C:\Users\Admin\AppData\Local\Temp\Rootkit By BULLET.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
e9a92ef8794dbf36f36d436ea295aaa3

SHA1
3ba98f282cc529979cff47f6418104e50a333929

SHA256
94e38b0420d9800a5c9b4c09134b00e62eb54f5c1c1ef3c30f9a0c4bb88d0ba4

SHA512
5069ecb08a4a86bad72b2a987fbed73e3b0e2100941bb98f845d47a872a5705e6f200bff22d6d6b0eff0652b0c97c777d94bf9a66864c2fc264cfa5f3b705984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
a0eb2ea9f256535ddde6c960e96f8872

SHA1
e6f13449ffce0834281c80d688c3ee873c86f8b7

SHA256
296abe3c4bb1cd799453d0780b3f995ca271f6e5a10d7531607e2f78acfcf997

SHA512
9333690f5d8c446266bb52bcbaffce2334656a55f8424726944162a0f123808cc2ad185e094b9c32122ef762663366b77128579468c2d4e26d68147b109d75ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12179793124389868d39d09c4345393a

SHA1
c618e59352bc2e927ec749d2b408ac118de6cf36

SHA256
0d18adb9d170d0e22e28499219f364af66c9358b724c1edbaa053dddff6d6949

SHA512
a5f8bd3f2770c362fb88f3ad7863fad7c9f31cfadbe4e0bef74b5c3910841b73d1f4fa01f805c60792588fe372500a6120a4bbc509830af9313b4dcd84fbe6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
486dfc0bf3074cc4df8885e04bc1bb2d

SHA1
272d7434592614d1049221b103ae9ca03fa1c2d3

SHA256
dfa2367f0c78f9307cddb76d6ee2d1757092d6959506209bb83d84d638ea97da

SHA512
3ce7413e1767c30cb18f71170027c5a6b5c9752194ec9f58359cdd004efa080a409a260b1443ab9f49bccb939e7c4b10ac89099a1bbea9a8a8cd5c210b883b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef44767a8a180360ad13c5b7faf74880

SHA1
f7daa9034fc325e4b4ef1788ddde9bfeb5b7d858

SHA256
fda476d364dfb184cb4cbb8fdabffa605f3e13148432c5815b5f70e3b3fa289d

SHA512
ba6bd1318175b8fd4d379203766b30fc61ce4bd692c0da8bbe2dd73e74a08283b9fcae703c9df96abd49c2095c81d13838aa94d6fd07ad37d0b6a4bf74e00950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
764b87bdd17d0083cdf5227f2bd07a1e

SHA1
9e5cf2962794ede38d8a0fb598ac8fe716ecc5bb

SHA256
14c6dfcfd0958244c127258756e68ff441b7f117cc91bc919b60025b7c508945

SHA512
4cf4f77968b3f5b689ff255d620469c44c09b9badf371854011ddacad88db37e48d6b0bcb8746171b33493b9fde16470658de64e6c4374dd55eb752e0043eacc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6eb72a7a02726564e1cfdbd76cc2f9c8

SHA1
263c8f2138719d2fcd8d4e24d910b6da2c25545c

SHA256
8fa219a169b4afbb4e37077cd03b29dd78a48bcb11e1064a457e4d6edcd66e27

SHA512
09c4a3ff3f9a39ed6ef93e6ccc182e619f53a34c0021f1b13071e4c39e40a7ed8241a4a553fd0ef7e7ff10ea2c2990adbb5e655400f41e3f9373248ef631d445

Download Submit
C:\Users\Admin\AppData\Local\Temp\63bQ8snFSjHKvEay.exe

Filesize
6.6MB

MD5
f69ad1202cbc793fb7907c7f7d645822

SHA1
da9cba2ead0851a7d53b3feedb0333b1c6c965ab

SHA256
5f978db5c8728c76f12783f1891086f29559f623b6e03f3d509ac5c1d894ae93

SHA512
23db16b22e7283fa1f7eb65d6592128c1dab46af2222e0403cf0a44d0e9d68ed10e770c2238238d6d3e85140c803b3395d3672a6bc1af874c3932fe29aeb39b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rootkit By BULLET.exe

Filesize
35KB

MD5
dac44a2aa78f98605695e8862b961a2a

SHA1
b2a76228aa58ee99fb17ba0a4f57eab112a1d774

SHA256
cc08743aff6862d0d7f763dafa68da0a5f4379f51f7b8dcf9c55b397144ce53c

SHA512
c2d1d4ea8a93bcb2fa93ddcb149ac31d18c0af875ddc492a3c2712bb0b7be4eb567611d763bd5408c6cbdbc7bbb1da5ee5613e401c81250f1ca199c451489b6c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 442069.crdownload

Filesize
2.8MB

MD5
76ddbcf2fa40abb2b9c9c667fb8c7daf

SHA1
7237097b64e29f39e2cd8ee0a4f6d7c98e8428ed

SHA256
19c564ffa0bcae590d9913f225e6341318cd9b5a0d53792cb50b2303dc5b3291

SHA512
edb679f86f101c69f781a04f9905019b02dfac05c923538b06b0d57e7e407a00e3da2e771bf8839461d26916c7234251ec3a2fb2282b95a24f7642fa70781e8b

Download Submit
memory/312-108-0x0000000000F10000-0x00000000011EC000-memory.dmp

Filesize
2.9MB

Download
memory/5240-131-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download