dcrat | 6769f3dcde3cc9f6fb8fd1fb6a37b52221ef79b97d5d4002c44308da7a24b144

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nursultan Alpha/start.exe
Size

2.3MB
MD5

c473326baa0562bc1081ac3fff5fadab
SHA1

79ae481230a4aeb89232b60bb015c7f376cd70d7
SHA256

66058290e904b349c68a65b6deac3875acf5c9b618bd31756f1a9cbde2cfb83b
SHA512

f822532e90006b0e69305a93e01512185a1a367ebb734e8b8c443efb716abe1d4460f246b70b32e7e18c8fc6aa7db85ec039d59773305e8061375b0634351ff5
SSDEEP

49152:IBJPbv4/KHiciethGCUA1TJeUCMkiOT3eY1CKzuJtGvAAzT:yNbv4/BUVb5JLChiAu1evAoT

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\conhost.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\chainBlocksurrogatewin\\lsm.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\chainBlocksurrogatewin\\lsm.exe\", \"C:\\chainBlocksurrogatewin\\taskhost.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\", \"C:\\chainBlocksurrogatewin\\lsm.exe\", \"C:\\chainBlocksurrogatewin\\taskhost.exe\", \"C:\\chainBlocksurrogatewin\\Comcontainerdriver.exe\""	Comcontainerdriver.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	276	1040	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	1040	schtasks.exe	35

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1360	powershell.exe
1268	powershell.exe
2328	powershell.exe
908	powershell.exe
1016	powershell.exe
1772	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
3056	Comcontainerdriver.exe
2096	audiodg.exe
2120	audiodg.exe
1612	audiodg.exe
3008	audiodg.exe
1876	audiodg.exe
2376	audiodg.exe
1760	audiodg.exe
2980	audiodg.exe
2556	audiodg.exe
2552	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
1172	cmd.exe
1172	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\chainBlocksurrogatewin\\lsm.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Default User\\conhost.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\Google\\Chrome\\Application\\106.0.5249.119\\MEIPreload\\audiodg.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Windows Portable Devices\\explorer.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\chainBlocksurrogatewin\\lsm.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\chainBlocksurrogatewin\\taskhost.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\chainBlocksurrogatewin\\taskhost.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Comcontainerdriver = "\"C:\\chainBlocksurrogatewin\\Comcontainerdriver.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comcontainerdriver = "\"C:\\chainBlocksurrogatewin\\Comcontainerdriver.exe\""	Comcontainerdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Default User\\conhost.exe\""	Comcontainerdriver.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
5	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC63F96142EB5B4D18A0DB1CF49D9DA3D.TMP	csc.exe
File created	\??\c:\Windows\System32\wa0wg5.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\explorer.exe	Comcontainerdriver.exe
File created	C:\Program Files (x86)\Windows Portable Devices\7a0fd90576e088	Comcontainerdriver.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe	Comcontainerdriver.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\42af1c969fbb7b	Comcontainerdriver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2064	PING.EXE
2568	PING.EXE
2960	PING.EXE
2332	PING.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Comcontainerdriver.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Comcontainerdriver.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
2064	PING.EXE
2568	PING.EXE
2960	PING.EXE
2332	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2272	schtasks.exe
2184	schtasks.exe
304	schtasks.exe
2616	schtasks.exe
1760	schtasks.exe
836	schtasks.exe
2596	schtasks.exe
2424	schtasks.exe
1060	schtasks.exe
276	schtasks.exe
1048	schtasks.exe
2044	schtasks.exe
2352	schtasks.exe
1204	schtasks.exe
2804	schtasks.exe
2320	schtasks.exe
444	schtasks.exe
848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe
3056	Comcontainerdriver.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	Comcontainerdriver.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	2096	audiodg.exe
Token: SeDebugPrivilege	2120	audiodg.exe
Token: SeDebugPrivilege	1612	audiodg.exe
Token: SeDebugPrivilege	3008	audiodg.exe
Token: SeDebugPrivilege	1876	audiodg.exe
Token: SeDebugPrivilege	2376	audiodg.exe
Token: SeDebugPrivilege	1760	audiodg.exe
Token: SeDebugPrivilege	2980	audiodg.exe
Token: SeDebugPrivilege	2556	audiodg.exe
Token: SeDebugPrivilege	2552	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2376	2428	start.exe	30
PID 2428 wrote to memory of 2376	2428	start.exe	30
PID 2428 wrote to memory of 2376	2428	start.exe	30
PID 2428 wrote to memory of 2376	2428	start.exe	30
PID 2376 wrote to memory of 1172	2376	WScript.exe	32
PID 2376 wrote to memory of 1172	2376	WScript.exe	32
PID 2376 wrote to memory of 1172	2376	WScript.exe	32
PID 2376 wrote to memory of 1172	2376	WScript.exe	32
PID 1172 wrote to memory of 3056	1172	cmd.exe	34
PID 1172 wrote to memory of 3056	1172	cmd.exe	34
PID 1172 wrote to memory of 3056	1172	cmd.exe	34
PID 1172 wrote to memory of 3056	1172	cmd.exe	34
PID 3056 wrote to memory of 2880	3056	Comcontainerdriver.exe	39
PID 3056 wrote to memory of 2880	3056	Comcontainerdriver.exe	39
PID 3056 wrote to memory of 2880	3056	Comcontainerdriver.exe	39
PID 2880 wrote to memory of 2988	2880	csc.exe	41
PID 2880 wrote to memory of 2988	2880	csc.exe	41
PID 2880 wrote to memory of 2988	2880	csc.exe	41
PID 3056 wrote to memory of 2328	3056	Comcontainerdriver.exe	57
PID 3056 wrote to memory of 2328	3056	Comcontainerdriver.exe	57
PID 3056 wrote to memory of 2328	3056	Comcontainerdriver.exe	57
PID 3056 wrote to memory of 1268	3056	Comcontainerdriver.exe	58
PID 3056 wrote to memory of 1268	3056	Comcontainerdriver.exe	58
PID 3056 wrote to memory of 1268	3056	Comcontainerdriver.exe	58
PID 3056 wrote to memory of 908	3056	Comcontainerdriver.exe	59
PID 3056 wrote to memory of 908	3056	Comcontainerdriver.exe	59
PID 3056 wrote to memory of 908	3056	Comcontainerdriver.exe	59
PID 3056 wrote to memory of 1016	3056	Comcontainerdriver.exe	61
PID 3056 wrote to memory of 1016	3056	Comcontainerdriver.exe	61
PID 3056 wrote to memory of 1016	3056	Comcontainerdriver.exe	61
PID 3056 wrote to memory of 1772	3056	Comcontainerdriver.exe	62
PID 3056 wrote to memory of 1772	3056	Comcontainerdriver.exe	62
PID 3056 wrote to memory of 1772	3056	Comcontainerdriver.exe	62
PID 3056 wrote to memory of 1360	3056	Comcontainerdriver.exe	63
PID 3056 wrote to memory of 1360	3056	Comcontainerdriver.exe	63
PID 3056 wrote to memory of 1360	3056	Comcontainerdriver.exe	63
PID 3056 wrote to memory of 1336	3056	Comcontainerdriver.exe	69
PID 3056 wrote to memory of 1336	3056	Comcontainerdriver.exe	69
PID 3056 wrote to memory of 1336	3056	Comcontainerdriver.exe	69
PID 1336 wrote to memory of 2708	1336	cmd.exe	71
PID 1336 wrote to memory of 2708	1336	cmd.exe	71
PID 1336 wrote to memory of 2708	1336	cmd.exe	71
PID 1336 wrote to memory of 2064	1336	cmd.exe	72
PID 1336 wrote to memory of 2064	1336	cmd.exe	72
PID 1336 wrote to memory of 2064	1336	cmd.exe	72
PID 1336 wrote to memory of 2096	1336	cmd.exe	73
PID 1336 wrote to memory of 2096	1336	cmd.exe	73
PID 1336 wrote to memory of 2096	1336	cmd.exe	73
PID 2096 wrote to memory of 2972	2096	audiodg.exe	74
PID 2096 wrote to memory of 2972	2096	audiodg.exe	74
PID 2096 wrote to memory of 2972	2096	audiodg.exe	74
PID 2972 wrote to memory of 2384	2972	cmd.exe	76
PID 2972 wrote to memory of 2384	2972	cmd.exe	76
PID 2972 wrote to memory of 2384	2972	cmd.exe	76
PID 2972 wrote to memory of 2944	2972	cmd.exe	77
PID 2972 wrote to memory of 2944	2972	cmd.exe	77
PID 2972 wrote to memory of 2944	2972	cmd.exe	77
PID 2972 wrote to memory of 2120	2972	cmd.exe	78
PID 2972 wrote to memory of 2120	2972	cmd.exe	78
PID 2972 wrote to memory of 2120	2972	cmd.exe	78
PID 2120 wrote to memory of 2192	2120	audiodg.exe	79
PID 2120 wrote to memory of 2192	2120	audiodg.exe	79
PID 2120 wrote to memory of 2192	2120	audiodg.exe	79
PID 2192 wrote to memory of 444	2192	cmd.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\start.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\start.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\chainBlocksurrogatewin\GQQ4ylq7g8v2sObSsphEhdaxNJcwRuTMFt5I2eiVZyEpGNyUkwbTE.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\chainBlocksurrogatewin\jadNZOaHlMDhsSca68lTCEwCwvIEx4Rlg.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\chainBlocksurrogatewin\Comcontainerdriver.exe
      "C:\chainBlocksurrogatewin/Comcontainerdriver.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k45xy1qx\k45xy1qx.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2880
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D28.tmp" "c:\Windows\System32\CSC63F96142EB5B4D18A0DB1CF49D9DA3D.TMP"
        6⤵
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\chainBlocksurrogatewin\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\chainBlocksurrogatewin\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\chainBlocksurrogatewin\Comcontainerdriver.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XmWG4xjOhw.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1336
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2708
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2064
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x0UH1pL55G.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2384
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2944
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ShSWMkBVB.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2184
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3cBJ2i3CCl.bat"
        11⤵
        
        PID:2480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3064
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2568
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HVsQnaolwE.bat"
        13⤵
        
        PID:2856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2960
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sVWBOBo5KY.bat"
        15⤵
        
        PID:1724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1260
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2228
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pv802QeGaw.bat"
        17⤵
        
        PID:2952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2532
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aehWhM7TGU.bat"
        19⤵
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2348
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WHqdBEPCKu.bat"
        21⤵
        
        PID:112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2332
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qlEmwzstBs.bat"
        23⤵
        
        PID:2840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2672
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\chainBlocksurrogatewin\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\chainBlocksurrogatewin\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\chainBlocksurrogatewin\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\chainBlocksurrogatewin\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\chainBlocksurrogatewin\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\chainBlocksurrogatewin\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComcontainerdriverC" /sc MINUTE /mo 13 /tr "'C:\chainBlocksurrogatewin\Comcontainerdriver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comcontainerdriver" /sc ONLOGON /tr "'C:\chainBlocksurrogatewin\Comcontainerdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComcontainerdriverC" /sc MINUTE /mo 8 /tr "'C:\chainBlocksurrogatewin\Comcontainerdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3cBJ2i3CCl.bat

Filesize
208B

MD5
4e0fd69155505babc724ce503afb3595

SHA1
8800790a584a70e93a20211a6a8abb6a050cb015

SHA256
20424135adc504c413c0319ac2352826bfaf949c483550776dbd93a8e2c918ad

SHA512
17ff1c6dc65ab43b5d9d52b9e130bb513f595f070d4a87b7a8d630961621252732324aece6cb98936407eeb755d87bed6f7d7ec57758f4d4ea273458d82aa7ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ShSWMkBVB.bat

Filesize
256B

MD5
916be80d386f1bc226addb477b382555

SHA1
2c101bdd135a1c0dd5bbeeddfcd803a7140f5895

SHA256
6cc13975d1958f34f8b04dc4dea12c1043b8fa42c3317d18e0605a1253b1f811

SHA512
98b131dca4d3296229bad769e526148958aac3f2bc176ebed4b735b0ec665aa5b95bc2b7b926b62212df14d2f21f4866a30bb4c99b3b3974fcebd75f465b4d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HVsQnaolwE.bat

Filesize
208B

MD5
a58ff7a0a4f0b5e3027fc4b4cd73d431

SHA1
bd61d73a3a50360b69690e2fac88df0d0eeab72d

SHA256
f8dde1f08641f2698f0c2e7549777c59bb689ab8766130b8d71834574dac3486

SHA512
3b5c719533f0431eb4e8a87d27c8535be2f95bdc7d497a514d3ba2b98330e0cf3f974721bb43590118bd63bbc17b6b7c177d2057c25146435f3513f3774c2228

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2D28.tmp

Filesize
1KB

MD5
8296eb2304f421f441f384b1b668c6a1

SHA1
9be82d153d04ee9684d05812d2ecfd044667070f

SHA256
3e14c1058805ddc63cffbdb7c25d8a17aee971a702722ae9c81f76abd21d54fd

SHA512
d63a59be322d75d709876b7bce9d3ed30ffbcf4070ddbcc75d37bef327188f62cc9e6f5e1f783a98dee1920ba01a5ff910a671d14f2e5733dbfc26d710f0b28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WHqdBEPCKu.bat

Filesize
208B

MD5
d6890bf70368aa82c534a9e7d4fadd62

SHA1
0590bb67cfe75153e3a909485019208abd7ea015

SHA256
a824533d1c9a00983adfeddf7f9ea2840ef26c8771c4a318b2682e3f4644153d

SHA512
9966aa36a3d2f08ebdc968724215424a43b61830845b931f20fe0b9485cbbd654b0542345cb73f00f338bd89b612dd98325dbee6f8486bdd1bca1790bf35fb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\XmWG4xjOhw.bat

Filesize
208B

MD5
f3312a75d2a7ab55795d6d6fbc511f30

SHA1
fbbf82fbedae77af5ddb4cec2f2d00f1faba1e2b

SHA256
1b37a0d52f01c9928d779cd082821c8dd9a16bb2a44e9ace999183ac15139eca

SHA512
3389f6c0591629c035a55ad6bf403616b248b3280407bd28deb70b0d6cd1e48295308ccc7fcad2bec16dc77a7809043844a4281d4f3d0cf82a48390b6e4a8d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\aehWhM7TGU.bat

Filesize
256B

MD5
4dece3587f0d4eeaf5966b852e00ca55

SHA1
f6e1848da1ddf8ff11fd4c7a85cc3c14b265f226

SHA256
6df9811adb325f58c008178769c4bd6a002ec396cc6ba3809301f97b82a8ade4

SHA512
d84b98f16e5f39db4c786e0979136501d0321516787eb51f3c97042f9adf8a6cb74dd6b54fc69fb4416b1c9add2bcbfcc50da82a60784c4089141680f1a1cf3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pv802QeGaw.bat

Filesize
256B

MD5
ac2ae5dc5b64528a24713c46518b6fb9

SHA1
8013b44c993ffd370986431b5ccbd46013917af4

SHA256
68170e28e07d8144799286fdd348a3a62c38175e5208598b7b5ca2146fcf57fe

SHA512
95ef01906a538bc52c5bbe30504be0b3ba0aed4435f3adfb7d0ab578942842cf77600a2319401325f2cc340a8b83cdc65e68223707cefc2dba40b5535ae2eec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlEmwzstBs.bat

Filesize
256B

MD5
7a2efafee434ba112403c47ec82ee0ef

SHA1
70b6cebf042019f19f8df62f62b684f55375b508

SHA256
9423edc34c382a332ec3cb74bb31fc788363111f947150c28307582ab606f9fb

SHA512
0d7646bdba216b0e2cb7055f512bec3b353e0de855ced6946ff3cf1ea08ad6dfb0cb43f0ebc5176dfde51b0cbcca21bdd2ac5bf8237cacf84b263b2204ec89d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sVWBOBo5KY.bat

Filesize
256B

MD5
9458c3ec5b996b5450dfe49e0ac07855

SHA1
be47d5e5b0388a20e7613e0d79b5e3a4a68639ab

SHA256
147d6383e61a129b6c4312e8f82fae61e95221fa00af767969452a9fdacc555c

SHA512
c4a1ef62f26489eda2a490c14319ee4ff7603dbc2cf8279bc6d4de88ddabaa7a674bbd66d21ebd540479acb642acecde4c2af0e269a105985122760cbab0f962

Download Submit
C:\Users\Admin\AppData\Local\Temp\x0UH1pL55G.bat

Filesize
256B

MD5
3fc4f16665c8413a8c197e73764fc17e

SHA1
dd5d261c57d7021b0baad58fc2c1c73e5dc1adc4

SHA256
6ebd73520a0c3bdd3ba415f51a807e16c25adcb52b88ba58035c419cc0db2e85

SHA512
1318d431cd49a8c8a2ddef6d5d61efc748b21c4fd62cff4d791ae2bb3f8fa094eb82a6e6059c48412e5e7c7d235a0b05056c3389811fd473fd532fce898cc5ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\42DOMEFND6WLAO5LA5VW.temp

Filesize
7KB

MD5
ea9bb0c3a5a97a9a738fe8c59c9e6237

SHA1
62f37e0cd106e99781257f98e8ba55a035f7e669

SHA256
1f4ffe0b1a1de98de4dfe0b810e3cc6e342b2f16fd6288b4556870d9297075a9

SHA512
8715be995b24a2d86101ab06231d73419f61ff53f5570a35956d9720994cfeb68a363b6dd44b274a3d93107b102881c1ce9fb9814c955de0c31c5bffe77e9c0a

Download Submit
C:\chainBlocksurrogatewin\GQQ4ylq7g8v2sObSsphEhdaxNJcwRuTMFt5I2eiVZyEpGNyUkwbTE.vbe

Filesize
234B

MD5
8dfd0c504793456574496822db2d2a6d

SHA1
18f7f8d6e3af7dd7c2d491c219743ac6e18886d9

SHA256
c9349402fa75d4a2ce0c9b704be94ca546cf3d2912a3272af80c050e8251c2b5

SHA512
946de0213c05a3db186f27754b40e08de12021a7dc2cf43f55c29da4ec2bb40347abab7104684acf5696cb1e289ccb90ac826db5048dca698f98cb043d15358a

Download Submit
C:\chainBlocksurrogatewin\jadNZOaHlMDhsSca68lTCEwCwvIEx4Rlg.bat

Filesize
104B

MD5
e5d7112ec4ea1326fb903ec7d5249948

SHA1
068099c095e83c6fa948702e467de51455f5b873

SHA256
4a7538c31c88df87c83d85e6e729fe85ea5371ebf41545df1639dbf6a07ad709

SHA512
ee5fe8ff4f8a41acad3baeb3069b662f808a6ccaf581c66340498ecdd6470af999c8d4fc91979269b51461bb025041d7cb2ac30c52603161aa0b11a53c889ba4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\k45xy1qx\k45xy1qx.0.cs

Filesize
365B

MD5
7cd654a1a068289b8d2a09ef0154ec18

SHA1
f836a2186e8d464f6c80d5c21f2b04de6b14c4be

SHA256
70941fd40a4bce35bde5594060f2fd45872548d36728360486bcb1da3ff148c6

SHA512
3deffed6d36c67b1223f1fbe3495bf75bf8fe528abb38fe2611bb2f9cf646e635865759e17b1486b6db474435a91de1a92b9c1b4e1116d170bd7179576652c0a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\k45xy1qx\k45xy1qx.cmdline

Filesize
235B

MD5
176e2314a80f08731804b25f29050501

SHA1
7a28103cc7167365f68000a646227b927a7b7df7

SHA256
e0257022f920daef96b9956fe30fbacca85b125dd6e4e0f3abc2984e4bc5b079

SHA512
7be27d491a704a9bf1ff0a55c25f98665c9b1c4f56467e5231fb2342fb796c9e006d6d438a3201acd103f37bcefdcdbec53bd3d83aaebc0e4e43ed0668265097

Download Submit
\??\c:\Windows\System32\CSC63F96142EB5B4D18A0DB1CF49D9DA3D.TMP

Filesize
1KB

MD5
b74f131aab310dc6e37b43e729c24199

SHA1
bade4cf35d7e80e79880396c1fdd518d9ab78bdf

SHA256
5fdff2a34cc18e36619ff327b292a8255286dc102d85074b7fc625ccbdbe1858

SHA512
733cb12c94d0a8bedc9a38c073dff2fc46553854d7e835767aaa749b4754beef77fa3bc8232eab21c92bc808c08b150cafe5c035bb33d82292fbf76fec55d885

Download Submit
\chainBlocksurrogatewin\Comcontainerdriver.exe

Filesize
2.0MB

MD5
9d27ce3f27809787e6c8bf545963d1e0

SHA1
89c73f5ba0a7cfb3afa53515b38704f90f8e70c4

SHA256
605f67d7b44d7d35fc5331e1badbe43ef332e369c86437c28bda68184c83294a

SHA512
0b49b02802a1652487d7d9dc052444194e74a43a3771dc68081c545114a437fbcc2aedd8ca032144ae7fa3e480cc4727e01fa9d0aa461ea786cb9bf63f867a4d

Download Submit
memory/908-62-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/908-61-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/1760-177-0x00000000001A0000-0x00000000003A4000-memory.dmp

Filesize
2.0MB

Download
memory/2096-91-0x0000000000150000-0x0000000000354000-memory.dmp

Filesize
2.0MB

Download
memory/2120-106-0x0000000000FA0000-0x00000000011A4000-memory.dmp

Filesize
2.0MB

Download
memory/2552-222-0x00000000009C0000-0x0000000000BC4000-memory.dmp

Filesize
2.0MB

Download
memory/2556-207-0x00000000003F0000-0x00000000005F4000-memory.dmp

Filesize
2.0MB

Download
memory/2980-192-0x0000000000EE0000-0x00000000010E4000-memory.dmp

Filesize
2.0MB

Download
memory/3056-19-0x0000000000A20000-0x0000000000A38000-memory.dmp

Filesize
96KB

Download
memory/3056-21-0x0000000000A40000-0x0000000000A52000-memory.dmp

Filesize
72KB

Download
memory/3056-23-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/3056-17-0x0000000000340000-0x000000000035C000-memory.dmp

Filesize
112KB

Download
memory/3056-25-0x0000000000330000-0x000000000033E000-memory.dmp

Filesize
56KB

Download
memory/3056-15-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/3056-27-0x0000000000570000-0x0000000000578000-memory.dmp

Filesize
32KB

Download
memory/3056-13-0x0000000000C40000-0x0000000000E44000-memory.dmp

Filesize
2.0MB

Download
memory/3056-29-0x0000000000A60000-0x0000000000A6C000-memory.dmp

Filesize
48KB

Download