xworm | 57583fbcfce7c62cfc880b35bc19d2bcb3d34e14423ab725674f9f1eefcbd038

Analysis

max time kernel
271s
max time network
272s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-01-2025 21:24

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

MoonCrypter.rar
Size

1.3MB
MD5

ccc21f4e00162c96301c0901ade0ccc4
SHA1

fd88be0f52f8ec766327ce75fc55fb196e4557c6
SHA256

57583fbcfce7c62cfc880b35bc19d2bcb3d34e14423ab725674f9f1eefcbd038
SHA512

bb40c47e1d25be445249a50e92f208187da14fdee9a64424db3a6bb5c1992d48da5d55141585bf6cb26ef88a293657d3bc9616000c6ded6a7145d0f87dd36051
SSDEEP

24576:8++stGfbozsU+ZB++stGfbozsUYJUYndkIkDf7KaoY8QY8EFhe89:IstGMzv+Z/stGMzvriaoXeEL5

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

193.123.88.61:4444

Mutex

1cAjmT6r87cbZXRe

Attributes

Install_directory
%AppData%
install_file
host.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1140-251-0x0000000002AC0000-0x0000000002ACE000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aabd-35.dat	family_xworm
behavioral1/memory/1140-44-0x0000000000A70000-0x0000000000A80000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe
3956	powershell.exe
4300	powershell.exe
460	powershell.exe
820	powershell.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk	moon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk	moon.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk	Launcher.exe

Executes dropped EXE 21 IoCs

pid	Process
2080	MoonCrypter.exe
1520	MoonCrypter.exe
1140	moon.exe
1648	fixer.exe
2516	Launcher.exe
1032	mce.exe
4080	Windows Services.exe
4192	fixer.exe
2792	Launcher.exe
4512	Secure System Shell.exe
5024	Runtime Explorer.exe
3380	mce.exe
1916	MoonCrypter.exe
1136	MoonCrypter.exe
3520	moon.exe
804	MoonCrypter.exe
5064	MoonCrypter.exe
2788	moon.exe
4820	fixer.exe
2520	Launcher.exe
4828	mce.exe

Loads dropped DLL 6 IoCs

pid	Process
2516	Launcher.exe
2516	Launcher.exe
2792	Launcher.exe
2792	Launcher.exe
2520	Launcher.exe
2520	Launcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Run\host = "C:\\Users\\Admin\\AppData\\Roaming\\host.exe"	moon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe"	Launcher.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\IMF\Windows Services.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Windows Services.exe	Launcher.exe
File created	C:\Windows\IMF\Runtime Explorer.exe.tmp	Launcher.exe
File opened for modification	C:\Windows\IMF\Runtime Explorer.exe	Launcher.exe
File opened for modification	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File opened for modification	C:\Windows\IMF\Secure System Shell.exe	Launcher.exe
File created	C:\Windows\IMF\Secure System Shell.exe.tmp	Launcher.exe
File created	C:\Windows\IMF\LICENCE.zip	Launcher.exe
File created	C:\Windows\IMF\LICENCE.dat	Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Secure System Shell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MoonCrypter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MoonCrypter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fixer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fixer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fixer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MoonCrypter.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
820	powershell.exe
820	powershell.exe
2336	powershell.exe
2336	powershell.exe
3956	powershell.exe
3956	powershell.exe
4300	powershell.exe
4300	powershell.exe
2516	Launcher.exe
460	powershell.exe
460	powershell.exe
4080	Windows Services.exe
4080	Windows Services.exe
4080	Windows Services.exe
4080	Windows Services.exe
2792	Launcher.exe
4512	Secure System Shell.exe
2520	Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3628	7zFM.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeRestorePrivilege	3628	7zFM.exe
Token: 35	3628	7zFM.exe
Token: SeSecurityPrivilege	3628	7zFM.exe
Token: SeDebugPrivilege	1140	moon.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	2516	Launcher.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeDebugPrivilege	1140	moon.exe
Token: 33	2856	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2856	AUDIODG.EXE
Token: SeDebugPrivilege	4080	Windows Services.exe
Token: SeDebugPrivilege	2792	Launcher.exe
Token: SeDebugPrivilege	4512	Secure System Shell.exe
Token: SeDebugPrivilege	3520	moon.exe
Token: SeDebugPrivilege	2788	moon.exe
Token: SeDebugPrivilege	2520	Launcher.exe
Token: SeShutdownPrivilege	1140	moon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3628	7zFM.exe
3628	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5024	Runtime Explorer.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1520	2080	MoonCrypter.exe	82
PID 2080 wrote to memory of 1520	2080	MoonCrypter.exe	82
PID 2080 wrote to memory of 1520	2080	MoonCrypter.exe	82
PID 2080 wrote to memory of 1140	2080	MoonCrypter.exe	83
PID 2080 wrote to memory of 1140	2080	MoonCrypter.exe	83
PID 1140 wrote to memory of 820	1140	moon.exe	84
PID 1140 wrote to memory of 820	1140	moon.exe	84
PID 1140 wrote to memory of 2336	1140	moon.exe	86
PID 1140 wrote to memory of 2336	1140	moon.exe	86
PID 1140 wrote to memory of 3956	1140	moon.exe	88
PID 1140 wrote to memory of 3956	1140	moon.exe	88
PID 1140 wrote to memory of 4300	1140	moon.exe	91
PID 1140 wrote to memory of 4300	1140	moon.exe	91
PID 1648 wrote to memory of 2516	1648	fixer.exe	93
PID 1648 wrote to memory of 2516	1648	fixer.exe	93
PID 1648 wrote to memory of 2516	1648	fixer.exe	93
PID 2516 wrote to memory of 460	2516	Launcher.exe	94
PID 2516 wrote to memory of 460	2516	Launcher.exe	94
PID 2516 wrote to memory of 460	2516	Launcher.exe	94
PID 1648 wrote to memory of 1032	1648	fixer.exe	96
PID 1648 wrote to memory of 1032	1648	fixer.exe	96
PID 2516 wrote to memory of 4080	2516	Launcher.exe	98
PID 2516 wrote to memory of 4080	2516	Launcher.exe	98
PID 2516 wrote to memory of 4080	2516	Launcher.exe	98
PID 4192 wrote to memory of 2792	4192	fixer.exe	100
PID 4192 wrote to memory of 2792	4192	fixer.exe	100
PID 4192 wrote to memory of 2792	4192	fixer.exe	100
PID 4080 wrote to memory of 4512	4080	Windows Services.exe	101
PID 4080 wrote to memory of 4512	4080	Windows Services.exe	101
PID 4080 wrote to memory of 4512	4080	Windows Services.exe	101
PID 4080 wrote to memory of 5024	4080	Windows Services.exe	102
PID 4080 wrote to memory of 5024	4080	Windows Services.exe	102
PID 4080 wrote to memory of 5024	4080	Windows Services.exe	102
PID 4192 wrote to memory of 3380	4192	fixer.exe	104
PID 4192 wrote to memory of 3380	4192	fixer.exe	104
PID 1916 wrote to memory of 1136	1916	MoonCrypter.exe	106
PID 1916 wrote to memory of 1136	1916	MoonCrypter.exe	106
PID 1916 wrote to memory of 1136	1916	MoonCrypter.exe	106
PID 1916 wrote to memory of 3520	1916	MoonCrypter.exe	107
PID 1916 wrote to memory of 3520	1916	MoonCrypter.exe	107
PID 804 wrote to memory of 5064	804	MoonCrypter.exe	109
PID 804 wrote to memory of 5064	804	MoonCrypter.exe	109
PID 804 wrote to memory of 5064	804	MoonCrypter.exe	109
PID 804 wrote to memory of 2788	804	MoonCrypter.exe	110
PID 804 wrote to memory of 2788	804	MoonCrypter.exe	110
PID 4820 wrote to memory of 2520	4820	fixer.exe	112
PID 4820 wrote to memory of 2520	4820	fixer.exe	112
PID 4820 wrote to memory of 2520	4820	fixer.exe	112
PID 4820 wrote to memory of 4828	4820	fixer.exe	113
PID 4820 wrote to memory of 4828	4820	fixer.exe	113

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MoonCrypter.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2000

C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe
"C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe
  "C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\moon.exe
  "C:\Users\Admin\AppData\Local\Temp\moon.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\moon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'moon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4300

C:\Users\Admin\Desktop\MoonCrypter\fixer.exe
"C:\Users\Admin\Desktop\MoonCrypter\fixer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe
  "C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- - C:\Windows\IMF\Windows Services.exe
    "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Windows\IMF\Secure System Shell.exe
      "C:\Windows\IMF\Secure System Shell.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\IMF\Runtime Explorer.exe
      "C:\Windows\IMF\Runtime Explorer.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5024
- C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe
  "C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe"
  2⤵
  - Executes dropped EXE
  PID:1032

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Users\Admin\Desktop\MoonCrypter\fixer.exe
"C:\Users\Admin\Desktop\MoonCrypter\fixer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe
  "C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe
  "C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe"
  2⤵
  - Executes dropped EXE
  PID:3380

C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe
"C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe
  "C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\moon.exe
  "C:\Users\Admin\AppData\Local\Temp\moon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3520

C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe
"C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe
  "C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\moon.exe
  "C:\Users\Admin\AppData\Local\Temp\moon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2788

C:\Users\Admin\Desktop\MoonCrypter\fixer.exe
"C:\Users\Admin\Desktop\MoonCrypter\fixer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe
  "C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe
  "C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe"
  2⤵
  - Executes dropped EXE
  PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\mce.exe.log

Filesize
594B

MD5
17d54af051d6e2279756e0394df4e94f

SHA1
c781de77a9d3f733c873e692288fdb28f0979d31

SHA256
940a773e48b39e5986e29d7b7ff9f8d92318495d18192ffe80a4c8e9988def15

SHA512
2fc05b403c74d1a3fbd8f45a625b6d454abfb08e317fabf210b4a8fc1e0d08376fc781819e4feec4254bb5b84ab355e3cef524f93710fc0e1625c2e8f178fb77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MoonCrypter.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

Filesize
1KB

MD5
86254e7829d7e589b36158ff7c4a81fe

SHA1
feec156a5f610ea4b7ad0cfeb102696f227d45c2

SHA256
4ee6cb3306075a294d8856310408c53a067420756b71542468295ce44a2044ca

SHA512
6d66535eb82c6a29603a43ea3a4c85299c7958c3db513b4119e6a05b386f12b8f6402eee4f4a272c893e644f8eb7f0b14025ce9e99017014574245f619f14347

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fixer.exe.log

Filesize
1KB

MD5
28df963c88836df10a200a7f3ddcdaf2

SHA1
12c9058ad17a0a186021a145aad09fd32bb8fa2c

SHA256
d61f44cb34af871284be7ca4dec205a1bf8ca747b2efbdb84a14e7df0ae3e85f

SHA512
6c55ee17008aad1bec0abfd8ad48d5d86b3d371b62eed0418a1351ac1c747a1226fdb3edb46480d6da4bab9c7dab3a05bc8958cc7e83cfe00419afb7531cefff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c8fbf27b2cff4dde6ca7e00361766ee9

SHA1
6827521759d823cd1833c660176cd8f73fed351e

SHA256
a31b617c46e17d49578babeaf2ea59af20ed6cab7cc2707385e78475912c1d12

SHA512
e131e9c6db5d1a5562622d16b2fcc6b3c460143e963fd202034eb0044229291174f3900bd6e7392906989a103fdf89968872acafdf77d63d53eca89d608ed687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8cb7f4b4ab204cacd1af6b29c2a2042c

SHA1
244540c38e33eac05826d54282a0bfa60340d6a1

SHA256
4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

SHA512
7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
050567a067ffea4eb40fe2eefebdc1ee

SHA1
6e1fb2c7a7976e0724c532449e97722787a00fec

SHA256
3952d5b543e5cb0cb84014f4ad9f5f1b7166f592d28640cbc3d914d0e6f41d2e

SHA512
341ad71ef7e850b10e229666312e4bca87a0ed9fe25ba4b0ab65661d5a0efa855db0592153106da07134d8fc2c6c0e44709bf38183c9a574a1fa543189971259

Download Submit
C:\Users\Admin\AppData\Local\Temp\MoonCrypter.exe

Filesize
191KB

MD5
24bd0c210794c566995f58dd1ea5d542

SHA1
890f5936f00948e77d766b8e200d6a9a210b1032

SHA256
d60d3dfdc76f15f7891d8f437b07a20567f4face48ae22e4b816b2bd44f6a5ba

SHA512
978338f90d3ce30b64d1f745a1ba477b42285f0e3a5409d3537a174f7211751e8edb4c056226f4af27c44ad8cbc6e9c95289efabd1540f7b31605b91df952d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y25fwx0d.onr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\moon.exe

Filesize
39KB

MD5
a980d2576c2540587333143dafc4fef4

SHA1
432352d8571bd6d345c8b931e19bef818f324cfe

SHA256
3ade47aed888d5099ba50ba655cbf909756367b12537b2fba6d0d7d3690e803a

SHA512
d7b67aa3ce5d5bddfb5929262ee3e64877600297cf423d90c101c8b7803687861b9668b112f17f4dee94d1701b0ee70ecf05972b810d37f8ca8a51a8055d19f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_E8BBD39CC7744969A84B0E1E6E6A9D2F.dat

Filesize
940B

MD5
b7361c57f9a7ff4d664919446006f3f6

SHA1
66aa405161c4007113f4efc2e174ac7ef598da43

SHA256
3378d0dc34091f28efa947ecefe1e3cab218917d9dc569cfe41b95c5ffecf652

SHA512
e866eb4a8cbe6d40983f492a320a6bc1010e6da957cfdf86051ef860a3a4e27176e533b6a54495c1993725e92f8a405af1ba5a9eb1c113b14ba1065f647f7a01

Download Submit
C:\Users\Admin\Desktop\MoonCrypter\Jint\Ionic.Zip.dll

Filesize
480KB

MD5
f6933bf7cee0fd6c80cdf207ff15a523

SHA1
039eeb1169e1defe387c7d4ca4021bce9d11786d

SHA256
17bb0c9be45289a2be56a5f5a68ec9891d7792b886e0054bc86d57fe84d01c89

SHA512
88675512daa41e17ce4daf6ca764ccb17cd9633a7c2b7545875089cae60f6918909a947f3b1692d16ec5fa209e18e84bc0ff3594f72c3e677a6cca9f3a70b8d6

Download Submit
C:\Users\Admin\Desktop\MoonCrypter\Jint\LICENCE.dat

Filesize
73KB

MD5
5ac57bee6febd79c760a08a6f4fbda37

SHA1
fc9646f500d3d197932a890544081dfa05c00214

SHA256
59a2f1e7e29689f58536f505b5479cbbef9d3e8e0a7ebfaa41dfb434f4667dea

SHA512
9b424abc0b94598c7b35ba6398a0b4a21c6b4a32de31bab43af259af3cbdb407592d0eaff25c29d6a3def645e7e455b50375eb7ab3161bb64ea8ae5d9b48d65a

Download Submit
C:\Users\Admin\Desktop\MoonCrypter\Jint\Launcher.exe

Filesize
53KB

MD5
c6d4c881112022eb30725978ecd7c6ec

SHA1
ba4f96dc374195d873b3eebdb28b633d9a1c5bf5

SHA256
0d87b9b141a592711c52e7409ec64de3ab296cddc890be761d9af57cea381b32

SHA512
3bece10b65dfda69b6defbf50d067a59d1cd1db403547fdf28a4cbc87c4985a4636acfcff8300bd77fb91f2693084634d940a91517c33b5425258835ab990981

Download Submit
C:\Users\Admin\Desktop\MoonCrypter\Jint\mce.exe

Filesize
253KB

MD5
0ec3da715b4dd0c38c00d5102dbcc6c6

SHA1
8f94bdd39e48e894d01cc418059288ab0b9fd7ce

SHA256
cd24da6a58712ffa1c42790226d2dbcbd4a223e14d001c97e4031170d3ef6a99

SHA512
a3b9aff7c374accb0d079104bbf73889c8b0c9c14cbabbf97265048c944efb89cc5b9340fab8e80607e8863d32cec6908d01d079414c4bc69a09301485464232

Download Submit
C:\Users\Admin\Desktop\MoonCrypter\MoonCrypter.exe

Filesize
268KB

MD5
b32cf72bcf05b3df1967624c18792bfc

SHA1
da6bb03499739c473d34cf65bba5a68c3248ba1a

SHA256
2b2e23b302667a243ddf8250f5c654ffc7033f7000375df534348aff2f18871d

SHA512
1772753364652881db88595a4bc9e0e96a3cded522723c21a287c8675286c89e8790286334b177ab96403a1d63bd483c20ec3ed69631f1dc590e0c36b96eb54f

Download Submit
C:\Windows\IMF\Runtime Explorer.exe

Filesize
144KB

MD5
5ea4ee24f01613f1bd403312c46b9ec9

SHA1
3d76201186437c8e0daba0ee37472fe3c4ef546d

SHA256
c81755fe990f1b023bf9b88eed4856c088755af050ea4627ed081a8203f03472

SHA512
73b0cc6d49db601b50a5c89b4b0f083a69efd6ff063edc03c93cac16c104173b8a1d172279e88f8a1b17b3b56f27a9fe6f207fde51729292cbacb272c75c8f53

Download Submit
C:\Windows\IMF\Secure System Shell.exe

Filesize
45KB

MD5
7d0c7359e5b2daa5665d01afdc98cc00

SHA1
c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

SHA256
f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

SHA512
a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

Download Submit
C:\Windows\IMF\Windows Services.exe

Filesize
46KB

MD5
ad0ce1302147fbdfecaec58480eb9cf9

SHA1
874efbc76e5f91bc1425a43ea19400340f98d42b

SHA256
2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

SHA512
adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

Download Submit
memory/460-196-0x0000000006FB0000-0x0000000006FC1000-memory.dmp

Filesize
68KB

Download
memory/460-205-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

Filesize
56KB

Download
memory/460-150-0x0000000006C70000-0x0000000006D14000-memory.dmp

Filesize
656KB

Download
memory/460-104-0x0000000002260000-0x0000000002296000-memory.dmp

Filesize
216KB

Download
memory/460-105-0x0000000004DF0000-0x000000000541A000-memory.dmp

Filesize
6.2MB

Download
memory/460-106-0x0000000004BA0000-0x0000000004BC2000-memory.dmp

Filesize
136KB

Download
memory/460-108-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/460-107-0x0000000005490000-0x00000000054F6000-memory.dmp

Filesize
408KB

Download
memory/460-191-0x0000000006E20000-0x0000000006E2A000-memory.dmp

Filesize
40KB

Download
memory/460-119-0x0000000005570000-0x00000000058C7000-memory.dmp

Filesize
3.3MB

Download
memory/460-194-0x0000000007030000-0x00000000070C6000-memory.dmp

Filesize
600KB

Download
memory/460-175-0x00000000073E0000-0x0000000007A5A000-memory.dmp

Filesize
6.5MB

Download
memory/460-182-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

Filesize
104KB

Download
memory/460-206-0x0000000006FF0000-0x0000000007005000-memory.dmp

Filesize
84KB

Download
memory/460-129-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Filesize
120KB

Download
memory/460-207-0x00000000070F0000-0x000000000710A000-memory.dmp

Filesize
104KB

Download
memory/460-130-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

Filesize
304KB

Download
memory/460-138-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

Filesize
304KB

Download
memory/460-136-0x0000000006030000-0x0000000006064000-memory.dmp

Filesize
208KB

Download
memory/460-209-0x00000000070E0000-0x00000000070E8000-memory.dmp

Filesize
32KB

Download
memory/460-149-0x0000000006010000-0x000000000602E000-memory.dmp

Filesize
120KB

Download
memory/820-57-0x000001EDFE150000-0x000001EDFE172000-memory.dmp

Filesize
136KB

Download
memory/1032-125-0x000000001BF60000-0x000000001C006000-memory.dmp

Filesize
664KB

Download
memory/1032-132-0x000000001CD20000-0x000000001CD6C000-memory.dmp

Filesize
304KB

Download
memory/1032-131-0x000000001BE50000-0x000000001BE58000-memory.dmp

Filesize
32KB

Download
memory/1032-128-0x000000001CAC0000-0x000000001CB5C000-memory.dmp

Filesize
624KB

Download
memory/1032-127-0x000000001C4E0000-0x000000001C9AE000-memory.dmp

Filesize
4.8MB

Download
memory/1140-251-0x0000000002AC0000-0x0000000002ACE000-memory.dmp

Filesize
56KB

Download
memory/1140-44-0x0000000000A70000-0x0000000000A80000-memory.dmp

Filesize
64KB

Download
memory/1520-51-0x0000000005AE0000-0x0000000005B36000-memory.dmp

Filesize
344KB

Download
memory/1520-50-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/1520-48-0x0000000005F50000-0x00000000064F6000-memory.dmp

Filesize
5.6MB

Download
memory/1520-49-0x00000000059A0000-0x0000000005A32000-memory.dmp

Filesize
584KB

Download
memory/1520-46-0x0000000000DE0000-0x0000000000E16000-memory.dmp

Filesize
216KB

Download
memory/1520-47-0x0000000005900000-0x000000000599C000-memory.dmp

Filesize
624KB

Download
memory/2080-45-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/2080-18-0x00007FFFEFC43000-0x00007FFFEFC45000-memory.dmp

Filesize
8KB

Download
memory/2080-19-0x0000000000EA0000-0x0000000000EEA000-memory.dmp

Filesize
296KB

Download
memory/2080-21-0x00007FFFEFC40000-0x00007FFFF0702000-memory.dmp

Filesize
10.8MB

Download
memory/2516-103-0x0000000006DD0000-0x0000000006E4E000-memory.dmp

Filesize
504KB

Download
memory/2516-171-0x0000000006990000-0x00000000069AE000-memory.dmp

Filesize
120KB

Download
memory/2516-98-0x0000000000DF0000-0x0000000000E04000-memory.dmp

Filesize
80KB

Download
memory/2516-170-0x00000000069B0000-0x0000000006A26000-memory.dmp

Filesize
472KB

Download
memory/4080-190-0x0000000000900000-0x0000000000912000-memory.dmp

Filesize
72KB

Download
memory/4512-200-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads