asyncrat | 19160558464eae235ddcabd9ca2f2430fe9cd4ef09a4a48422b3d307dc9f1211

Resubmissions

21-02-2025 21:27

250221-1a286szqgy 10

Analysis

max time kernel
480s
max time network
485s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
21-02-2025 21:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Output.exe
Size

101.5MB
MD5

99dedecce8d12d114093774bfe37e8d2
SHA1

3c426086ac435fc2f0f8d484ec0c8ac3b7b67198
SHA256

19160558464eae235ddcabd9ca2f2430fe9cd4ef09a4a48422b3d307dc9f1211
SHA512

0ae07c890b8759a549dcaa0095ffd7bb77207e421671b7c43ca55766d912afc605cce6d0beab854b7de43535a572d49d657f257a735d4517d1481019a077733b
SSDEEP

1572864:TAH9VHuvHriHHGVZVPbRe57nkuAwa1Fn7bzsj7e4ZleTIVYX+rpox53/7ZTOMdZk:iLuvkUs6vx7b0Lowc3lTOMMoDK7ubWQ

Score

10^/10

asyncrat discordrat xworm default discovery execution persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

77.100.63.251:5631

Mutex

hBzn8DEgaZjEQy9i

Attributes

Install_directory
%ProgramData%
install_file
XClient.exe

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

77.100.63.251:5631

Mutex

wPgAGvV1528Y

Attributes

delay
3
install
true
install_file
G.exe
install_folder
%AppData%

aes.plain

Extracted

Family

discordrat

Attributes

discord_token
MTMzNTM2MTY5MTk5OTAxMDgxNg.GciI8P.eK2Ct0JduBeUphJEDtbS4269H32Q5D3CBEUg6o
server_id
1342556667375779910

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001c00000002ada7-6.dat	family_xworm
behavioral1/memory/5056-24-0x0000000000800000-0x0000000000812000-memory.dmp	family_xworm

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x001900000002ada8-17.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1592	powershell.exe
572	powershell.exe
2632	powershell.exe
1068	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 14 IoCs

pid	Process
5056	XClient.exe
4068	AntonsFile.exe
4856	Test.exe
2072	Client-built.exe
1600	Test.exe
2500	G.exe
4380	XClient.exe
4424	XClient.exe
968	XClient.exe
3928	XClient.exe
3460	XClient.exe
1164	XClient.exe
792	XClient.exe
4972	XClient.exe

Loads dropped DLL 64 IoCs

pid	Process
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe
1600	Test.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-580533235-1933962784-2718464258-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\ProgramData\\XClient.exe"	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
7	discord.com
12	discord.com
13	discord.com
14	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com
2	ip-api.com
3	ipinfo.io
4	ipinfo.io
11	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AntonsFile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1556	timeout.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "135"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-580533235-1933962784-2718464258-1000\{CBDD943B-0EBB-4454-86D1-6DF56067AD0D}	Test.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3452	schtasks.exe
2168	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2500	G.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
4068	AntonsFile.exe
1592	powershell.exe
1592	powershell.exe
572	powershell.exe
572	powershell.exe
2632	powershell.exe
2632	powershell.exe
1068	powershell.exe
1068	powershell.exe
5056	XClient.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	XClient.exe
Token: SeDebugPrivilege	2072	Client-built.exe
Token: SeDebugPrivilege	4068	AntonsFile.exe
Token: SeDebugPrivilege	1600	Test.exe
Token: SeDebugPrivilege	2500	G.exe
Token: SeDebugPrivilege	2500	G.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	5056	XClient.exe
Token: SeDebugPrivilege	4380	XClient.exe
Token: SeDebugPrivilege	4424	XClient.exe
Token: SeDebugPrivilege	968	XClient.exe
Token: SeDebugPrivilege	3928	XClient.exe
Token: SeDebugPrivilege	3460	XClient.exe
Token: SeDebugPrivilege	1164	XClient.exe
Token: SeDebugPrivilege	792	XClient.exe
Token: SeDebugPrivilege	4972	XClient.exe
Token: SeShutdownPrivilege	1224	shutdown.exe
Token: SeRemoteShutdownPrivilege	1224	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5056	XClient.exe
2500	G.exe
2256	LogonUI.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 5056	1068	Output.exe	82
PID 1068 wrote to memory of 5056	1068	Output.exe	82
PID 1068 wrote to memory of 4068	1068	Output.exe	83
PID 1068 wrote to memory of 4068	1068	Output.exe	83
PID 1068 wrote to memory of 4068	1068	Output.exe	83
PID 1068 wrote to memory of 4856	1068	Output.exe	84
PID 1068 wrote to memory of 4856	1068	Output.exe	84
PID 1068 wrote to memory of 2072	1068	Output.exe	86
PID 1068 wrote to memory of 2072	1068	Output.exe	86
PID 4068 wrote to memory of 3912	4068	AntonsFile.exe	88
PID 4068 wrote to memory of 3912	4068	AntonsFile.exe	88
PID 4068 wrote to memory of 3912	4068	AntonsFile.exe	88
PID 4068 wrote to memory of 3584	4068	AntonsFile.exe	90
PID 4068 wrote to memory of 3584	4068	AntonsFile.exe	90
PID 4068 wrote to memory of 3584	4068	AntonsFile.exe	90
PID 3912 wrote to memory of 3452	3912	cmd.exe	92
PID 3912 wrote to memory of 3452	3912	cmd.exe	92
PID 3912 wrote to memory of 3452	3912	cmd.exe	92
PID 3584 wrote to memory of 1556	3584	cmd.exe	93
PID 3584 wrote to memory of 1556	3584	cmd.exe	93
PID 3584 wrote to memory of 1556	3584	cmd.exe	93
PID 4856 wrote to memory of 1600	4856	Test.exe	94
PID 4856 wrote to memory of 1600	4856	Test.exe	94
PID 3584 wrote to memory of 2500	3584	cmd.exe	95
PID 3584 wrote to memory of 2500	3584	cmd.exe	95
PID 3584 wrote to memory of 2500	3584	cmd.exe	95
PID 5056 wrote to memory of 1592	5056	XClient.exe	99
PID 5056 wrote to memory of 1592	5056	XClient.exe	99
PID 5056 wrote to memory of 572	5056	XClient.exe	101
PID 5056 wrote to memory of 572	5056	XClient.exe	101
PID 5056 wrote to memory of 2632	5056	XClient.exe	103
PID 5056 wrote to memory of 2632	5056	XClient.exe	103
PID 5056 wrote to memory of 1068	5056	XClient.exe	105
PID 5056 wrote to memory of 1068	5056	XClient.exe	105
PID 5056 wrote to memory of 2168	5056	XClient.exe	107
PID 5056 wrote to memory of 2168	5056	XClient.exe	107
PID 2500 wrote to memory of 2484	2500	G.exe	131
PID 2500 wrote to memory of 2484	2500	G.exe	131
PID 2500 wrote to memory of 2484	2500	G.exe	131
PID 2484 wrote to memory of 1224	2484	cmd.exe	133
PID 2484 wrote to memory of 1224	2484	cmd.exe	133
PID 2484 wrote to memory of 1224	2484	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Public\XClient.exe
  "C:\Users\Public\XClient.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\ProgramData\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- C:\Users\Public\AntonsFile.exe
  "C:\Users\Public\AntonsFile.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "G" /tr '"C:\Users\Admin\AppData\Roaming\G.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "G" /tr '"C:\Users\Admin\AppData\Roaming\G.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDCF2.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1556
  - - C:\Users\Admin\AppData\Roaming\G.exe
      "C:\Users\Admin\AppData\Roaming\G.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\SysWOW64\shutdown.exe
        
        Shutdown /s /f /t 00
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
- C:\Users\Public\Test.exe
  "C:\Users\Public\Test.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Public\Test.exe
    "C:\Users\Public\Test.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- C:\Users\Public\Client-built.exe
  "C:\Users\Public\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2072

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2348

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\ProgramData\XClient.exe
C:\ProgramData\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a3b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BrowserData.db

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\PyQt5\Qt5\bin\MSVCP140.dll

Filesize
576KB

MD5
01b946a2edc5cc166de018dbb754b69c

SHA1
dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46

SHA256
88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5

SHA512
65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\PyQt5\Qt5\bin\Qt5Core.dll

Filesize
5.7MB

MD5
817520432a42efa345b2d97f5c24510e

SHA1
fea7b9c61569d7e76af5effd726b7ff6147961e5

SHA256
8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a

SHA512
8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\PyQt5\QtCore.pyd

Filesize
2.4MB

MD5
678fa1496ffdea3a530fa146dedcdbcc

SHA1
c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8

SHA256
d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37

SHA512
8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_asyncio.pyd

Filesize
69KB

MD5
cc0f232f2a8a359dee29a573667e6d77

SHA1
d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7

SHA256
7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d

SHA512
48484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_bz2.pyd

Filesize
83KB

MD5
dd26ed92888de9c57660a7ad631bb916

SHA1
77d479d44d9e04f0a1355569332233459b69a154

SHA256
324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

SHA512
d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_cffi_backend.cp312-win_amd64.pyd

Filesize
175KB

MD5
fcb71ce882f99ec085d5875e1228bdc1

SHA1
763d9afa909c15fea8e016d321f32856ec722094

SHA256
86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b

SHA512
4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_ctypes.pyd

Filesize
122KB

MD5
c8afa1ebb28828e1115c110313d2a810

SHA1
1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a

SHA256
8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0

SHA512
4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_decimal.pyd

Filesize
251KB

MD5
cea3b419c7ca87140a157629c6dbd299

SHA1
7dbff775235b1937b150ae70302b3208833dc9be

SHA256
95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

SHA512
6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_hashlib.pyd

Filesize
64KB

MD5
d19cb5ca144ae1fd29b6395b0225cf40

SHA1
5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

SHA256
f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

SHA512
9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_lzma.pyd

Filesize
156KB

MD5
8cfbafe65d6e38dde8e2e8006b66bb3e

SHA1
cb63addd102e47c777d55753c00c29c547e2243c

SHA256
6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

SHA512
fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_multiprocessing.pyd

Filesize
34KB

MD5
eb859fc7f54cba118a321440ad088096

SHA1
9d3c410240f4c5269e07ffbde43d6f5e7cc30b44

SHA256
14bdd15d60b9d6141009aeedc606007c42b46c779a523d21758e57cf126dc2a4

SHA512
694a9c1cc3dc78b47faedf66248ff078e5090cfab22e95c123fb99b10192a5748748a5f0937ffd9fd8e1873ad48f290be723fe194b7eb2a731add7f5fb776c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_overlapped.pyd

Filesize
54KB

MD5
df92ea698a3d0729b70a4306bbe3029f

SHA1
b82f3a43568148c64a46e2774aec39bf1f2d3c1e

SHA256
46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032

SHA512
bdebafe1b40244a0cb6c97e75424f79cfe395774a9d03cdb02f82083110c1f4bdcac2819ba1845ad1c56e2d2e6506dcc1833e4eb269bb0f620f0eb73b4d47817

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_queue.pyd

Filesize
31KB

MD5
7d91dd8e5f1dbc3058ea399f5f31c1e6

SHA1
b983653b9f2df66e721ece95f086c2f933d303fc

SHA256
76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d

SHA512
b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_socket.pyd

Filesize
81KB

MD5
e43aed7d6a8bcd9ddfc59c2d1a2c4b02

SHA1
36f367f68fb9868412246725b604b27b5019d747

SHA256
2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

SHA512
d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_sqlite3.pyd

Filesize
122KB

MD5
f8869058c1f6f6352309d774c0fefde9

SHA1
4a9fd6c93785c6b6c53f33946e9b1ca5db52a4e9

SHA256
fb00951d39084e88871c813d6c4043ce8afb60ab6d012e699ddd607baa10f6e1

SHA512
37205b755985cdbb16f806cda8e7637164d1d62f410ea07501739215b9e410e91997110600ead999d726cb15ec4aef3abf673e7ad47d3ca076457c89ea2b401c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_ssl.pyd

Filesize
174KB

MD5
6a2b0f8f50b47d05f96deff7883c1270

SHA1
2b1aeb6fe9a12e0d527b042512fc8890eedb10d8

SHA256
68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a

SHA512
a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_tkinter.pyd

Filesize
64KB

MD5
e38a6b96f5cc200f21da22d49e321da3

SHA1
4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b

SHA256
f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20

SHA512
3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\_wmi.pyd

Filesize
36KB

MD5
bed7b0ced98fa065a9b8fe62e328713f

SHA1
e329ebca2df8889b78ce666e3fb909b4690d2daa

SHA256
5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94

SHA512
c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\base_library.zip

Filesize
1.3MB

MD5
02379f4e366dcea1548a76c096c64cc6

SHA1
b0d95b88aed3ba8dbc3d00612bb38537c563043f

SHA256
4b7596f5b73b708cd77e565cd3925b78aa56f0023697090a243e67e422a3a0fa

SHA512
53d79b3c8d8262678bc22c1eaad66a9a02204d2be0df214c46f62a60e49f417dfa47836c19b8aaf728589269a8b59ddbe6f88211185500a1d270f34c9563ccd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\pyexpat.pyd

Filesize
197KB

MD5
815f1bdabb79c6a12b38d84aa343196d

SHA1
916483149875a5e20c6046ceffef62dd6089ddd5

SHA256
31712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9

SHA512
1078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\python3.DLL

Filesize
66KB

MD5
8dbe9bbf7118f4862e02cd2aaf43f1ab

SHA1
935bc8c5cea4502d0facf0c49c5f2b9c138608ed

SHA256
29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db

SHA512
938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\select.pyd

Filesize
30KB

MD5
79ce1ae3a23dff6ed5fc66e6416600cd

SHA1
6204374d99144b0a26fd1d61940ff4f0d17c2212

SHA256
678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

SHA512
a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Filesize
1KB

MD5
4ce7501f6608f6ce4011d627979e1ae4

SHA1
78363672264d9cd3f72d5c1d3665e1657b1a5071

SHA256
37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

SHA512
a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\sqlite3.dll

Filesize
1.5MB

MD5
956ef70f60fb099d31a79fa7334359ad

SHA1
336a78492c0e10fab4baa0add7552e52f61dd110

SHA256
809c7b48b73c95b361d13c753e7a6e3c83124a27e18aac81df7c876f32e98e00

SHA512
7fd74b92e32a385b193264d0f08a390eec672e508ef85bf0439bdb713a9c8909688f845bcacd4adb3dd91b08a3eb40ae32532a08fc9378ed4530646fb871fd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\tcl86t.dll

Filesize
1.7MB

MD5
3ae729942d15f4f48b1ea8c91880f1f4

SHA1
d27596d14af5adeb02edab74859b763bf6ac2853

SHA256
fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760

SHA512
355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\tk86t.dll

Filesize
1.5MB

MD5
966580716c0d6b7eec217071a6df6796

SHA1
e3d2d4a7ec61d920130d7a745586ceb7aad4184d

SHA256
afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2

SHA512
cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\unicodedata.pyd

Filesize
1.1MB

MD5
b848e259fabaf32b4b3c980a0a12488d

SHA1
da2e864e18521c86c7d8968db74bb2b28e4c23e2

SHA256
c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

SHA512
4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI48562\zlib1.dll

Filesize
143KB

MD5
4fadeda3c1da95337b67d15c282d49d8

SHA1
f49ee3256f8f5746515194114f7ef73d6b6141c0

SHA256
28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013

SHA512
45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xcwuect.4k4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDCF2.tmp.bat

Filesize
145B

MD5
66b0fd2874e8481030dde317eb064d74

SHA1
f788d0d990659b646851d6fffeb8d5d2b31d8d78

SHA256
216d0996149805771b74dc659d4fc012ca3e10ce102c43652086fe068a072cf7

SHA512
84c7d1f6de0776aca4241a8081c0c32f119f74c5c9f20d42ff4ea4137ceea5729c2896b7628a516deccfa01c97b101287830c3d3b1d3ea14a17cc3bed61a45ed

Download Submit
C:\Users\Public\AntonsFile.exe

Filesize
47KB

MD5
cf2ca438000d1b1eb52027e072633348

SHA1
225a0741c9cb1cdddd12dfad6895bb91bb218712

SHA256
002a936cc181ea7e45b5f441d90cfe633a9ba5abece878a789163ca2ef992374

SHA512
6c12d644711ac63005dfc958c69a7e5b842d1e66ae23d8f60373a171572398f73187197f1f480222469dfa371f1a6baea65c5189bbf8e4a593db0e0e907a1396

Download Submit
C:\Users\Public\Client-built.exe

Filesize
78KB

MD5
e9135fe9bd3c47df0b3652ea085bbeea

SHA1
f2d69d0b0cc15cc09582ec4363256f5a7214a4ea

SHA256
463dca79e83589665bc074450e7251e593c886d468e7de978886daf341d62c06

SHA512
021f6ee5f7a897077a9a61ce1bd8142bd9dc7f94bb1550aa1a8a17b587f17a1b6ee3b0885870218b34dc2fe1ce750fc54dd3960afc898fd76da83bcb709fde30

Download Submit
C:\Users\Public\XClient.exe

Filesize
45KB

MD5
664d69c8649c34525d721692bf455b8e

SHA1
554eca18d4ac68e3ea8810b12ab8bcbe28913b32

SHA256
2f31983fe687c7008fc3363593da4bfe4a6138c3f6135a9f7908f7d0caf119a1

SHA512
24563b80e18c13dd9574963e7a87ea91fb1436848ca804f56d37639165094e8c04149674ed29d744b578720058775059313545023123b5ce2f7a2e19ff3b5ad8

Download Submit
memory/1068-1-0x0000000000390000-0x0000000001390000-memory.dmp

Filesize
16.0MB

Download
memory/1068-0-0x00007FFA76913000-0x00007FFA76915000-memory.dmp

Filesize
8KB

Download
memory/1592-1317-0x0000024FE3BC0000-0x0000024FE3BE2000-memory.dmp

Filesize
136KB

Download
memory/1600-1310-0x00007FFA77710000-0x00007FFA77973000-memory.dmp

Filesize
2.4MB

Download
memory/2072-47-0x000002EBE8FC0000-0x000002EBE8FD8000-memory.dmp

Filesize
96KB

Download
memory/2072-48-0x000002EBEB820000-0x000002EBEB9E2000-memory.dmp

Filesize
1.8MB

Download
memory/2500-2493-0x0000000005EF0000-0x0000000006496000-memory.dmp

Filesize
5.6MB

Download
memory/2500-2494-0x0000000006620000-0x0000000006696000-memory.dmp

Filesize
472KB

Download
memory/2500-2500-0x0000000006B90000-0x0000000006B9A000-memory.dmp

Filesize
40KB

Download
memory/2500-2499-0x0000000006540000-0x00000000065A2000-memory.dmp

Filesize
392KB

Download
memory/2500-2498-0x00000000064A0000-0x0000000006504000-memory.dmp

Filesize
400KB

Download
memory/2500-2497-0x0000000006AB0000-0x0000000006B42000-memory.dmp

Filesize
584KB

Download
memory/2500-2496-0x00000000066E0000-0x00000000066FE000-memory.dmp

Filesize
120KB

Download
memory/2500-2495-0x00000000065A0000-0x0000000006608000-memory.dmp

Filesize
416KB

Download
memory/4068-1171-0x00000000056F0000-0x000000000578C000-memory.dmp

Filesize
624KB

Download
memory/4068-27-0x0000000000900000-0x0000000000912000-memory.dmp

Filesize
72KB

Download
memory/4068-26-0x000000007452E000-0x000000007452F000-memory.dmp

Filesize
4KB

Download
memory/4068-1075-0x0000000005210000-0x0000000005276000-memory.dmp

Filesize
408KB

Download
memory/5056-1371-0x00000000010D0000-0x00000000010DC000-memory.dmp

Filesize
48KB

Download
memory/5056-1374-0x000000001C5B0000-0x000000001C5BC000-memory.dmp

Filesize
48KB

Download
memory/5056-1375-0x000000001CFB0000-0x000000001D03E000-memory.dmp

Filesize
568KB

Download
memory/5056-1377-0x00007FFA76910000-0x00007FFA773D2000-memory.dmp

Filesize
10.8MB

Download
memory/5056-24-0x0000000000800000-0x0000000000812000-memory.dmp

Filesize
72KB

Download
memory/5056-25-0x00007FFA76910000-0x00007FFA773D2000-memory.dmp

Filesize
10.8MB

Download
memory/5056-108-0x00000000010F0000-0x0000000001100000-memory.dmp

Filesize
64KB

Download
memory/5056-1316-0x00000000010F0000-0x0000000001100000-memory.dmp

Filesize
64KB

Download
memory/5056-1315-0x00007FFA76910000-0x00007FFA773D2000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads