revengerat | d91912b4b945e88e881e54573390e6723cfc41916b6546453b59e60f9beee337

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2025, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REVENGE-RAT.js
Size 1.2MB
Sample250504-gspagsen21
SHA256 4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e
MD5 8ff99e0a81c684cefbc2a752c44f30a1
SHA1 61b8dbc7483abcb72d2c633e6309feb26ac16eb0
SHA512 7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364
SSDEEP 24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat tenakt discovery execution persistence trojan

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\Control Panel\International\Geo\Nation	tacbvfff.exe

Drops startup file 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msta.exe	foldani.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msta.exe	foldani.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cjnsta.vbs	foldani.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tenakt.js	foldani.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hadiya.lnk	foldani.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\elBV.URL	foldani.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\inststa.exe	vbc.exe

Executes dropped EXE 6 IoCs

pid	Process
2396	tacbvfff.exe
4780	tacbvfff.exe
1124	foldani.exe
5072	foldani.exe
4848	foldani.exe
2492	foldani.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2930597513-779029253-718817275-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tenakna = "C:\\Users\\Admin\\Documents\\foldani.exe"	foldani.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 4780	2396	tacbvfff.exe	92
PID 1124 set thread context of 5072	1124	foldani.exe	97
PID 4848 set thread context of 2492	4848	foldani.exe	134

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tacbvfff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foldani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tacbvfff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foldani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foldani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foldani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5292	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	tacbvfff.exe
Token: SeDebugPrivilege	5072	foldani.exe
Token: SeDebugPrivilege	2492	foldani.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2396	3688	wscript.exe	89
PID 3688 wrote to memory of 2396	3688	wscript.exe	89
PID 3688 wrote to memory of 2396	3688	wscript.exe	89
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 2396 wrote to memory of 4780	2396	tacbvfff.exe	92
PID 4780 wrote to memory of 1124	4780	tacbvfff.exe	96
PID 4780 wrote to memory of 1124	4780	tacbvfff.exe	96
PID 4780 wrote to memory of 1124	4780	tacbvfff.exe	96
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 1124 wrote to memory of 5072	1124	foldani.exe	97
PID 5072 wrote to memory of 2664	5072	foldani.exe	98
PID 5072 wrote to memory of 2664	5072	foldani.exe	98
PID 5072 wrote to memory of 2664	5072	foldani.exe	98
PID 2664 wrote to memory of 2416	2664	vbc.exe	100
PID 2664 wrote to memory of 2416	2664	vbc.exe	100
PID 2664 wrote to memory of 2416	2664	vbc.exe	100
PID 5072 wrote to memory of 5292	5072	foldani.exe	102
PID 5072 wrote to memory of 5292	5072	foldani.exe	102
PID 5072 wrote to memory of 5292	5072	foldani.exe	102
PID 5072 wrote to memory of 2776	5072	foldani.exe	105
PID 5072 wrote to memory of 2776	5072	foldani.exe	105
PID 5072 wrote to memory of 2776	5072	foldani.exe	105
PID 5412 wrote to memory of 4848	5412	cmd.exe	107
PID 5412 wrote to memory of 4848	5412	cmd.exe	107
PID 5412 wrote to memory of 4848	5412	cmd.exe	107
PID 2776 wrote to memory of 4140	2776	vbc.exe	108
PID 2776 wrote to memory of 4140	2776	vbc.exe	108
PID 2776 wrote to memory of 4140	2776	vbc.exe	108
PID 5072 wrote to memory of 4284	5072	foldani.exe	109
PID 5072 wrote to memory of 4284	5072	foldani.exe	109
PID 5072 wrote to memory of 4284	5072	foldani.exe	109
PID 4284 wrote to memory of 5660	4284	vbc.exe	111
PID 4284 wrote to memory of 5660	4284	vbc.exe	111
PID 4284 wrote to memory of 5660	4284	vbc.exe	111
PID 5072 wrote to memory of 64	5072	foldani.exe	112
PID 5072 wrote to memory of 64	5072	foldani.exe	112
PID 5072 wrote to memory of 64	5072	foldani.exe	112
PID 64 wrote to memory of 2504	64	vbc.exe	114
PID 64 wrote to memory of 2504	64	vbc.exe	114
PID 64 wrote to memory of 2504	64	vbc.exe	114
PID 5072 wrote to memory of 4408	5072	foldani.exe	115
PID 5072 wrote to memory of 4408	5072	foldani.exe	115
PID 5072 wrote to memory of 4408	5072	foldani.exe	115
PID 4408 wrote to memory of 1044	4408	vbc.exe	117
PID 4408 wrote to memory of 1044	4408	vbc.exe	117
PID 4408 wrote to memory of 1044	4408	vbc.exe	117
PID 5072 wrote to memory of 5820	5072	foldani.exe	118
PID 5072 wrote to memory of 5820	5072	foldani.exe	118
PID 5072 wrote to memory of 5820	5072	foldani.exe	118
PID 5820 wrote to memory of 5216	5820	vbc.exe	120
PID 5820 wrote to memory of 5216	5820	vbc.exe	120
PID 5820 wrote to memory of 5216	5820	vbc.exe	120
PID 5072 wrote to memory of 3596	5072	foldani.exe	121
PID 5072 wrote to memory of 3596	5072	foldani.exe	121

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
  "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
    "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Users\Admin\Documents\foldani.exe
      "C:\Users\Admin\Documents\foldani.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1124
    - - C:\Users\Admin\Documents\foldani.exe
        
        "C:\Users\Admin\Documents\foldani.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5072
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pxs3_kac.cmdline"
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE903.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3CA6F62A3FB346FA95B314FCC8DAFC8.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5292
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\09jmoo6w.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc460A16A2FD59475189CE2A8F9272051.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yz6hu-wh.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEAE8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcADA2780FB7D340ADA1B410956435D5F.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q5tsuqw7.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC30.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2F42FE8C96B3459A98471F844069385B.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2504
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p-qq37vh.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC9D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7367F4C2F6CB4DAD8FBE21AB663DBEB.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-kbd5hxn.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5820
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED39.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5EA960768ADA49178133F8FA2FCF461F.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rono_ida.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34D847BFBDC54843826DFAE7445D5A2E.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qrsqk3po.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE62.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc12199EB6A044439681DA9EEF59A8C537.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:468
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t33evqb6.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEDF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3B92C6381C9441B5B5E69657AE44C697.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ob_nzvps.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc82EF2D4971AA411E858BE37FA562053.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Users\Admin\Documents\foldani.exe
  C:\Users\Admin\Documents\foldani.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4848
- - C:\Users\Admin\Documents\foldani.exe
    "C:\Users\Admin\Documents\foldani.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tacbvfff.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log
Size 496B
SHA256 8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349
MD5 cb76b18ebed3a9f05a14aed43d35fba6
SHA1 836a4b4e351846fca08b84149cb734cb59b8c0d6
SHA512 7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c
MD5 SHA1 SHA512

Submit Download

-kbd5hxn.0.vb

Path C:\Users\Admin\AppData\Local\Temp\-kbd5hxn.0.vb
Size 285B
SHA256 f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a
MD5 b34b98a6937711fa5ca663f0de61d5bb
SHA1 c371025912ab08ae52ff537aaa9cd924dbce6dcc
SHA512 2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f
MD5 SHA1 SHA512

Submit Download

-kbd5hxn.cmdline

Path C:\Users\Admin\AppData\Local\Temp\-kbd5hxn.cmdline
Size 178B
SHA256 e11b59348a0242124e46afd4338747f17ce53686a843f6ba8025448eddb45c66
MD5 afb3d5d08f8970ce39974c2b7fc06308
SHA1 0106af38fad9bbd5e123720dcf021f21e94ee84c
SHA512 bd4c6bb614d485e9fa9abb991370349ba80295ebfc25280fbf9eb2481ec425298892f1ce005ee64da5e90e04e17a590ad2c22cc37488d7da94fbdba50640e9bf
MD5 SHA1 SHA512

Submit Download

09jmoo6w.0.vb

Path C:\Users\Admin\AppData\Local\Temp\09jmoo6w.0.vb
Size 268B
SHA256 1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439
MD5 fe8760874e21534538e34dc52009e8b0
SHA1 26a9ac419f9530d6045b691f3b0ecfed323be002
SHA512 24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed
MD5 SHA1 SHA512

Submit Download

09jmoo6w.cmdline

Path C:\Users\Admin\AppData\Local\Temp\09jmoo6w.cmdline
Size 161B
SHA256 5ac0afe855377dd9dae45ba4940bf52270e1f82589d53ee45afc5f5a11f86942
MD5 b240495ea5abc32f27121503b1397f5f
SHA1 84b2874717244e71ae1927bf79af042c3cbcea72
SHA512 3e769c8510cd47d9af72fd5cdf44e6dcfff483aa25b9a709d7079088b0b750e32d20e544693064c3510c61f5936d612d02a97bf736ce869ac0bbe3901a564dde
MD5 SHA1 SHA512

Submit Download

RESE903.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE903.tmp
Size 1KB
SHA256 92ef432a25803e76c7980e9ff5876fc3be0200e6eadf659ccc13cf1df2dfd890
MD5 1037b2d5edd439c91cf4e6a77b34ca46
SHA1 c9590c86b62adb8da57a701b38727d645c1cfb6a
SHA512 42717fff590f4f9d59033524c63a5da2b3d1d24bf85922701aa5bb5642929128b316bacdb599c7b5bd012d4500f95d57f2792a26a6172ad29fcfc861c6cb2247
MD5 SHA1 SHA512

Submit Download

RESE9DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE9DE.tmp
Size 1KB
SHA256 c1b9cb6c800e2bd882a038b01ce259cd893f4a16765b09c6bf38d4141dc31d1a
MD5 299c5711ca9aed53514c35c35ce712dd
SHA1 6957d4900adb4e9d10253eb62784cdbdf0579b52
SHA512 59394e4402011a072342b7d5e21a5e07ff7735b501473a9ce4191ed08c2ff9e05932018c0e5f1a8326a6e184303b5cc1e9fce8c1edbc6936f482841716d7a99a
MD5 SHA1 SHA512

Submit Download

RESEAE8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEAE8.tmp
Size 1KB
SHA256 da1fc3b12c1c30e48dfc5c3d6a110bfc7cd9034a8f127e3df90a7c0a9ae9e0cc
MD5 3b87e0eaae7a02ccea181b14764503a6
SHA1 92333c1232a5debc7a98e536326d2270c2ee35eb
SHA512 628c8e0a895d035b0e2b00dd11521e36701ac684f33177bf0dcbd51dffd5f371a5a11a439b2eb517025e445bc578633f6640d5c35072d048e8a7467dfa8801c4
MD5 SHA1 SHA512

Submit Download

RESEC30.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEC30.tmp
Size 1KB
SHA256 d769e212d34ed4bfef2c667dd8d5f7d6ecd2d65f8db0c07aab0cc4978c69e669
MD5 a33fc36ff95426388f4048f58c8bcdd0
SHA1 a476db674d20e6a8e15f0e7bf8f9de946567e7aa
SHA512 e18fbf79c8780b8ffcd47cd04cf9034361055dcfd0858ed27ad8c593fa6aa896b81e0749aa7da179703d84bccc4036c1d2ae295183309b5f5dcc77fcf72dbc22
MD5 SHA1 SHA512

Submit Download

RESEC9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEC9D.tmp
Size 1KB
SHA256 fddc5075a70522ceae616a6d972de6ec52fab7ae53d780ac5d9c24b75a4d8990
MD5 09e7a22d0d3b92b46d9f787b8c4fe205
SHA1 8571be9e182a3c43652da07ba564ff8c47bc1900
SHA512 3db455513c1d2739c1245ffb8bb95600a3f53c9e6009347377411b0823d2ac0a19137d9d10a784f29da624d131dbf1a2367c034a208cceedbf087501ad139248
MD5 SHA1 SHA512

Submit Download

RESED39.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESED39.tmp
Size 1KB
SHA256 08a3539823a71b493363ddf9974fa8eb274257e3ff913732141e601803e788ac
MD5 4bdbbc769c08eb281930e86fb1c14780
SHA1 7e0e227b8cd28b670f79c789030499214ecb3eea
SHA512 82ed413acb84bb5eb658b786114f0ec4a27ef9bd141357fc99185d509bb1bbbcd61a6ee0ff3d2bdcda33c4054d1fc22f9e9085cc00fec73c83e753a8b5853ee2
MD5 SHA1 SHA512

Submit Download

RESEDC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEDC6.tmp
Size 1KB
SHA256 cad505e94325cd2c73ce037ecb7da5759e9e8d73ce4f3d0c9e9ac1053f129eb6
MD5 5676eeba2b621a49fbb0df8e0b935c0a
SHA1 06cdc262a44d4f6bf0698dfb40f497b8262a6835
SHA512 7b1a1f235ab2c5a69a4f5da5963476800e6963aa4fa8b1bea3be953cc212214e577cf0a70a70556363e284d5929cb32026f1d230d7b28cbac8ca72bbac8b0f41
MD5 SHA1 SHA512

Submit Download

RESEE62.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEE62.tmp
Size 1KB
SHA256 6a6cc6bc031552719a7c00749f448b477b2b1dd9e5b21bec15dc6021f9a306bf
MD5 691327f87e45b0e79141cb231cac5257
SHA1 c7ca0400e1753fdd919675c67b06a440a1c08658
SHA512 4dc1c4a05432a0b4d63ddc85f0d3f5f0b3cc92e65c4d3638f7513bbcd2faeba7b2c80612be4d49b748e4d87e6bd1d806450c4a70a5a0b45b3f1eafe75c052ea7
MD5 SHA1 SHA512

Submit Download

RESEEDF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEEDF.tmp
Size 1KB
SHA256 450faf6c6cb4bc3768ef574fef399a600b9310ac16cac4168545492deb203c3a
MD5 f2e509c138bdd2f261eb3f8f7e0e3394
SHA1 0e713bf286f7a9121b88de52d13d9196802852fd
SHA512 d281cb4b6f1bba891c2081cc55b8b8a50afcce0485ae6918a3eda6e4e8dd87fa8193855da4b8f2432d45851f0cd2589abae6a792883cac2f8d06f7e6faa1ce59
MD5 SHA1 SHA512

Submit Download

RESEF6C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEF6C.tmp
Size 1KB
SHA256 417a3927c75ab1b94865e7523fe5becd20b74537b3c80d7624b59fb8ed3c1138
MD5 ec2383cb8d542e5f28c32ed9c3168928
SHA1 516ad4d53b3300310df587b1e2035c2dbde6776e
SHA512 2104aaa61e02df962df36db8231137bdd237f57991c071b20f7eff262b8c6f8a7150f8c00fa845b6ebd0b722b71e1304bf0ba9727a8b8512e142c4422ccd44aa
MD5 SHA1 SHA512

Submit Download

ob_nzvps.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ob_nzvps.0.vb
Size 287B
SHA256 b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49
MD5 9cc0fccb33a41b06335022ada540e8f9
SHA1 e3f1239c08f98d8fbf66237f34b54854ea7b799a
SHA512 9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb
MD5 SHA1 SHA512

Submit Download

ob_nzvps.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ob_nzvps.cmdline
Size 180B
SHA256 28f660e4640ca32185bbecf986ee797f7246a55b885d9783993da91aa8449805
MD5 f46029602d990dabc2a13354776d3f32
SHA1 3940b3195d76ceb62ff78f5e408ae01b6d5bad17
SHA512 2c97992c3e3012e2258807e63d8c5437ea5f2413426ae7a8489d75fa74c07a23af3f4163970a55a261912be40dc528eeb370ace952ae953d49ecd3c135b29137
MD5 SHA1 SHA512

Submit Download

p-qq37vh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\p-qq37vh.0.vb
Size 285B
SHA256 e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40
MD5 9a478476d20a01771bcc5a342accfb4e
SHA1 314cd193e7dae0d95483be2eae5402ce5d215daa
SHA512 56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29
MD5 SHA1 SHA512

Submit Download

p-qq37vh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\p-qq37vh.cmdline
Size 178B
SHA256 b65933cb678ed15a480a7d1110b7d58c287a0924b9cff3f77685fee5426ba8d2
MD5 fb1956c67f0b8dc0e653eb9212195c6b
SHA1 5c6f95be93706fe5865a873ffc0dfdadc9d9e9ec
SHA512 fa204bfb4ec874499d16dc928d83eda8a224069a410c4004e96e91d5d65fcc7d9d49b9626c967deaed8fa44f24ad43ee3129fb2a1ecb86a7e68554cd4c600dd0
MD5 SHA1 SHA512

Submit Download

pxs3_kac.0.vb

Path C:\Users\Admin\AppData\Local\Temp\pxs3_kac.0.vb
Size 145B
SHA256 24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7
MD5 61413d4417a1d9d90bb2796d38b37e96
SHA1 719fcd1e9c0c30c9c940b38890805d7a89fd0fe5
SHA512 9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4
MD5 SHA1 SHA512

Submit Download

pxs3_kac.cmdline

Path C:\Users\Admin\AppData\Local\Temp\pxs3_kac.cmdline
Size 195B
SHA256 2b075feb7565a66d513bd73638cb90e6e474ed7f538213dbc691ea21c312388c
MD5 ce492a03005dc6fe1f406af11eb9dc5a
SHA1 2656903974d059e57b755a1e013f8717cbe41dec
SHA512 0fd449db194c7f970aad82ec498f58706ceedd8dff2de17d49a189fb50c06f91dadc6c72aab6c1e9688d0dfa22c2834da2ca64a6161448f966a2ff8fe3448773
MD5 SHA1 SHA512

Submit Download

q5tsuqw7.0.vb

Path C:\Users\Admin\AppData\Local\Temp\q5tsuqw7.0.vb
Size 284B
SHA256 f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168
MD5 6989ad9512c924a0d9771ce7e3360199
SHA1 1bcc5312adf332719db83156f493ad365f5bdec6
SHA512 13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536
MD5 SHA1 SHA512

Submit Download

q5tsuqw7.cmdline

Path C:\Users\Admin\AppData\Local\Temp\q5tsuqw7.cmdline
Size 177B
SHA256 781268141a5dbc0827a1fd1562dd946644953e3995be863f8a3c326678f4b64f
MD5 964bd44f031ae5d8f6162bbd08439447
SHA1 2fa7ac2ea5d9dc071a1e951b668cf1f74c965c43
SHA512 ce14baf64ce2f7afad70b544cb9fa68cea13cdd05e361dbbaa5707003106f9a399160788ab89ef7a9d27b897a56eb78cdcc249fd0f1bc76574e2fec5af3265a1
MD5 SHA1 SHA512

Submit Download

qrsqk3po.0.vb

Path C:\Users\Admin\AppData\Local\Temp\qrsqk3po.0.vb
Size 278B
SHA256 3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78
MD5 6d569859e5e2c6ed7c5f91d34ab9f56d
SHA1 7bcd42359b8049010a28b6441d585c955b238910
SHA512 accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7
MD5 SHA1 SHA512

Submit Download

qrsqk3po.cmdline

Path C:\Users\Admin\AppData\Local\Temp\qrsqk3po.cmdline
Size 171B
SHA256 7ad1eb65c1ca7dd1856b4442dbaa63bef5f25f8727137397c2cb4ef1baafb895
MD5 1633c61b87642a3abbf497a1bb72d6d3
SHA1 ff8fbc7c8f619c277e79052e2a1e4a950c2aa30b
SHA512 74e7989dfc5adc37f11a8d01fb387b0496dff9c04d1005187f060eb0c54b54406c3285a2fb37cfb49a062acd058c28d37a3657306fc30090db1e87d280270174
MD5 SHA1 SHA512

Submit Download

rono_ida.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rono_ida.0.vb
Size 288B
SHA256 2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07
MD5 af52f4c74c8b6e9be1a6ccd73d633366
SHA1 186f43720a10ffd61e5f174399fb604813cfc0a1
SHA512 c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e
MD5 SHA1 SHA512

Submit Download

rono_ida.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rono_ida.cmdline
Size 181B
SHA256 4b20af6ebddb24dd28dadea13d86990324c321e2d34d90a690030d45632dce34
MD5 4c5fec8f37d19f4aef7fb3c54fa64719
SHA1 331511dffb10c46d9bbf6879e0d6959a70c24762
SHA512 a79c7533ec1fe9a27bf0562e3aafa1bebe2f63fdff0a17369b57006f7d2187be57c0203471316fa6d73c32281a437e59e56b086c658d98d1bb3bb7be7f60afcd
MD5 SHA1 SHA512

Submit Download

t33evqb6.0.vb

Path C:\Users\Admin\AppData\Local\Temp\t33evqb6.0.vb
Size 284B
SHA256 e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7
MD5 62caeb4021ea9d333101382b04d7ac1c
SHA1 ebe2bb042b8a9c6771161156d1abdce9d8d43367
SHA512 e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c
MD5 SHA1 SHA512

Submit Download

t33evqb6.cmdline

Path C:\Users\Admin\AppData\Local\Temp\t33evqb6.cmdline
Size 177B
SHA256 236616a645c5a0cd392716ce389017b7a9ffd29ba99764105bc3cc1efda4e069
MD5 3e0b45170f96e4c0edc94eb70460d311
SHA1 2fc40935445ed2120c0c510092e1f4abc0ca94dd
SHA512 d890cdc08928a0c5e6c65959ec59b9366183a693d7b03aff4a6b7e45c6c888a484b8ca7fb9fa28378dbe0b95455405d70d9b3a7312a8b8665acf4857ff8c6ba2
MD5 SHA1 SHA512

Submit Download

tacbvfff.exe

Path C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
Size 234KB
SHA256 32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e
MD5 3d3e7a0dc5fd643ca49e89c1a0c3bc4f
SHA1 30281283f34f39b9c4fc4c84712255ad0240e969
SHA512 93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68
SSDEEP 3072:PNPoivdbbPzLHRGObm0XLqpGu+odArDvBp0Xxxyj:PNQivFPzLHRGObm0b0hx
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc34D847BFBDC54843826DFAE7445D5A2E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc34D847BFBDC54843826DFAE7445D5A2E.TMP
Size 684B
SHA256 e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
MD5 8135713eeb0cf1521c80ad8f3e7aad22
SHA1 1628969dc6256816b2ab9b1c0163fcff0971c154
SHA512 a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4
MD5 SHA1 SHA512

Submit Download

vbc3CA6F62A3FB346FA95B314FCC8DAFC8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3CA6F62A3FB346FA95B314FCC8DAFC8.TMP
Size 644B
SHA256 e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac
MD5 55335ad1de079999f8d39f6c22fa06b6
SHA1 f54e032ad3e7be3cc25cd59db11070d303c2d46d
SHA512 ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca
MD5 SHA1 SHA512

Submit Download

vbc460A16A2FD59475189CE2A8F9272051.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc460A16A2FD59475189CE2A8F9272051.TMP
Size 644B
SHA256 2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
MD5 dac60af34e6b37e2ce48ac2551aee4e7
SHA1 968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA512 1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
MD5 SHA1 SHA512

Submit Download

vbc7367F4C2F6CB4DAD8FBE21AB663DBEB.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7367F4C2F6CB4DAD8FBE21AB663DBEB.TMP
Size 676B
SHA256 f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
MD5 85c61c03055878407f9433e0cc278eb7
SHA1 15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA512 7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756
MD5 SHA1 SHA512

Submit Download

vbc82EF2D4971AA411E858BE37FA562053.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc82EF2D4971AA411E858BE37FA562053.TMP
Size 684B
SHA256 453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
MD5 7a707b422baa7ca0bc8883cbe68961e7
SHA1 addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA512 81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
MD5 SHA1 SHA512

Submit Download

vbcADA2780FB7D340ADA1B410956435D5F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcADA2780FB7D340ADA1B410956435D5F.TMP
Size 668B
SHA256 0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
MD5 3906bddee0286f09007add3cffcaa5d5
SHA1 0e7ec4da19db060ab3c90b19070d39699561aae2
SHA512 0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
MD5 SHA1 SHA512

Submit Download

yz6hu-wh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\yz6hu-wh.0.vb
Size 274B
SHA256 0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430
MD5 05ab526df31c8742574a1c0aab404c5d
SHA1 5e9b4cabec3982be6a837defea27dd087a50b193
SHA512 1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40
MD5 SHA1 SHA512

Submit Download

yz6hu-wh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\yz6hu-wh.cmdline
Size 167B
SHA256 6e0f24c3f5a5682e2e41490c62e56efa04507fc898aa548aa8de0f6160cf875f
MD5 a6436c79c9cde5b8bdd80a27379cc8b6
SHA1 e1a5b233062d7cd95fac4d4825a6ac455f9b5441
SHA512 fcd04d792575db1c9a723fcc7f8e0f68c736369bd7a5727aebe01d422c59e7d4930914f9cc10353c01d3360e8d26baed16815ced6621f2b7f1d93c73baf5a4a6
MD5 SHA1 SHA512

Submit Download

memory/2396-15-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/2396-24-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/2396-14-0x0000000074832000-0x0000000074833000-memory.dmp

Download

memory/2396-13-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/2396-12-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/2396-11-0x0000000074832000-0x0000000074833000-memory.dmp

Download

memory/4780-25-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4780-23-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4780-21-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4780-20-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

memory/4780-16-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4780-17-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4780-38-0x0000000074830000-0x0000000074DE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads