275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06

user interaction
yes
max time kernel
900s
max time network
907s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/03/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RAT/file.exe
Size 101KB
Sample260323-cffqcsds9n
SHA256 275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
MD5 88dbffbc0062b913cbddfde8249ef2f3
SHA1 e2534efda3080e7e5f3419c24ea663fe9d35b4cc
SHA512 036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
SSDEEP 1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS
TLSH
T123A34A086BEDDE29D7BD0B7D6BF5245C47B0E6436A23E70E1ED414B91A933801A027A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RAT\\file.exe"	file.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	file.exe
Token: SeDebugPrivilege	4628	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1384	4532	file.exe	91
PID 1384 wrote to memory of 3720	1384	vbc.exe	93
PID 4532 wrote to memory of 4468	4532	file.exe	94
PID 4468 wrote to memory of 3336	4468	vbc.exe	96
PID 4532 wrote to memory of 2896	4532	file.exe	97
PID 2896 wrote to memory of 3772	2896	vbc.exe	99
PID 4532 wrote to memory of 5468	4532	file.exe	100
PID 5468 wrote to memory of 4092	5468	vbc.exe	103
PID 4532 wrote to memory of 4588	4532	file.exe	104
PID 4588 wrote to memory of 3448	4588	vbc.exe	106
PID 4532 wrote to memory of 5172	4532	file.exe	107
PID 5172 wrote to memory of 5068	5172	vbc.exe	109

C:\Users\Admin\AppData\Local\Temp\RAT\file.exe
"C:\Users\Admin\AppData\Local\Temp\RAT\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bgfjun0t.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D3E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc91BADD92904B471C9848C5212D761B97.TMP"
    3⤵
    PID:3720
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7s6isrqj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6136.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26EFC863D4147498AD670C17E27850.TMP"
    3⤵
    PID:3336
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b--vqr6j.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6879.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcADCAF8F05B194B1A9F449EB94FFE7F31.TMP"
    3⤵
    PID:3772
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v9pezy3x.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B19.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3C5E197FF346437F88D12C8C8381EC92.TMP"
    3⤵
    PID:4092
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bjc9a8ex.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CBF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc75D412AA938349EEA687E6475CEFA045.TMP"
    3⤵
    PID:3448
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ifzc-tcp.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD86454AB39A74D50A0E19B9F184422B2.TMP"
    3⤵
    PID:5068

C:\Users\Admin\AppData\Local\Temp\RAT\file.exe
C:\Users\Admin\AppData\Local\Temp\RAT\file.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$Recycle.Bin.exe

Path C:\$Recycle.Bin.exe
Size 7KB
SHA256 7d6ff093fb87c74c3f5d0dca5fda2d90a750a0f1257a1d7de7a79a9678bb7585
MD5 d1c93f66dd603e69ff7690e7255e3f1c
SHA1 35964cfda9fb695477415ae29fb7f9b976bd2731
SHA512 e8e499b8b5430ab7c1d797fd11e496ccf91c803cc4a63f5999371e5360fe6c5ae65f15c9f15464eaa9558d829abc4ac7e43f8fbfa093a5b96e7f40b6cfb35d9b
SSDEEP 192:tFk3SrgbRVInlYJLLLTTuXPmCzt16+gQ+Mn:tFkCrUR7PLTCx1
TLSH
T1B4F1E51677E086E9C55A0B7358E3050A5BA0FD2CDE279B7F10A0F3B25EB205046627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Documents and Settings.exe

Path C:\Documents and Settings.exe
Size 8KB
SHA256 d3d20e4ab704e56a02506d8fb69d55b791d0d024927e94eb3c2c08fa13e4483c
MD5 728c63c105af35ecf08346e8932a839e
SHA1 713db2d2b9b6f83f57cbed5685014f8670ce36d0
SHA512 d7c479b4e48803fbd6064bee4b948450bda8f14e4ce5ded484f1412f5e0ad32657538163188527e29b0d93d719a5f016de4c3b979efbf9b2b82feeefd5c2f7ec
SSDEEP 192:otk3UrgbRVInlYJLLLTTW3PBj16+gQ+Mn:otkkrUR7PLTgj1
TLSH
T16EF1F61677E086EAC55A0B7354E3410B1760FD2CDE27AB3F14A0F3B25DB245046A27B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfLogs.exe

Path C:\PerfLogs.exe
Size 7KB
SHA256 59c2c7010de288be6e47db3fc6dfbe4e8d067392882ab03390f8d9e45bb0ccd2
MD5 7215a5b8067e2484b5ce84aa8431cd7f
SHA1 ae15de481d866b478334f77eae31356c3b633f4d
SHA512 603c5379d381452208c0b6d5fc6d643d1e51c0faa0e72883652a2218c8dd3e44d447233488741601f3191011b71513b7ffc8af08b17e0d95c77a1358b1a4eca1
SSDEEP 192:c1k3mrgbRVInlYJLLLTTVPtX16+gQ+Mn:c1kWrUR7PLTHX1
TLSH
T15BF1F72677E086FAC51A0B7358B3414B57A0FD28DE63AB7F14A0F3B25EB20504662773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Program Files (x86).exe

Path C:\Program Files (x86).exe
Size 8KB
SHA256 43ceb0ea0bce83022ea2939e9aeb091d5482ed72443e1690d63bfbfbc986f97a
MD5 fa18c2b5db11a0c522f537a535aa0b28
SHA1 2e29a27e06f3bf6c96086f34fccb63afd2dc54e8
SHA512 5660050a3c5b6a20f3f9a9b29682d4a81a37bbaf14d3efb1dc66d2ca4182b5c6dae82a0641384182a95ae4c739ff1fdbcc76baf3957c8f50da01611ca4d74c5d
SSDEEP 192:bdk3RrgbRVInlYJLLLTTLP1v16+gQ+Mn:bdkBrUR7PLT9v1
TLSH
T1F8F1E6166BE086E9C55A0B7359A3040B1760FD28DF67AB7F10A0F3B25EB206446627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xblRvZwfR.ico

Path C:\ProgramData\RevengeRAT\xblRvZwfR.ico
Size 1KB
SHA256 11b5a0730666935c78d22b379f83ea5fc30d1afdea09a796b4f18b38a1e1ef69
MD5 42d552558e7e6f7440b2b63a6cde217f
SHA1 9c8fa01060f667cf3b0caad33e91fa59e643cf76
SHA512 e6a6dc1239b9668e7ffc883b3cf46aff8c9f86ef11ae975f6fb65531d8b9313acd7608272042e322fad415a45c0cf767252d2c620ad066e6809656af0f09441b
TLSH
T1FD2128423BA099D8C0100E73B45B944E27487CFEDD4086A630B4FBBA2EB64B105A56B7
MD5 SHA1 SHA512 TLSH

Submit Download

Recovery.exe

Path C:\Recovery.exe
Size 7KB
SHA256 86e6cbda736f938462975f8eeb5595273b7edd4d731688603629786a26b1553a
MD5 f55db9b61a32166a0c4c807837113b83
SHA1 bf6e24568f695d694a2723afdd0ae95e3f8bbbf2
SHA512 dcc7739d4779def7df3b1cda92eaf2640e182c4b4ad599885795afe4f58a94217528b8f1edcbcc27e95e4b96c6b4bcd1e93d7405ad93363f4eb31e83c13380b3
SSDEEP 192:B1k3mrgbRVInlYJLLLTTzPuk16+gQ+Mn:B1kWrUR7PLTek1
TLSH
T1A1F1E62677E086EAC55A0B7358E3400B5760FD28DE53AB7F24A0F3B25EB20644662773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7s6isrqj.0.vb

Path C:\Users\Admin\AppData\Local\Temp\7s6isrqj.0.vb
Size 359B
SHA256 2bb58efd5e05b869678e245802cefdc4f9e24c8f1ff5c0d44fe12f398f7e045c
MD5 f2eb66522e81f5808c8794592b7d0cc3
SHA1 d10227a9de168dbb33ddd6663c14bae72ec45191
SHA512 a9bdbc6466c144d3867778260dc971dede176983c38c9b3bf1c2fd95c46f6dca25acbf42dd57f727fff2a29252eb63cdfcc44cba8ced86c672f42d00c2d45670
TLSH
T136E0C0F3712183064F4D3853D99259041DBF0BF633945C4800CC2188CF17270DB76297
MD5 SHA1 SHA512 TLSH

Submit Download

7s6isrqj.cmdline

Path C:\Users\Admin\AppData\Local\Temp\7s6isrqj.cmdline
Size 213B
SHA256 c98d57aed2ad8d0e70a42888d8291f7c7e4fff3ff120ffa03be6ed83e07a800b
MD5 6fee5be3deddf1402354ae2aaeeb12ad
SHA1 772fb12b2657f2f9f41f806c758b7f68a2792ada
SHA512 9155fde1b2b67a08062904f214e0c7325298dcdadf2abf4288bffefc16edd3484a9b3dd1d8b34f9c5ade0390ef4ababde2e71c38236ed06ad1839b071dc97340
TLSH
T15FD02301134746CC4BFB600D87BAC15C4372CC3F79953A1D1444954D59326453771546
MD5 SHA1 SHA512 TLSH

Submit Download

RES5D3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5D3E.tmp
Size 2KB
SHA256 a1f96d248ded037ddb65c6f385a1bba67143897cfadbdb87f87ca5e17943fc71
MD5 63c63a6de18eccee65f71200b1b8abc2
SHA1 0393feaaf9cc0da38ba1d78df162621031768c26
SHA512 7ea2bbd912457108ceefca6c6cec9780e9ed65df917fd70fab18f2cb3f9045887fdafad111107123cb1714caf9853c49df0951ddc9b546dae7aa0cbf2b58f32e
TLSH
T161516E0637E48AC9D0210B33B4E7561F6714BCFCDD50836B65A0F77A2DB25A09A90AB3
MD5 SHA1 SHA512 TLSH

Submit Download

RES6136.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6136.tmp
Size 2KB
SHA256 abc258d9c6e8eecea28864cfdb44a3fbc48cbc81248674d00b2f948b2accfa04
MD5 a8e48f53d1ab70b783a525711eaadde7
SHA1 3f8b31232bf97f87e646f0206af8841332b7574b
SHA512 2777e5271d25af1aafc856a8adcb9347fcf4634d5ac99caa2eed384965dc374b867dbaf70c2edf28027f1c12ad9dfc9327d73954dae0c3b98054a5a74ea4ef83
TLSH
T15D516B4237E489C9E0210B33B0A7560F6714BCBCDD51C36B65A0B7792D725A08A91AB3
MD5 SHA1 SHA512 TLSH

Submit Download

RES6879.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6879.tmp
Size 2KB
SHA256 8ac0c09ca3f1f2ed6e768ed32d6fa8ea7c13c6a21fcb696e6cbce629cff73f3b
MD5 5e2dda098c52e7cf3c698cc8ce31d978
SHA1 13190654444572f3077acccaf3eaf39423c8fd0e
SHA512 f166380d3cb651e2d45f1950d7c153c3cae16e00ec132e40e617aee4cd09d2a5bebfaa6284d22f090a9f7551883eed8c2134ec8642bf92271ea028dbaacea6a1
TLSH
T1D8517C0637E489CDE0310B33A4A7560F6714BCFCDD51836B25A0F7B92C724A05A916B3
MD5 SHA1 SHA512 TLSH

Submit Download

RES6B19.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6B19.tmp
Size 2KB
SHA256 45ba3a3c590c378e32522982eef848aa8c3f8583ad4721457dff57fe15a359dc
MD5 bbf58106a18f3f8ecc0ff04439379a5e
SHA1 4c0c52054c0cb2c15839e3f9a95e41f96ff0f22d
SHA512 37f685c4b529467b72044cf6d15f30fbf1a77ec3c27475efafaa9c690b44f6a1376807edc63f698f06e8d35da848208fc60d1fc7e91e2f11d45619ffd7f47119
TLSH
T11E516F013BE489C9D0710B33A4E7560F6714BCBCDE60836B64B0F7792D720A04A917B3
MD5 SHA1 SHA512 TLSH

Submit Download

RES6CBF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6CBF.tmp
Size 2KB
SHA256 c992a68c18b717f3e0cb6f5105696f4666f96f177c16c83396c98360e9d73d19
MD5 559a9cfdc32a1497bc751419e576931b
SHA1 cdd346c50e2c005b679fb783f136278eef74f15d
SHA512 95c6f08aa4f573090bee466cb09963f7c90536f3cf0b3de4223e5d7b6b33df15612587e601e7ba992c251ad9ce7bbdc9bd8a4991f6a2cb581580a1b192ab516e
TLSH
T1DF515F0637E48AC9D0210B33B4E7560F6714BCBCDD91C36B64A1F7BA2D724A09A907B3
MD5 SHA1 SHA512 TLSH

Submit Download

RES6E07.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6E07.tmp
Size 2KB
SHA256 8d26510904943e345189d99627cdd1af2fc10f0e11f230c12ad0a92c0d8d8189
MD5 90f195be3e71f3a3a04c424da1c972f8
SHA1 0720ddc37b91d32f411e039a310e45c20d3fd814
SHA512 d3d340b27d9e77f641b845366f937a94f226a36080a9eb624ad355965824bb4ef972a09b971da51c8b87056ee111190083d5925ba6b366934717b6ceee67e7be
TLSH
T17F514D0237E48AC9D0210B33B4E7561F6718BCBCDD91837B64B0F7792D721A09A916B3
MD5 SHA1 SHA512 TLSH

Submit Download

b--vqr6j.0.vb

Path C:\Users\Admin\AppData\Local\Temp\b--vqr6j.0.vb
Size 345B
SHA256 412137881e3f3de959a2d007b4a2b49d052571353f8a974010255f4c0f044082
MD5 c8f33b81180ae953e6e8d5451208e55b
SHA1 14619702dbbda508a22d62240d7fe49aa3f1df0a
SHA512 3a23ba1d02585d081c3f9c95625fdf7bf2a0947ebe40ec6352b581b39171a9710f8934b4600954f658c957ff889f270af2cdf8dfccfca35a61ec408fc8eb5a96
TLSH
T18AE020B3B52187124F4D3857999159445DBF0BF623945C4901CC2189CF17574D776297
MD5 SHA1 SHA512 TLSH

Submit Download

b--vqr6j.cmdline

Path C:\Users\Admin\AppData\Local\Temp\b--vqr6j.cmdline
Size 199B
SHA256 ffed21295ec2e06132aa34eaeece6d4a1b7dd6e0c2511a0ef21c4af4c71749c4
MD5 70548215f9932f2e04f8e2b9598347e3
SHA1 e6eeff5aecd12f5b271fc027a0457b059f6df0b3
SHA512 b79df5e81c67cb10805fbf7a7d944dd09db37358b3f36ff505589d4eeb690971d18fa3a3c2cea2506fa4b7c86d624e2ae92ab16fc77dc13eb838ae83629b1c35
TLSH
T185D02201538B8B846BFB600E4AA9C25CC3629D2F29883A1D0481894E91226083662545
MD5 SHA1 SHA512 TLSH

Submit Download

bgfjun0t.0.vb

Path C:\Users\Admin\AppData\Local\Temp\bgfjun0t.0.vb
Size 349B
SHA256 a615fea96d0b746bc79189352ba83103cdd3ee700f361ce0621ed4ff46aad4ad
MD5 7e8dc285e017cea4559ce6031c044024
SHA1 7e87c47b4441e938d993097906d0d78d321569c6
SHA512 c6e83f3bd083b0aeda81f08225732ba4952ddb479aa5c7923e1bccbb532832815c13b6ac264550b03b57d4ba0b0debd1a7d2c03acb41c31b317936d914c09950
TLSH
T15FE0C0B3702083124F5C3CA3C9D1590418BF0BF623941C0801CC2188CB17174DB2629B
MD5 SHA1 SHA512 TLSH

Submit Download

bgfjun0t.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bgfjun0t.cmdline
Size 203B
SHA256 5e4738d79c5de1f56280d5d23c0fb5b3edf48cc87d4e1d16b8363bf40e7dd07c
MD5 5d4987493f9e00eaa3f8c0d2afcecf9d
SHA1 772ac6af25427a7de7899ff4c04546b96b775457
SHA512 0f20092e586fc5aff05270a20e10ad080fe98c281afec36fe56a565a3c51030fdbe66fec62b830fb382d8b0f04c2566455a7ee36d2d8b9e56d3f5618b7d1de2a
TLSH
T177D0220023478BC85BFA601A82E9C25C83639C2F2A8C3B1945818A4CA562A483B22989
MD5 SHA1 SHA512 TLSH

Submit Download

bjc9a8ex.0.vb

Path C:\Users\Admin\AppData\Local\Temp\bjc9a8ex.0.vb
Size 345B
SHA256 401083c6f8135c71830c9fa258e49863523c1459e6c1e59a3e574cb0a8a41646
MD5 cd6c54181a29d34a9c388ae8b2bac97a
SHA1 842877924fe997161aad06beb122b4d7ad7025ff
SHA512 7d78bc9b75dadb1e69cd6fa3f529286f4fe4c240a76b7332a6df93e77a90d605d9012bda9b6b52b42cf7ee027d250afff53b74ca34fed01487220e74db68e199
TLSH
T10DE0C0B3702083024F4C3853C991580419BF0BF623941C4804CC21C8CB17170DB272AB
MD5 SHA1 SHA512 TLSH

Submit Download

bjc9a8ex.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bjc9a8ex.cmdline
Size 199B
SHA256 b81c670e785683eba350135c933322b1d2fcc5d2f33680c364febfc76c8f2401
MD5 2bb708dfc95bb4a34badeaa96a800b5d
SHA1 84ea9f2160cd1f18794a3be80f49df04d7b8a5f1
SHA512 d801eeeba871cbfe6ef2c6c3ec393adac501d3e7c75fbde883245460055d9c1e23090cf68e69b31196f1c255c2d81998fd19b2812c6410442e801babd3fa94ed
TLSH
T1AAD022001357CA845BFF200B83EDC2AC83638D2F69887A6D4D80988C96222053622659
MD5 SHA1 SHA512 TLSH

Submit Download

ifzc-tcp.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ifzc-tcp.0.vb
Size 349B
SHA256 f76e8960b34bb917632dc6cb47cf1c69b53a7b9b5e58a5ccbcf9a099cacc2c99
MD5 f1405abb8e9f89c7517c03f3ecec1564
SHA1 c37550afa9762b44f9c82c852d021ab3624e6ded
SHA512 90819d8cd3fa47e8ac2e79f8abff7ef4f4692185d7ca65fd45cb9144ea335dc92fca5308ae369407f288a40e6d488082a1e89fda5c59c5e5725a80ac76d04733
TLSH
T1F2E0C0F3702187024F4D3C639991580418BF1BF623941C4800CC2288CB17170D76B29B
MD5 SHA1 SHA512 TLSH

Submit Download

ifzc-tcp.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ifzc-tcp.cmdline
Size 203B
SHA256 96e46cb9905b4c6bb6cfc10b01b456e0721c8561be0a3c0e46dc7b1a7f51f22a
MD5 24ccdfdde02758cd59536f829e108ab6
SHA1 213eebe317550c94a82e4324f6e91d356ffaee70
SHA512 1cc0c65bf96f5a6f1b3c896d4d6d96b7ec3fa4af01da951a81dce4a86ae97c7141ac333b641f88cc83117a61aa6cf87e82956421ada4eeec05af6af9b7f14f80
TLSH
T15CD0220103878FC447FB201A42F9C16CC332CD2F28893AA949C1CA4CA52721537B2A49
MD5 SHA1 SHA512 TLSH

Submit Download

v9pezy3x.0.vb

Path C:\Users\Admin\AppData\Local\Temp\v9pezy3x.0.vb
Size 356B
SHA256 069e4022d9d8a43c9b2fd85a75458624f29235262ebc1efc889d2cd64ed18d27
MD5 86c68da5eca3f86e9afd81f7e9a34a23
SHA1 e0d5a1b459cc26d07f190de7c53adda1be1bd28e
SHA512 5c54931607ea8ab16c1ab3c36154b81e4ef66a30bb9d911e21ed1c0914b88f097f3e5d4056120daeb8c07698c41f8865e792c05673876ccc3aab419f9c9aa1b4
TLSH
T190E068B3602182424B4938939A91580418BF0FE633941C0901CC2289CA17170976A2A7
MD5 SHA1 SHA512 TLSH

Submit Download

v9pezy3x.cmdline

Path C:\Users\Admin\AppData\Local\Temp\v9pezy3x.cmdline
Size 210B
SHA256 9c9b657682ccd2d9535d1be86ae1f9a8463c9c994a8139ae0ddf4ef1baae657b
MD5 9a5ca8c50b0a6381aaf8331832948d19
SHA1 3c10225764db66484a894c8bcfe9789fd4d55ed3
SHA512 f3103495eb0bee8a79fe9650eb537a6749b7a80f6cb118484dc09621c6b616fb478381534f0685fd723a4dccdb4b98635d904be0710edbb008f63a946e9a5b98
TLSH
T1C4D023000357C7C457AB600957DDC55C4372CD1F759836290580994D91A2B5537B1547
MD5 SHA1 SHA512 TLSH

Submit Download

vbc26EFC863D4147498AD670C17E27850.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc26EFC863D4147498AD670C17E27850.TMP
Size 1KB
SHA256 5259fea78d4db203e2d10c628fd91519ac4e99b602753290889dba1ccec56c8d
MD5 1e1accabea11b2f2b119e3cd0dfb189f
SHA1 36f01d204ad1691c3b38d727bd6029f1ea4ed787
SHA512 3599231c75bce9cba236352af0bdc16c36e537e48812f0a4e0b0748d653f2e6860819952bf512b273bbcf3dd3939c6b129c283f31539d576a257ceafe9f53764
TLSH
T11241E94637E485C9E0720F73B4A6424F6654BCBDDD6183AE34B0B7BA2C715604661BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbc3C5E197FF346437F88D12C8C8381EC92.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3C5E197FF346437F88D12C8C8381EC92.TMP
Size 1KB
SHA256 36ac27154a7c665d75d189b50f8f91bb705a9bd7fce0e467fe7b6852fc6e77b1
MD5 4cddbc51aa87a8da871ff6d3e264e11f
SHA1 8315122c35faeb53d9aee9043368cee0cb8ca91e
SHA512 f4bd8b62c5392ad9bcd567d5c7c63f6ca93d447482ec1c37bcd669f1af4b96c9c3d3466b0e1d7d82130fe18457b8e2d8ac6459d2b6d10f75b744a13b78c56716
TLSH
T1A5410A423BE485C8E0620F73B4B7524F6258BCBDDD6183AA34B0F7B92C714614565BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbc75D412AA938349EEA687E6475CEFA045.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc75D412AA938349EEA687E6475CEFA045.TMP
Size 1KB
SHA256 61635a41485be5ef65a9cbf21e06501f2457f5382bd29ea9ce2901a5b7408774
MD5 cbff7107f47a4ac55a18af6c6710c34c
SHA1 65bec7fe045adc005d55dbcc3bf23179ea678cc6
SHA512 69a0c9e126cd7cda50da6366bf2f44da55e93b0d7f0c78e791ecc89d9e28d345e3c08b7292138fcb36aff0ac506f15f5d3262f8174b09909dc55a0e6405670fa
TLSH
T1D641D84637E485C8E0620B73B4B7424F6658BCBCDD6183AE34B0FBBA2C714604591BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbc91BADD92904B471C9848C5212D761B97.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc91BADD92904B471C9848C5212D761B97.TMP
Size 1KB
SHA256 7e3353bb1fd38d66a53bfcecf5bebe8d9052916abccc7d96ea241541c9af8610
MD5 19ef61b3387a71ede7704efd63a111d8
SHA1 d6fc5831d1eb4e6ec09bbceac14d1858bf95108b
SHA512 658423fe5ea03091f5688c816d8a3a14e5b33fe9785c7d8112c1faa797bf73941e76c7682cc7b0a05a40770ff062a65d2798e64d401c47f80d90f2b1f286f88a
TLSH
T16241D8463BE485D8E0620F73B4A7425F66487CBDCD5183BE34B0BBBA2D714614561AB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbcADCAF8F05B194B1A9F449EB94FFE7F31.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcADCAF8F05B194B1A9F449EB94FFE7F31.TMP
Size 1KB
SHA256 05cd4041b325837f2290bd65e2c160ea91241339e4c53fe29b243542df417ade
MD5 b7370f71606afbaf01745643bc55db56
SHA1 9cfc962aef724cfd27b4d0a1f9c9990fe840eb0b
SHA512 5591c8fc1a7ae23bfda9872fcc5c7c5c5d8b668996b280a027bd18dd930edc0d812548185bea1e426f71ec0783d75719066df345ec95d1f92af938f98887495d
TLSH
T10141C74637E495D8E0620F73B4B6424F6258BCBDDD6183AA34B0FBBA2C714604561BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbcD86454AB39A74D50A0E19B9F184422B2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD86454AB39A74D50A0E19B9F184422B2.TMP
Size 1KB
SHA256 3bac257a86632110fff75cae8c9d784afdf9522706d397ae086ee6b19d4a955d
MD5 20ef8f695fed113f459624133aa73992
SHA1 f0aaf3ce1967b5ae8c7031fbe930b1a7e3142bda
SHA512 bd1c8d57ecff5a5dc3940307775f36771627ce0b4b228b6a6a56ef3b0659cb2f9cb1c9e754d4f805bfc094dc44cbe06072e8270363fbb7f43b246202049d1a5a
TLSH
T19B41DB4637E495D8D0620F73B4A7825F6248BCBCDD5183BE34B0BBBA2D7146145A1BB3
MD5 SHA1 SHA512 TLSH

Submit Download

$RECYCLE.BIN.exe

Path F:\$RECYCLE.BIN.exe
Size 7KB
SHA256 9ffa9c3d3999ede27d8048f925de5de9705b9a5edb01085b53800ecfd01fc1bf
MD5 0c880ea06923d43b1b7176ee48a5cf34
SHA1 adb4d00268c7118d68e926f352b6117718bcbf22
SHA512 c24cd06de416cfe9b99d60347e7cebbb79aab4590faad972d08d8e796b7238bb9a85e3f34c1c4707d507d302a66d5f884f73cc08d731fa23d0111f844809c0c7
SSDEEP 192:hFk3SrgbRVInlYJLLLTTujnPmCzt16+gQ+Mn:hFkCrUR7PLTw7x1
TLSH
T136F1D61677E086F9C5590BB369A3440A5760FD2CDE579B7F14A0F3B25EB205006627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1384-27-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/1384-38-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/3336-51-0x0000000000420000-0x000000000042C000-memory.dmp

Download

memory/3448-91-0x0000000000530000-0x000000000053C000-memory.dmp

Download

memory/3720-35-0x0000000000530000-0x000000000053C000-memory.dmp

Download

memory/3772-65-0x0000000000460000-0x000000000046C000-memory.dmp

Download

memory/4092-78-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/4468-54-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4468-48-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-8-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-15-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-16-0x000000001B670000-0x000000001B67C000-memory.dmp

Download

memory/4532-12-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-11-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-10-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-18-0x00007FF991945000-0x00007FF991946000-memory.dmp

Download

memory/4532-21-0x000000001CED0000-0x000000001CF6C000-memory.dmp

Download

memory/4532-14-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-9-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-0-0x00007FF991945000-0x00007FF991946000-memory.dmp

Download

memory/4532-13-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-7-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-6-0x000000001C0F0000-0x000000001C152000-memory.dmp

Download

memory/4532-5-0x000000001B5B0000-0x000000001B656000-memory.dmp

Download

memory/4532-4-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-3-0x000000001BB60000-0x000000001C02E000-memory.dmp

Download

memory/4532-2-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/4532-1-0x00007FF991690000-0x00007FF992031000-memory.dmp

Download

memory/5068-106-0x0000000000840000-0x000000000084C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads