njrat | 11ebcd4828f455914e1395f0b81bd7a3fb1740f65fb147a1c77c655a4ed35fb5

Analysis

max time kernel
60s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/04/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NjRat 0.7D Green Edition by im523.exe
Size 3.4MB
Sample260411-plwd8afs5m
SHA256 11ebcd4828f455914e1395f0b81bd7a3fb1740f65fb147a1c77c655a4ed35fb5
MD5 6b362923512bfa953322e419d9629c1a
SHA1 02b62a509a4877697c354245f37316ad6376111e
SHA512 5c659e84463af51283e84621c632a242bd4a593157a9c1bfd0d7c65637387b3675546ef087cd6b94d5138c4a402041575d115f633ccfbd006ae0bc51e240f771
SSDEEP 98304:znsmtk2axDDKR1gCQw0nL1mXE2Gw9pk6NQ:LLSWJQw0nL1mXE2T9pk1
TLSH
T15EF51232F2D18477D1331A3C8D6BE3B5982ABF902E34790A7BE51E4D9E396812D152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery njrat xred persistence privilege_escalation trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Njrat family
njrat
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
484	netsh.exe

Executes dropped EXE 21 IoCs

pid	Process
5772	._cache_NjRat 0.7D Green Edition by im523.exe
1008	Synaptics.exe
4852	._cache_Synaptics.exe
6136	Synaptics.exe
4952	Qhubjhdcoc.exe
3932	Fenxqce.exe
3372	._cache_Qhubjhdcoc.exe
1640	._cache_Fenxqce.exe
5348	._cache_Synaptics.exe
272	Smshrwygllw.exe
4620	Lmnesatik.exe
5708	Qhubjhdcoc.exe
2456	Fenxqce.exe
2288	._cache_Smshrwygllw.exe
420	._cache_Lmnesatik.exe
5804	._cache_Qhubjhdcoc.exe
1600	._cache_Fenxqce.exe
3172	Smshrwygllw.exe
6016	Lmnesatik.exe
4476	._cache_Smshrwygllw.exe
2644	._cache_Lmnesatik.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	NjRat 0.7D Green Edition by im523.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\._cache_Smshrwygllw.exe	Smshrwygllw.exe
File created	C:\Windows\SysWOW64\._cache_Lmnesatik.exe	Lmnesatik.exe
File created	C:\Windows\SysWOW64\._cache_Smshrwygllw.exe	Smshrwygllw.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Lmnesatik.exe	Lmnesatik.exe
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File created	C:\Windows\SysWOW64\._cache_Qhubjhdcoc.exe	Qhubjhdcoc.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Qhubjhdcoc.exe	Qhubjhdcoc.exe
File created	C:\Windows\SysWOW64\._cache_Fenxqce.exe	Fenxqce.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Fenxqce.exe	Fenxqce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Smshrwygllw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat 0.7D Green Edition by im523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Fenxqce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Smshrwygllw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Lmnesatik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhubjhdcoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Smshrwygllw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Lmnesatik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Fenxqce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fenxqce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fenxqce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Smshrwygllw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmnesatik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmnesatik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhubjhdcoc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	NjRat 0.7D Green Edition by im523.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Qhubjhdcoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Fenxqce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Fenxqce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Smshrwygllw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Lmnesatik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Qhubjhdcoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Smshrwygllw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Lmnesatik.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4712	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe
1640	._cache_Fenxqce.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	._cache_Fenxqce.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	._cache_Fenxqce.exe
Token: 33	1640	._cache_Fenxqce.exe
Token: SeIncBasePriorityPrivilege	1640	._cache_Fenxqce.exe
Token: 33	1640	._cache_Fenxqce.exe
Token: SeIncBasePriorityPrivilege	1640	._cache_Fenxqce.exe
Token: 33	1640	._cache_Fenxqce.exe
Token: SeIncBasePriorityPrivilege	1640	._cache_Fenxqce.exe
Token: 33	1640	._cache_Fenxqce.exe
Token: SeIncBasePriorityPrivilege	1640	._cache_Fenxqce.exe
Token: 33	1640	._cache_Fenxqce.exe
Token: SeIncBasePriorityPrivilege	1640	._cache_Fenxqce.exe
Token: 33	1640	._cache_Fenxqce.exe
Token: SeIncBasePriorityPrivilege	1640	._cache_Fenxqce.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
420	._cache_Lmnesatik.exe
2644	._cache_Lmnesatik.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
420	._cache_Lmnesatik.exe
2644	._cache_Lmnesatik.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4712	EXCEL.EXE
4712	EXCEL.EXE
4712	EXCEL.EXE
4712	EXCEL.EXE
4712	EXCEL.EXE
4712	EXCEL.EXE
4712	EXCEL.EXE
4712	EXCEL.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5772	3452	NjRat 0.7D Green Edition by im523.exe	79
PID 3452 wrote to memory of 1008	3452	NjRat 0.7D Green Edition by im523.exe	80
PID 1008 wrote to memory of 4852	1008	Synaptics.exe	82
PID 5772 wrote to memory of 4952	5772	._cache_NjRat 0.7D Green Edition by im523.exe	84
PID 5772 wrote to memory of 3932	5772	._cache_NjRat 0.7D Green Edition by im523.exe	85
PID 4952 wrote to memory of 3372	4952	Qhubjhdcoc.exe	86
PID 3932 wrote to memory of 1640	3932	Fenxqce.exe	87
PID 6136 wrote to memory of 5348	6136	Synaptics.exe	88
PID 3372 wrote to memory of 272	3372	._cache_Qhubjhdcoc.exe	89
PID 3372 wrote to memory of 4620	3372	._cache_Qhubjhdcoc.exe	90
PID 5348 wrote to memory of 5708	5348	._cache_Synaptics.exe	91
PID 5348 wrote to memory of 2456	5348	._cache_Synaptics.exe	92
PID 272 wrote to memory of 2288	272	Smshrwygllw.exe	93
PID 4620 wrote to memory of 420	4620	Lmnesatik.exe	94
PID 5708 wrote to memory of 5804	5708	Qhubjhdcoc.exe	95
PID 2456 wrote to memory of 1600	2456	Fenxqce.exe	96
PID 5804 wrote to memory of 3172	5804	._cache_Qhubjhdcoc.exe	97
PID 5804 wrote to memory of 6016	5804	._cache_Qhubjhdcoc.exe	98
PID 3172 wrote to memory of 4476	3172	Smshrwygllw.exe	99
PID 6016 wrote to memory of 2644	6016	Lmnesatik.exe	100
PID 1640 wrote to memory of 484	1640	._cache_Fenxqce.exe	101

C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\._cache_NjRat 0.7D Green Edition by im523.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_NjRat 0.7D Green Edition by im523.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Qhubjhdcoc.exe
    "C:\Users\Admin\AppData\Local\Temp\Qhubjhdcoc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Qhubjhdcoc.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Qhubjhdcoc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Smshrwygllw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Smshrwygllw.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:272
      - C:\Users\Admin\AppData\Local\Temp\._cache_Smshrwygllw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Smshrwygllw.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Lmnesatik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lmnesatik.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\._cache_Lmnesatik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Lmnesatik.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:420
- - C:\Users\Admin\AppData\Local\Temp\Fenxqce.exe
    "C:\Users\Admin\AppData\Local\Temp\Fenxqce.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Fenxqce.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Fenxqce.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\._cache_Fenxqce.exe" "._cache_Fenxqce.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:484
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    PID:4852

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Users\Admin\AppData\Local\Temp\Qhubjhdcoc.exe
    "C:\Users\Admin\AppData\Local\Temp\Qhubjhdcoc.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\Windows\SysWOW64\._cache_Qhubjhdcoc.exe
      "C:\Windows\system32\._cache_Qhubjhdcoc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Smshrwygllw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Smshrwygllw.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\SysWOW64\._cache_Smshrwygllw.exe
        
        "C:\Windows\system32\._cache_Smshrwygllw.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Lmnesatik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lmnesatik.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6016
      - C:\Windows\SysWOW64\._cache_Lmnesatik.exe
        
        "C:\Windows\system32\._cache_Lmnesatik.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Fenxqce.exe
    "C:\Users\Admin\AppData\Local\Temp\Fenxqce.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\SysWOW64\._cache_Fenxqce.exe
      "C:\Windows\system32\._cache_Fenxqce.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1600

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 3.4MB
SHA256 11ebcd4828f455914e1395f0b81bd7a3fb1740f65fb147a1c77c655a4ed35fb5
MD5 6b362923512bfa953322e419d9629c1a
SHA1 02b62a509a4877697c354245f37316ad6376111e
SHA512 5c659e84463af51283e84621c632a242bd4a593157a9c1bfd0d7c65637387b3675546ef087cd6b94d5138c4a402041575d115f633ccfbd006ae0bc51e240f771
SSDEEP 98304:znsmtk2axDDKR1gCQw0nL1mXE2Gw9pk6NQ:LLSWJQw0nL1mXE2T9pk1
TLSH
T15EF51232F2D18477D1331A3C8D6BE3B5982ABF902E34790A7BE51E4D9E396812D152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_Smshrwygllw.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\._cache_Smshrwygllw.exe.log
Size 319B
SHA256 8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6
MD5 2a0834560ed3770fc33d7a42f8229722
SHA1 c8c85f989e7a216211cf9e4ce90b0cc95354aa53
SHA512 c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82
TLSH
T1D0E072303732D0C408213B140C013FDA21EF035B67A8EE0C1610038DDC2A663EB016E2
MD5 SHA1 SHA512 TLSH

Submit Download

._cache_Qhubjhdcoc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\._cache_Qhubjhdcoc.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

._cache_Fenxqce.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Fenxqce.exe
Size 37KB
SHA256 2684fe311f3f699837db2656df0fbdd4cdf20c75a985f5781d6164ccd2dada93
MD5 5101955d99970bc9840c7a4015852472
SHA1 8b95f4ffaeb87140a8e9c7700e2cb7a75687f5e1
SHA512 7652d4762f0632660472d61e07c3a3457d1c379b5856383b002085810338aa86817506a2896b22546b0d6dca7014d218ece7a1dd942f969835097d199869b010
SSDEEP 384:nz0MIiej3CVLO309QmykrtMR2tY2Nf4v+6IyrAF+rMRTyN/0L+EcoinblneHQM35:ztdGdkr2RgJ4G67rM+rMRa8Nufat
TLSH
T1A3032A4D7FE181A8C4FD067B05B2D41207BAE04B6E23DD0E9EE564AA37636C58B50AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_Lmnesatik.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Lmnesatik.exe
Size 1.6MB
SHA256 f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580
MD5 1033c448810d3b507423546432e2f502
SHA1 2bf9d04f68ed15b957378fb95daa78c85d5b2b26
SHA512 aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44
SSDEEP 12288:ouicuiPszLSDeMFFFFFFFNPjiRfbljmYpNk1Yt6JwpwqVcTeec7neIjjpL:ouicui0zLSDRPjiRfzUcpcNgD
TLSH
T176850B03B343EA54E97812F46105CFA052696E4E9178C1F639AC3B79FBDA8D1BD853C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_NjRat 0.7D Green Edition by im523.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_NjRat 0.7D Green Edition by im523.exe
Size 2.7MB
SHA256 bb402b6f1dbd7c9ec36506e9cce1180ddeef1762decce80ef841ce8cb358365a
MD5 f71c9f0521f235543edd006662bd2518
SHA1 e7c0d83f62ae04cb736dcdd0dad8680650a2ae17
SHA512 dfeaf6bb9b69e7f7133a946b61ef0a063a025412dcddd084b7c39126f219d868b8872df272d767c9fe7116f96a5e45ece9226660829c09c867bffd7eba108ef4
SSDEEP 49152:P+CCujPtGS8DVPHdbmR1rkC/B2wKw0MD2/L1mXsT2GHQ4ipkgqx3MAlcN:YDDKR1gCQw0nL1mXE2Gw9pk6N
TLSH
T115D533F84ACEDCC9CE4EB7B9DBA1E33656424BE0E730E41487C358B9B880D916E11E55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_Qhubjhdcoc.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Qhubjhdcoc.exe
Size 1.3MB
SHA256 6f33b0e47c75a18551d5a65bb66406dba216efea1808df83d871d5e9ab8283ae
MD5 dbb7dee9bf142a34d11291f2f4be8cca
SHA1 0737cf41d2773799c2b6c0aa844391f29ee5be5f
SHA512 4eb0705b2fd28c80d91ceef2e7842c205d667939452c491e9e85099a70924344d9c36227852ec1a333730c982bbbef09a8c45760bca096dbe33dc84e6dc9705a
SSDEEP 24576:+M/5XnQLCWTcLeB/Kmy+fPyIyfWaoGJa2OhtgCyPvcSB0F://5XSTz/Kmy+PoWqaLh+CCu
TLSH
T1A75533E48B8ECE68C70A61F5A761DA3397514FC6E6F0EE0A51CA192FF440ED92453F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B6685E00

Path C:\Users\Admin\AppData\Local\Temp\B6685E00
Size 23KB
SHA256 0d0cfc6e8aeba0b577db43021110d7622a351b708509fb299bc701cb97a457f3
MD5 b86ca3d1ef8a2e2ee5485fd38e5d8d19
SHA1 2c8204d2414114028dc35e112e9f4890bce71492
SHA512 48ac60089b125aebdca2773ebc1395327a724496f38002e6ad14f5dead01f1b3d384848d231f0bd18a7f3227bcd0611dcb48cf12008ae4e90479f56e9d0340fa
SSDEEP 384:M9yJKyA5yXR1p+o5bEhKt8rHIcY5oyieVRUoF0QdQsD1hqRNs1dOHC:MwJKyq+R14o5bEdHzYGeTUizegwioC
TLSH
T179B2D02C517998CDE8F92C3DAD050A79F41021EBA686BCDF1682B2585B617DB27FB1C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fenxqce.exe

Path C:\Users\Admin\AppData\Local\Temp\Fenxqce.exe
Size 790KB
SHA256 35880c12067d6d881eede9a62e2ff1a6f57237262ee0e77126cbda767be2760e
MD5 714fb7821008c495027ef029c70cc7b5
SHA1 d7561361185758c67251b87f79c2d46963d884b1
SHA512 e45ffc4cae2a92f54ba96b10d8b9925e04b537ecfcd82887904b5da80a18dfcdee0d3b5618fd9eb3c263e1d86bef4bb78fec862587f935c31d82bf76f8a7dbef
SSDEEP 12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nSXEj:mnsJ39LyjbJkQFMhmC+6GD97
TLSH
T1C2058D22F2D18437D1761A3D8C6BA3A5483ABE512E38794E3BF81E4D5F3E6812D152D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmnesatik.exe

Path C:\Users\Admin\AppData\Local\Temp\Lmnesatik.exe
Size 2.4MB
SHA256 c4ef8ed807f03aeff7fd33f916271f95a5c56f4049e16b57ae11a45b76d12d0f
MD5 ac30ad232fd2028a9ab2fc29b57a61e7
SHA1 346080212d8838ae0be1fb6724f7ffac52542a4c
SHA512 f706fa329ace70ca784087c187746692ede0369169d80deb8cad6ee2f6f95ead91742b2f140ca07923e4fc3ef98abd871e190f44c40c5a62481ec760696bc02d
SSDEEP 24576:InsJ39LyjbJkQFMhmC+6GD9puicui0zLSDRPjiRfzUcpcNgDP:InsHyjtk2MYC5GDN0KfzUoK8
TLSH
T1DCB59403B343EA64E97912F46405CFA052297E4E9534C5F639AC3B69FBEA8D1BC943C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qhubjhdcoc.exe

Path C:\Users\Admin\AppData\Local\Temp\Qhubjhdcoc.exe
Size 2.1MB
SHA256 696eff6649735f409e1a18be62cb72f4bf6e268b2fcbd56b11fe745e79c202b0
MD5 07f0c9652a1705edf640d0696f4b55f7
SHA1 ab377b72cade56c1ebebb2c21ee1305e9871b29b
SHA512 d957f6b0e2b792a2fe51e20b97d749c42d62d26be05d657173170fdebca6e998e70a938be5c28775a6688f193def88c483617b30ad14473381b41384c92ecc75
SSDEEP 49152:lnsHyjtk2MYC5GDb/5XSTz/Kmy+PoWqaLh+CCuD:lnsmtk2aQ5XSTzKmDPoWlX
TLSH
T19CA5F132F2D18437D1321A3C9D5BE3A5982ABF512E38794F3BE91E4D5E3968138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qtpfynfrigce.ico

Path C:\Users\Admin\AppData\Local\Temp\Qtpfynfrigce.ico
Size 19KB
SHA256 cc556e3486a0e236cf0a996df6b1b6affaa56d66213c8052ff0fcdda011a371b
MD5 c6643ed828cc3accf0ced8246b4ed829
SHA1 04cc4f43357022b4c934a90e35a65ce25c459d75
SHA512 0ea346df9935c840ad98254f2065d8f5d919f71a17a8df82f8e1fc0057d08eb63b5f351f53a78ba80d77afd29c872b37214691f776102643886e29993cd88913
SSDEEP 192:0h5n+TeMDOL/fWj6EHG25koCAw9YWd55erCmCeqtXwiSXBsu69:0hwTe3/fWj6Eu330rFCeqtgiSXBhU
TLSH
T199922CD1BB5BFE0BF3C9C8318424E9A989613EEB4BB345B9B87C750D933D692550CA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bNBWJ1o3.xlsm

Path C:\Users\Admin\AppData\Local\Temp\bNBWJ1o3.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/272-551-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/1008-779-0x0000000000400000-0x0000000000770000-memory.dmp

Download

memory/1008-789-0x0000000000400000-0x0000000000770000-memory.dmp

Download

memory/2456-608-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3172-713-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3372-357-0x0000000000DC0000-0x0000000000F16000-memory.dmp

Download

memory/3372-400-0x0000000003100000-0x000000000310C000-memory.dmp

Download

memory/3452-130-0x0000000000400000-0x0000000000770000-memory.dmp

Download

memory/3452-0-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/3452-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/3932-360-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4620-595-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4712-732-0x00007FFBADC50000-0x00007FFBADC60000-memory.dmp

Download

memory/4712-726-0x00007FFBB07F0000-0x00007FFBB0800000-memory.dmp

Download

memory/4712-728-0x00007FFBB07F0000-0x00007FFBB0800000-memory.dmp

Download

memory/4712-729-0x00007FFBB07F0000-0x00007FFBB0800000-memory.dmp

Download

memory/4712-730-0x00007FFBB07F0000-0x00007FFBB0800000-memory.dmp

Download

memory/4712-727-0x00007FFBB07F0000-0x00007FFBB0800000-memory.dmp

Download

memory/4712-731-0x00007FFBADC50000-0x00007FFBADC60000-memory.dmp

Download

memory/4852-781-0x0000000001070000-0x000000000107C000-memory.dmp

Download

memory/4952-355-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5348-782-0x00000000030C0000-0x00000000030CC000-memory.dmp

Download

memory/5708-600-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/5772-778-0x0000000000E90000-0x0000000000E9C000-memory.dmp

Download

memory/5772-780-0x000000001B530000-0x000000001B540000-memory.dmp

Download

memory/5772-127-0x000000001B530000-0x000000001B540000-memory.dmp

Download

memory/5772-70-0x00000000003A0000-0x0000000000654000-memory.dmp

Download

memory/5804-631-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Download

memory/6016-723-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/6136-371-0x0000000000400000-0x0000000000770000-memory.dmp

Download