xworm | 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b

Analysis

max time kernel
179s
max time network
172s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contract9021_06_07_26.exe
Size 833KB
Sample260706-ls5ppahs7q
SHA256 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
MD5 5053320a66a5c4989c44a932a8720b7d
SHA1 f63c54193c17199031d7826b5ad0660db4ffb6e5
SHA512 b04be55de3d996eaeae43095b1be0b875b3719fc025ebe03a57aebc90f14c33c326401cddef93017f48bea2dbeed084e620585ddb34ce83aaed2fb69b6ccab1c
SSDEEP 24576:DRvV0Ldy2hY+QY/4WeSGQ2LRXv2QEfP5HVLotL9p:DRN0LY2O+QYESH29/bEJdoD
TLSH
T1E3050168675DE801C8210735ADB4E6BC16693E6DBA11D3171FECBEEFB9367168C40382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery evasion execution xworm persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:443

Mutex

70vLmgcqMEnUJOeL

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5848-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	Contract9021_06_07_26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	bin.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe
1896	powershell.exe
4464	powershell.exe
2440	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	Contract9021_06_07_26.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	Contract9021_06_07_26.exe

Executes dropped EXE 7 IoCs

pid	Process
3492	bin.exe
5788	bin.exe
5976	bin.exe
1232	bin.exe
3912	bin.exe
3740	bin.exe
5676	bin.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	Contract9021_06_07_26.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3220-7-0x0000000005610000-0x000000000562C000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3220 set thread context of 5848	3220	Contract9021_06_07_26.exe	88
PID 3492 set thread context of 5788	3492	bin.exe	108
PID 5976 set thread context of 1232	5976	bin.exe	110
PID 3912 set thread context of 5676	3912	bin.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Contract9021_06_07_26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Contract9021_06_07_26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1896	powershell.exe
1896	powershell.exe
4464	powershell.exe
4464	powershell.exe
2440	powershell.exe
2440	powershell.exe
3536	powershell.exe
3536	powershell.exe
5848	Contract9021_06_07_26.exe
5848	Contract9021_06_07_26.exe
3912	bin.exe
3912	bin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	Contract9021_06_07_26.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeIncreaseQuotaPrivilege	1896	powershell.exe
Token: SeSecurityPrivilege	1896	powershell.exe
Token: SeTakeOwnershipPrivilege	1896	powershell.exe
Token: SeLoadDriverPrivilege	1896	powershell.exe
Token: SeSystemProfilePrivilege	1896	powershell.exe
Token: SeSystemtimePrivilege	1896	powershell.exe
Token: SeProfSingleProcessPrivilege	1896	powershell.exe
Token: SeIncBasePriorityPrivilege	1896	powershell.exe
Token: SeCreatePagefilePrivilege	1896	powershell.exe
Token: SeBackupPrivilege	1896	powershell.exe
Token: SeRestorePrivilege	1896	powershell.exe
Token: SeShutdownPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeSystemEnvironmentPrivilege	1896	powershell.exe
Token: SeRemoteShutdownPrivilege	1896	powershell.exe
Token: SeUndockPrivilege	1896	powershell.exe
Token: SeManageVolumePrivilege	1896	powershell.exe
Token: 33	1896	powershell.exe
Token: 34	1896	powershell.exe
Token: 35	1896	powershell.exe
Token: 36	1896	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeIncreaseQuotaPrivilege	4464	powershell.exe
Token: SeSecurityPrivilege	4464	powershell.exe
Token: SeTakeOwnershipPrivilege	4464	powershell.exe
Token: SeLoadDriverPrivilege	4464	powershell.exe
Token: SeSystemProfilePrivilege	4464	powershell.exe
Token: SeSystemtimePrivilege	4464	powershell.exe
Token: SeProfSingleProcessPrivilege	4464	powershell.exe
Token: SeIncBasePriorityPrivilege	4464	powershell.exe
Token: SeCreatePagefilePrivilege	4464	powershell.exe
Token: SeBackupPrivilege	4464	powershell.exe
Token: SeRestorePrivilege	4464	powershell.exe
Token: SeShutdownPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeSystemEnvironmentPrivilege	4464	powershell.exe
Token: SeRemoteShutdownPrivilege	4464	powershell.exe
Token: SeUndockPrivilege	4464	powershell.exe
Token: SeManageVolumePrivilege	4464	powershell.exe
Token: 33	4464	powershell.exe
Token: 34	4464	powershell.exe
Token: 35	4464	powershell.exe
Token: 36	4464	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeIncreaseQuotaPrivilege	2440	powershell.exe
Token: SeSecurityPrivilege	2440	powershell.exe
Token: SeTakeOwnershipPrivilege	2440	powershell.exe
Token: SeLoadDriverPrivilege	2440	powershell.exe
Token: SeSystemProfilePrivilege	2440	powershell.exe
Token: SeSystemtimePrivilege	2440	powershell.exe
Token: SeProfSingleProcessPrivilege	2440	powershell.exe
Token: SeIncBasePriorityPrivilege	2440	powershell.exe
Token: SeCreatePagefilePrivilege	2440	powershell.exe
Token: SeBackupPrivilege	2440	powershell.exe
Token: SeRestorePrivilege	2440	powershell.exe
Token: SeShutdownPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeSystemEnvironmentPrivilege	2440	powershell.exe
Token: SeRemoteShutdownPrivilege	2440	powershell.exe
Token: SeUndockPrivilege	2440	powershell.exe
Token: SeManageVolumePrivilege	2440	powershell.exe
Token: 33	2440	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 5848	3220	Contract9021_06_07_26.exe	88
PID 3220 wrote to memory of 5848	3220	Contract9021_06_07_26.exe	88
PID 3220 wrote to memory of 5848	3220	Contract9021_06_07_26.exe	88
PID 3220 wrote to memory of 5848	3220	Contract9021_06_07_26.exe	88
PID 3220 wrote to memory of 5848	3220	Contract9021_06_07_26.exe	88
PID 5848 wrote to memory of 1896	5848	Contract9021_06_07_26.exe	89
PID 5848 wrote to memory of 4464	5848	Contract9021_06_07_26.exe	92
PID 5848 wrote to memory of 2440	5848	Contract9021_06_07_26.exe	94
PID 5848 wrote to memory of 3536	5848	Contract9021_06_07_26.exe	96
PID 5848 wrote to memory of 6060	5848	Contract9021_06_07_26.exe	98
PID 5848 wrote to memory of 988	5848	Contract9021_06_07_26.exe	103
PID 988 wrote to memory of 3872	988	csc.exe	105
PID 3492 wrote to memory of 5788	3492	bin.exe	108
PID 3492 wrote to memory of 5788	3492	bin.exe	108
PID 3492 wrote to memory of 5788	3492	bin.exe	108
PID 3492 wrote to memory of 5788	3492	bin.exe	108
PID 3492 wrote to memory of 5788	3492	bin.exe	108
PID 5976 wrote to memory of 1232	5976	bin.exe	110
PID 5976 wrote to memory of 1232	5976	bin.exe	110
PID 5976 wrote to memory of 1232	5976	bin.exe	110
PID 5976 wrote to memory of 1232	5976	bin.exe	110
PID 5976 wrote to memory of 1232	5976	bin.exe	110
PID 3912 wrote to memory of 3740	3912	bin.exe	112
PID 3912 wrote to memory of 5676	3912	bin.exe	113
PID 3912 wrote to memory of 5676	3912	bin.exe	113
PID 3912 wrote to memory of 5676	3912	bin.exe	113
PID 3912 wrote to memory of 5676	3912	bin.exe	113
PID 3912 wrote to memory of 5676	3912	bin.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Contract9021_06_07_26.exe

C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe
"C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe
  "C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe"
  2⤵
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5848
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Contract9021_06_07_26.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3536
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\Contract9021_06_07_26.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_0c89f0428523474ebce4d57b5132955f.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC53FC42EBFFB84E40866D6EC5C463272.TMP"
      4⤵
      PID:3872

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2996

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1232

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 2408151b467e8fb35862f559746d329917b30098500c6191c22c20849d8b3416
MD5 adfb5ba15c1fa44b7349d4e35d1cdbeb
SHA1 bbf1a079d6e775b109144689ee7fbefd7d2a9362
SHA512 fb335a79a9012616bfeffe36f6f60fea4228f26f65c0b250acbdd7cff0c44c8418e9f300a4f8a86ea8fbe36dfb888a0c82c09172e9bb8cdc4698f83b1c363916
SSDEEP 384:71eBaoT1iBGIGW14biye//+5x0bFLPrr2PnGIAXz48+FW3WtzKwIvYbhNaPAlRt6:5exZ6GDWiu9//+5xC6uIAXzX+5VHbhN+
TLSH
T150A2B478213F6DC7D8D226B410D20AF7FBE4D489DAF611D4BF1BDA2F4C90AB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 6446c997c5863e63e6d8f2473d015c4c485d7d07959c1205edf04246f68cfc43
MD5 f8c8aabbb82d5a22b28a0241e4756849
SHA1 8c10b10770d15d8131ab334d72d97ee015912f0b
SHA512 331614de4cbd4baf9321ca6d215d6071b59527867409dbb548ed47479f78aaff18466e491bcae1228640194d1e42a60206f02cb9baa78bbc8ab5e4f920aadd6c
SSDEEP 384:E1eBaoT1iBGqihD5UkiehGc+geCar/7WOEkZIAXIzbQtoaqB3KFpg7hNcJht0RWx:QexZ6G/hD2kiYGc+R2N+IAX1toaM6FOW
TLSH
T1FDA2D52C26AB8DCBD69160A414824783FBF8D554E7E651DBEF0FC92F2C41A7E4A501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 b7ffffb37ac249edcdee8a68110190f7cade020330c6e144a3cf059d124e4182
MD5 a19ddabdf9a6638bf69f65f6605be4bb
SHA1 f70d8f9559b8d2fc686087112c89daa598afec1b
SHA512 08172d1299c9fe637ec699e8f42bf0f86c392aceab544917af7bdbcf7691aba16c58c3ecebbdd6b76dd487b77ca9035497a37949e9ebb659c38ae0bfbef0ca53
SSDEEP 384:LSEboT1iBGoldrZWc/+If1nP6PsOEbDzdC0wIAC9ZRQxV5vqB3KFw4v27hNIeUJO:Z0Z6GoldrV/+Id6UNbFC0wIAKCb5vM6S
TLSH
T118A2F729266F5DCBC89061B800C24343FBE8D568EBE291C7EB5BC91F2C41A7D4E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2EF.tmp
Size 1KB
SHA256 66088309f42fd64e61564cc6604eec1b292fe5dddf690fe8866416199e70a83b
MD5 d222d751712d72e5d178a04b85fc1550
SHA1 1d60e234f881b208e94a11b1ac0a8b27872cb800
SHA512 2e64ca82857bbda835f78e07769a75245f256b8f0533a4d6f2db01abc7501385fdc81c480912c6cc20a3ffd515d9a25c73990de13b06df1c9cda4d58f0eed91b
TLSH
T17C41260483DC8B1EF173473129F79716A674BD95AE5A439DB588123E1F12744DEC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b0vkabmy.jct.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0vkabmy.jct.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 833KB
SHA256 37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
MD5 5053320a66a5c4989c44a932a8720b7d
SHA1 f63c54193c17199031d7826b5ad0660db4ffb6e5
SHA512 b04be55de3d996eaeae43095b1be0b875b3719fc025ebe03a57aebc90f14c33c326401cddef93017f48bea2dbeed084e620585ddb34ce83aaed2fb69b6ccab1c
SSDEEP 24576:DRvV0Ldy2hY+QY/4WeSGQ2LRXv2QEfP5HVLotL9p:DRN0LY2O+QYESH29/bEJdoD
TLSH
T1E3050168675DE801C8210735ADB4E6BC16693E6DBA11D3171FECBEEFB9367168C40382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC53FC42EBFFB84E40866D6EC5C463272.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC53FC42EBFFB84E40866D6EC5C463272.TMP
Size 1KB
SHA256 171c5cd3554d5f2a55194a07eee017319231355333c22b16e2888039e0487793
MD5 10306a21d28bf669d5e6217c85ead59b
SHA1 636db20879340ac7feb7f480553620a0b53b5110
SHA512 0b513315a446272acd332bfb022d186f9697d5baa4b21079fafb8551a3200284576b22618f8342f82b56505f5a3b00b8d06dd7a7b3605412ec63838c1daf9b91
TLSH
T1E221AD4593E8561EF1B3477039F58363A178BE929C7943DC348C135F2B15A0086836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_0c89f0428523474ebce4d57b5132955f.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_0c89f0428523474ebce4d57b5132955f.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-14-0x0000000002D90000-0x0000000002DC6000-memory.dmp

Download

memory/1896-38-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/1896-36-0x0000000007B90000-0x0000000007C26000-memory.dmp

Download

memory/1896-35-0x0000000007990000-0x000000000799A000-memory.dmp

Download

memory/1896-34-0x0000000007920000-0x000000000793A000-memory.dmp

Download

memory/1896-33-0x0000000007F60000-0x00000000085DC000-memory.dmp

Download

memory/1896-32-0x00000000077C0000-0x0000000007863000-memory.dmp

Download

memory/1896-16-0x0000000005C10000-0x000000000625A000-memory.dmp

Download

memory/1896-15-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/1896-17-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/1896-18-0x00000000058E0000-0x0000000005902000-memory.dmp

Download

memory/1896-19-0x0000000005980000-0x00000000059E6000-memory.dmp

Download

memory/1896-22-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/1896-23-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/1896-24-0x0000000006260000-0x00000000065BB000-memory.dmp

Download

memory/1896-25-0x00000000065C0000-0x00000000065DE000-memory.dmp

Download

memory/1896-26-0x0000000006600000-0x000000000664C000-memory.dmp

Download

memory/1896-27-0x0000000007780000-0x00000000077B6000-memory.dmp

Download

memory/1896-28-0x0000000071160000-0x00000000711AC000-memory.dmp

Download

memory/1896-31-0x0000000006B80000-0x0000000006BA0000-memory.dmp

Download

memory/2440-51-0x0000000071160000-0x00000000711AC000-memory.dmp

Download

memory/3220-4-0x00000000050F0000-0x00000000050FA000-memory.dmp

Download

memory/3220-5-0x0000000005260000-0x00000000052FC000-memory.dmp

Download

memory/3220-1-0x0000000000620000-0x00000000006F6000-memory.dmp

Download

memory/3220-10-0x0000000007970000-0x0000000007A16000-memory.dmp

Download

memory/3220-9-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/3220-2-0x0000000005640000-0x0000000005BFA000-memory.dmp

Download

memory/3220-8-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

Download

memory/3220-3-0x0000000005120000-0x00000000051B2000-memory.dmp

Download

memory/3220-0-0x0000000074EC2000-0x0000000074EC3000-memory.dmp

Download

memory/3220-7-0x0000000005610000-0x000000000562C000-memory.dmp

Download

memory/3220-12-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/3220-6-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/3536-58-0x0000000071160000-0x00000000711AC000-memory.dmp

Download

memory/4464-44-0x0000000071160000-0x00000000711AC000-memory.dmp

Download

memory/4464-39-0x0000000005D20000-0x000000000607B000-memory.dmp

Download

memory/5848-43-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/5848-69-0x0000000007FF0000-0x000000000806C000-memory.dmp

Download

memory/5848-70-0x0000000007F30000-0x0000000007F38000-memory.dmp

Download

memory/5848-13-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/5848-66-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/5848-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5848-78-0x0000000074EB0000-0x000000007566C000-memory.dmp

Download

memory/5848-79-0x0000000008D60000-0x0000000008F22000-memory.dmp

Download