lxbaserat | e2f9eeae126236bb235433322d5bccdfd605ec08607c8b367fb63da3aec7fa0d

Analysis

max time kernel
299s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tanda Terima Pengiriman.js
Size 773KB
Sample260808-thfltahq5t
SHA256 e2f9eeae126236bb235433322d5bccdfd605ec08607c8b367fb63da3aec7fa0d
MD5 165e37b1c96d9d3124f420ff6e64384c
SHA1 be16f8fa15119176f247c68121fd841a064058fb
SHA512 5cfd3017542c03fc524c4e385615854947b9732019f223e53caf58243eabbca84bc45181c10fed728d97e32241c282dc021230ee1a0dd576e97f81f45e23bb0b
SSDEEP 24576:TAIKdDeaHgUTLLYc6M0VZfCQdtmLyR19Z:8PdD3PWrdqm
TLSH
T1C3F49F081391DE5A0C9A73EB076D05E13EFCD80C8B5286C0B989FB6B9FC4A25D69D1F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 1a83f37a318549ff9e552cad18eceb6d collection discovery execution lxbaserat persistence rat upx

Malware Config

Extracted

Family

lxbaserat

Version

1.0.24

Botnet

Group1

Campaign

1a83f37a318549ff9e552cad18eceb6d

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
hCeWS8Uz8SJ6ASPT2fef

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4252	powershell.exe
4416	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5932	msvc_2fcfdac8.exe

Loads dropped DLL 1 IoCs

pid	Process
3116	chrome.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2764	wscript.exe
2820	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4252 set thread context of 5856	4252	powershell.exe	96

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c539-63.dat	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	MSBuild.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5856	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4252	powershell.exe
4252	powershell.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe
5856	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5856	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	5856	MSBuild.exe
Token: SeDebugPrivilege	4416	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5856	MSBuild.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2764	2748	wscript.exe	91
PID 2764 wrote to memory of 4252	2764	wscript.exe	92
PID 4252 wrote to memory of 3304	4252	powershell.exe	94
PID 3304 wrote to memory of 3000	3304	csc.exe	95
PID 4252 wrote to memory of 5856	4252	powershell.exe	96
PID 4252 wrote to memory of 5856	4252	powershell.exe	96
PID 4252 wrote to memory of 5856	4252	powershell.exe	96
PID 4252 wrote to memory of 5856	4252	powershell.exe	96
PID 4252 wrote to memory of 5856	4252	powershell.exe	96
PID 5856 wrote to memory of 3116	5856	MSBuild.exe	98
PID 5856 wrote to memory of 3832	5856	MSBuild.exe	99
PID 3832 wrote to memory of 5236	3832	csc.exe	101
PID 5856 wrote to memory of 5932	5856	MSBuild.exe	102
PID 5856 wrote to memory of 4812	5856	MSBuild.exe	106
PID 4812 wrote to memory of 2820	4812	WScript.exe	108
PID 2820 wrote to memory of 4416	2820	wscript.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Tanda Terima Pengiriman.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\2ykzy4vg\svc_87007_7752.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\2ykzy4vg\cfg_63099_7730.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jr1gjlrh\jr1gjlrh.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E04.tmp" "c:\Users\Admin\AppData\Local\Temp\jr1gjlrh\CSC9CFCD9B8BFB540C599313932B28B879D.TMP"
        5⤵
        
        PID:3000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      outlook_office_path
      PID:5856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Loads dropped DLL
        
        PID:3116
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\msvc_2fcfdac8.exe" "C:\Users\Admin\AppData\Local\Temp\msvc_2fcfdac8.cs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3832
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8090.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC63BC886854CF4FEC99F25148411BC1C.TMP"
        6⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\msvc_2fcfdac8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc_2fcfdac8.exe" 3116 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.sync.26781.3021.E594"
        5⤵
        Executes dropped EXE
        
        PID:5932
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LX_BWiy5Jwl5O.js"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4812
      - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\zvvog9ca\dat_69333_c3e4.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\zvvog9ca\log_58041_c3c9.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PhotoStudio.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\PhotoEngine\PhotoStudio.vbs
Size 148B
SHA256 0c5d2af482d9eb35b077baa5407ac27776195a633ca72dafa55e81a78f7be0cf
MD5 4af25f78646b3fab604bde092251d620
SHA1 18d0225e728a58153b23bbfc880f4aa779170f19
SHA512 46aca75723ccad0dbb9c9b10c389a01d817d4862e7d702924c65bdc175923bbe6ea8b3ebc51ba8a881f8cbe50fb0780e907e08ebed1343cbf676b8445cbe4578
TLSH
T187C02B2CB4ACD93B5014C08A2B33884CFB9049DB5209F62E5310E40821817C4B94B443
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 119KB
SHA256 fe8289239a81f3e1bc881e4f622e11c8e67b1d90c4a54d07a55e00a1950939d8
MD5 a6fb047749de3b890d36d2172df0ff97
SHA1 4431970ca391769bb36d72677c89e26217e006be
SHA512 3d8f6eb72f07fdf921aa4fcd000396ef5259aa7827411c691ed00742f721ff3d3334123ed178661434835b02f53d6224bd749a6e241e4d046b3e4edabf1935ed
SSDEEP 1536:nWdGfNbAkj1K3X7BQ9d0SHS7hdPFw5coos5J9PtSUDwS8U+DQAK+OAOxW4C:WdsA81ISdNQzPFzotxD789Q/+Oe
TLSH
T168C3D5D626D84E8AEA14667846DEC322773EFAF087434B03A268B0754E17FC17DC561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 1c418137c190945d072c8ccf564f90ca33fdd0d72bea1c0def4659c5d19ba264
MD5 142831e861c5dabc085d4a51bb5feea3
SHA1 ea9a33ee19b25d40028f8c3af982f8332da2a65c
SHA512 704b0a2615c8cdf44be99f89bf8f83e605cf39bc18c4e941b10aee6d6a0e0c8db786ca46297d3fea8e2b905d8fe867d6adb223616ebafe1781e08ad01636e5db
SSDEEP 384:W1XBaGX1iBuy4b8quvMMUnQCKr2PN1IAEr4y5gA6jAJD6z851vlFbBzsXFLWfbhO:2XnF6urQqAMMUU67IAEr3gAJJDQuLbR0
TLSH
T12392B768513F6DC7D89122B414D602E7FFE4E048EB7551A4FF2BCE3B5C90ABA4BA0524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg_63099_7730.ps1

Path C:\Users\Admin\AppData\Local\Temp\2ykzy4vg\cfg_63099_7730.ps1
Size 5KB
SHA256 bb5f491deac9726a60e4404a2425747b264882f4adc37346bf6b4c5c7f38277f
MD5 1743a45f07c0a6e930b4f48b5ab6afcb
SHA1 435591f404038069a89ec9038b8a154107b2bc99
SHA512 4919ebf754fb1e461113c79778491d81d94daf50f7c20e315d475ea3185c7912c97f8b8411ee02e23f7e9d40df06b5ecaab09e0361607f809de4d43b545b0c43
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5oE5wf5PgzWE43NGIoBY67tKhwwDMJWtUvrcXgup:gmOEG39XaygEUij/f+LfCu4IomItKh4W
TLSH
T1E5C1834B7ADE4BFA02C3707459B65101B269C437260F1D04F6ECC2C9BF06474E3E52AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clr_103585_7730

Path C:\Users\Admin\AppData\Local\Temp\2ykzy4vg\clr_103585_7730
Size 308KB
SHA256 d69f329832c1ebb9359daa7a9678cbad5de14cbc850bf10ff35e1ec83cffb47c
MD5 5d3924194be293bf6d69d8c4de5bb2e0
SHA1 187a980f9ada8ef91cbcee5dfbb3f15e9ed94fe3
SHA512 41dbc6c7f2ae06d9d7e1621cf0c583dc1a4538a834d127012016b8e3529b3087531cd69cc8ffff2724b6bec5916b1797f4c9a75bca24c508ca8f1a47bada49a2
SSDEEP 6144:FwDWFnXKzTA4kZdo2CkAHNxOzqfyrubRyN4OOZYOX6bFAQH5g6Uu7buM2gMvbG9:LFnXSEdo2PAHNEzXubRtOYYOX69H5g67
TLSH
T185642225DC6ECCAE433815AD39AA0F4F6FB7691208D49B544720BE1B0FA75ED01CD2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_57369_772e

Path C:\Users\Admin\AppData\Local\Temp\2ykzy4vg\net_57369_772e
Size 39KB
SHA256 705b9f1750bfed729fb80fe42d15838bf0ac29b4f88957278ce0a667811e90c0
MD5 09b92c1b0f180f35cb7c01c35868b10d
SHA1 6803052aeb9aeb52e645809e4d57e3489a04c830
SHA512 0929bbb9622eddbd5e3bda2d6b13fbdb3f9eda20494470cee79f43e6903bc955e2f96168070d85f0e1eaff36394d6ac6397acc756014f09c83bbd436e6fe505c
SSDEEP 768:DIAor2o9zcJ4+glKY0q7L+EubdVGQvDNhB3p+/Y+N51Ryo/czt6EF6Nqdzbj:DRg2qH+gl37L+nHGQjj+/YY1B8MdN4zH
TLSH
T14C0301EAF5AD876C9D4F220590B9254E34336CDB6303B9FA03FA55A6A1E181A38430D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_87007_7752.vbs

Path C:\Users\Admin\AppData\Local\Temp\2ykzy4vg\svc_87007_7752.vbs
Size 228B
SHA256 0f083732f70668d041fdc84d20ada226a0b3a911a87daf026d6c939f67a0432b
MD5 e653ab0ee35cd90ff42944864c0499b8
SHA1 c905444dc8bb315783fc63e06a01354d43c7ff19
SHA512 bff8224ae658f14ffe818430029a680a316884a55054c010043efc34e35ad53af63dde41274f190e42bb745102a8f161b3308842c94c96ac85166ec1c4470e61
TLSH
T1D2D02304B13EE30CDC29C47901B2563CC9D3D8DD260067516764CA08F6D1775DE9E15D
MD5 SHA1 SHA512 TLSH

Submit Download

LX_BWiy5Jwl5O.js

Path C:\Users\Admin\AppData\Local\Temp\LX_BWiy5Jwl5O.js
Size 317KB
SHA256 852e83467f98dcb3d6a9b9b766cbf5467221f00f532f8a33f2568000cc5bc331
MD5 f6106f25db8317a81a43b9a46e7f49b1
SHA1 246084755cd7ea0f8346aad5f3b29f361b004c3d
SHA512 af2c3900def3702e28b0c3f8ba9f1cd9b9609f5be9b51064823efb8d9901721ea368b5767e0b419702bd1d138c060ce57e8c20837d758443e18b96ece03fb32c
SSDEEP 6144:blhTPXiAi8k41tiqtpy8hyo4c3rS5Uk03cWcPe37aTKob3NC6FLB8u0S:bRi85TiqtC4IUkIcWx37aBXB8u0S
TLSH
T1EC64BFD82712250458E64B3C787F62DE7FFC361857D8E302599DF4C93283A9AA1F3626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES5E04.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5E04.tmp
Size 1KB
SHA256 d062758b0292ba24c1d8a43be8d4ab190bc4b97980c52b155fc687f093202be0
MD5 f573aae46650f61d1930f1b2e1c21eb7
SHA1 2fde4ca61e8dc2865a986606dbb84f0b10913ff2
SHA512 24b063771916021aaf742bcdceca7d85456a01f926c2bdbbcb0d35a98b811c21105057649b9ff578c21a0d66b44bc9659197dc5aec376b6008e3ad342407f7d0
TLSH
T1B0218C0993E9871EF07347317AF6136FA279FD65EFA1975A8540422C3C51144EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8090.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8090.tmp
Size 1KB
SHA256 5f16cda9479372b9170cd789d6d5aee23589877c866d430fba591def18b47f5f
MD5 f08500321f601a7d64ae6f8f2b508c25
SHA1 f1594803dd3755691f9b5ec8b90c31a15618041a
SHA512 21c2979d5b96b3b1b9ce7e06966dd7cf7f6fa074b53c4c015b4dfddf7fe57da59bc1730616d134fea241f1338521774492ec0bda97705a459aacbd50ee26404a
TLSH
T1D741444093DC871FF172473118F7972AA678BE96AEAA435D7188122E1E02B84DDC35B1
MD5 SHA1 SHA512 TLSH

Submit Download

jr1gjlrh.dll

Path C:\Users\Admin\AppData\Local\Temp\jr1gjlrh\jr1gjlrh.dll
Size 3KB
SHA256 2b98da3d2b8c631ee156c2d1c18a565f2095318ae4229c84b63348ad1320bd25
MD5 5ec703e4645ad8048f0ea36278b1a69e
SHA1 f61a59bbdc8962b365d1aceeaab8866ff86cef65
SHA512 f0f8986c91f4f50a936fd7384d5f34036baff51b869af167beeb96168047568ab55438f912a17926ac4179aea9b9e3a63c655eec260b2931b8475c0302235036
TLSH
T1D3519B1A57E88A2BF4730B35AEF3471677B4F8509BB3675E1D90421CBC606644A21FB0
MD5 SHA1 SHA512 TLSH

Submit Download

msvc_2fcfdac8.exe

Path C:\Users\Admin\AppData\Local\Temp\msvc_2fcfdac8.exe
Size 6KB
SHA256 6e4d0b55e90b8f71598399936211e5f4d89a9cfecf800b6b92cd1feb2211fc9d
MD5 0705b2042643580c6a938658f29b2274
SHA1 ca5a7bd3222d0530f8eef04fb0828f0bbe3d2156
SHA512 3ce4624ca124e157276ff800a068fe5376f642cfc89ab3c6a06883e23365dd9f3b19c12d8e0eb6eeee02a3363a93d35e5004952a22fb2062230fa00210807bcb
SSDEEP 96:dOoKU4XMuUdFis4hezvUvXfcIdOI883638WbbkrVmLTzNt:b74hNhPWQI1
TLSH
T1B9C10A8B87DC0772E8AD433C52B347256379E5B645138B9F68D1012BAE23BD947233B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dat_69333_c3e4.vbs

Path C:\Users\Admin\AppData\Local\Temp\zvvog9ca\dat_69333_c3e4.vbs
Size 228B
SHA256 0b73a9660744922ee48629c9d342e23b2cd6becf8b0b82a8de9eb72c3305353b
MD5 3a925d6013f25073635fb232c670ddd5
SHA1 18e8155e344b93dd1a000520c35a2fe813365ff2
SHA512 242d2c2429ce060b6c57bd262dbc036bb6ebf4527a2d3712998429143277704e3a85db5a7ce62555f90270cbed828caebaf4794ce6812d86cd8cc247790bb621
TLSH
T1D1D02300723DD20CCD28C4760172823C80E3989C318027512350C808F6823B8CF9D308
MD5 SHA1 SHA512 TLSH

Submit Download

log_10358_c3c7

Path C:\Users\Admin\AppData\Local\Temp\zvvog9ca\log_10358_c3c7
Size 84KB
SHA256 a1f8efa81ac96d2b68fbe7ab2c32cbd80c97769fdb4a6d0e4b6906937a2e0142
MD5 7f963bff93148cf8e9749c01fc24da31
SHA1 d35e5e0656060ae354ef72f2f299c1e7a91a5f62
SHA512 a7ac476736d64b40afcf17e2e2386796f06597748e6361b27991abac7d074a9e2115e3ee1dee09b6146b72089924b8cc0a8e0d6b4019fffb0e8054742dfd4f53
SSDEEP 1536:nXmrCHa7Lz73fmHmbvPg7iRB6Tn7ptiSoOaCroEhc8Wy98b87nTu+:WrCWf7NYlD7vdoZ8jWy98EnTZ
TLSH
T1BC8302D7D9FDC77F803C1396B8B3111E73E9A98421986188E7FBA421A613D0F236B854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_58041_c3c9.ps1

Path C:\Users\Admin\AppData\Local\Temp\zvvog9ca\log_58041_c3c9.ps1
Size 5KB
SHA256 bcb63bc5e6341970616136b5cbd0410e44b1253cf6a08e68311b27b11d7a07a6
MD5 93e60987e2a0ca37f9bb992f9bcea8c8
SHA1 8bf49356517f92cd77305833683af70d5cbd52c6
SHA512 9a6bff0dfe60525bd88ae658ba2c2b8c54d2c3d4dedd328367923e4093f25c8a614a66919803c00de27b7b174884a5715253aeb151c8e1aa95349e1fe6e9a84b
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5zFTf5hZ7GIoBY67tKhwwDMJWtUvrcXquyUNoul2:gmOEG39XaygEUij/f59f4IomItKh4Lvr
TLSH
T1F7C1840A7AD98BFA02C375749CB65502B269D42B325F1C00F6FCC6C6AF06474D3E91AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp_44549_c3c3

Path C:\Users\Admin\AppData\Local\Temp\zvvog9ca\tmp_44549_c3c3
Size 39KB
SHA256 5cf258bfc08bf91a40c53b01d74b54a3daf2b4aa3f9cc2f22c661e57c10947d5
MD5 45b8339696efdb3af1c2f7430e12ad84
SHA1 cf0b09b0faa87a70e3c043dd52b5881d805726be
SHA512 87e41f4973fb715a2ac124aa7883f70a449aa5f77b5a14bedefd72c8c2ed0afbc5ba736e1f517444eb3327b842429c5405f3d8bd71e4ecdaa50d8646be567251
SSDEEP 768:s4Fp4/DeoRbbnNQzYKP8ofsgxpzdn/G3MRHrVi4Rdd1qj:1FpSeYX+8toEwpzQc15/zgj
TLSH
T18903F12348743CE11BEC557A857B8AB2121059690952FEB38BA8083BFEFF0741D57D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC63BC886854CF4FEC99F25148411BC1C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC63BC886854CF4FEC99F25148411BC1C.TMP
Size 1KB
SHA256 bf6483ae018bee07b6a90cef973479a3dca55735b311a3a60997d16e138d361b
MD5 c2cc27c407c4bbf143975ee56d387562
SHA1 64409ad9a110be81f8c626bf7b53e9eca34011c9
SHA512 0722420ad309e4ad2b77010d1e51cc95699d2c3784672e4b7d530aa298a5f47ba16657f81e1775a4e85b91c27fac341c4300eb209c3673dc1a84d97ca8731c84
TLSH
T11721CC45A3E8421EF2B3877069F2C363956C7E569C7A43DC3488171B2F16A408883AB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9CFCD9B8BFB540C599313932B28B879D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jr1gjlrh\CSC9CFCD9B8BFB540C599313932B28B879D.TMP
Size 652B
SHA256 9e00b12fcbcceb2fb41cf0bf85ebebe72176fe87800431c300f53bb9d30cd4b3
MD5 aa8657701eff79969c11b891a3040360
SHA1 0cf9e0b9f58fbdf04fa6e3a98c4d6f13fa188566
SHA512 03bd982ba847af028fae7ae710dce31cdbf3d1b39cb304a43325a081d88b01b0780b1bc552ef935f6b8f5c6f107d43ea86c696311c996a1c28dff427915e3848
TLSH
T1FCF05E0963F8420EF0F34B31BEF643A391A9BC65DE3293ED1540031D68746208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jr1gjlrh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jr1gjlrh\jr1gjlrh.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

jr1gjlrh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jr1gjlrh\jr1gjlrh.cmdline
Size 369B
SHA256 34fd11ab24a881a25f8266bb5aa94a4af8a24fd41fc56087d8d79c8adf6a3c5f
MD5 4fa49a8d30930901eb654c8470c157ed
SHA1 98827228468c350652bbd7e4789651e28f59f1bc
SHA512 03d8213213f95f102538ea8555b2c51b226e1234aca751b54155cbc4a98b2c1d096a8aa0da0c234ff2a3000d2c47f2e607fef0b0c1e8e0edefabc5ddaf190653
TLSH
T138E0C02E9286C3BF45DF10072169F4FCC2B207832A413F84584045CDE39704027D1BC5
MD5 SHA1 SHA512 TLSH

Submit Download

msvc_2fcfdac8.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\msvc_2fcfdac8.cs
Size 3KB
SHA256 1243a2c30132533e8a2baba7fbb9dc628778e4c2c101c6c39255dd5bc2ab2074
MD5 956d29c7c2582edb156faa745998d459
SHA1 dfbaae25a60f503aab33196716b3e10e51b4791c
SHA512 8bb8495ca4f56c514f12288979cb6ceb3d29b438d19bd796e0024fb2a9a9bcd2cf5d352e5101cea17b00d07cc0af2e78a923a3218d31116d188c9e4b5851986b
TLSH
T13D61EE556349E7A416B1040F4AD8C059F3678033473A6E04BE9E8512AFF812BA37AFA1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3832-59-0x0000023A898E0000-0x0000023A8A284000-memory.dmp

Download

memory/4252-38-0x0000000007730000-0x00000000077C6000-memory.dmp

Download

memory/4252-10-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/4252-6-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

Download

memory/4252-39-0x00000000076C0000-0x00000000076E2000-memory.dmp

Download

memory/4252-7-0x0000000005710000-0x0000000005D5A000-memory.dmp

Download

memory/4252-8-0x00000000055E0000-0x0000000005602000-memory.dmp

Download

memory/4252-9-0x0000000005E10000-0x0000000005E76000-memory.dmp

Download

memory/4252-15-0x0000000006720000-0x000000000676C000-memory.dmp

Download

memory/4252-13-0x0000000005EF0000-0x000000000624B000-memory.dmp

Download

memory/4252-35-0x00000000051D0000-0x00000000051D8000-memory.dmp

Download

memory/4252-34-0x0000000007600000-0x0000000007608000-memory.dmp

Download

memory/4252-21-0x00000000075D0000-0x00000000075E6000-memory.dmp

Download

memory/4252-20-0x00000000069A0000-0x00000000069BA000-memory.dmp

Download

memory/4252-19-0x0000000007C10000-0x000000000828C000-memory.dmp

Download

memory/4252-14-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/4416-95-0x0000000005760000-0x0000000005ABB000-memory.dmp

Download

memory/4416-97-0x00000000061E0000-0x000000000622C000-memory.dmp

Download

memory/4416-101-0x0000000006CA0000-0x0000000006CB6000-memory.dmp

Download

memory/5856-49-0x0000000008D70000-0x000000000929C000-memory.dmp

Download

memory/5856-48-0x0000000008670000-0x0000000008832000-memory.dmp

Download

memory/5856-37-0x0000000005600000-0x0000000005BBA000-memory.dmp

Download

memory/5856-47-0x0000000008450000-0x00000000084A0000-memory.dmp

Download

memory/5856-44-0x0000000006BA0000-0x0000000006BAA000-memory.dmp

Download

memory/5856-43-0x0000000006BB0000-0x0000000006C42000-memory.dmp

Download

memory/5856-36-0x0000000000340000-0x00000000003C4000-memory.dmp

Download

memory/5932-62-0x0000000000470000-0x0000000000476000-memory.dmp

Download