xworm | 07f832fec18520e00fd3366300677edebd045585873aee8c19c6a51148854429

Analysis

max time kernel
298s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MB320843298AE.js
Size 207KB
Sample260814-tkrrvsel5s
SHA256 07f832fec18520e00fd3366300677edebd045585873aee8c19c6a51148854429
MD5 fc35e7bac1d5fc7589b364648f1fe267
SHA1 6cdd8e75079a8ec759c1089687c39222f4c2fc11
SHA512 7d4056e5374c8cc305fb7d7690e4b50aa807338689de0cde486aa017261238789e4511b5c8770cc4aee4465b1fedd5252039cf84d9a6300a0ae5950a57b03c88
SSDEEP 3072:8tVTtcMFxf7Ax5gJdtrsDbascKT5RylDBjqscB/i+TpMyApXrLrziI5+qxyhjApg:4TuuxjAAJsjc2cloBH
TLSH
T13F248E6102B37E7CFB5426B9047F2AAB61F8FF012810F15BEAB27D475D25CA1C542A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:1012

Mutex

aGO284VKfQVe8Vup

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1540-34-0x0000000000560000-0x0000000000570000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe
988	powershell.exe
1344	powershell.exe
1524	powershell.exe
3840	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe

Executes dropped EXE 6 IoCs

pid	Process
2916	bin.exe
3660	bin.exe
1796	bin.exe
3348	bin.exe
2572	bin.exe
3328	bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	MSBuild.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3272	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3840 set thread context of 1540	3840	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3840	powershell.exe
3840	powershell.exe
2316	powershell.exe
2316	powershell.exe
988	powershell.exe
988	powershell.exe
1344	powershell.exe
1344	powershell.exe
1524	powershell.exe
1524	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	1540	MSBuild.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeIncreaseQuotaPrivilege	2316	powershell.exe
Token: SeSecurityPrivilege	2316	powershell.exe
Token: SeTakeOwnershipPrivilege	2316	powershell.exe
Token: SeLoadDriverPrivilege	2316	powershell.exe
Token: SeSystemProfilePrivilege	2316	powershell.exe
Token: SeSystemtimePrivilege	2316	powershell.exe
Token: SeProfSingleProcessPrivilege	2316	powershell.exe
Token: SeIncBasePriorityPrivilege	2316	powershell.exe
Token: SeCreatePagefilePrivilege	2316	powershell.exe
Token: SeBackupPrivilege	2316	powershell.exe
Token: SeRestorePrivilege	2316	powershell.exe
Token: SeShutdownPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeSystemEnvironmentPrivilege	2316	powershell.exe
Token: SeRemoteShutdownPrivilege	2316	powershell.exe
Token: SeUndockPrivilege	2316	powershell.exe
Token: SeManageVolumePrivilege	2316	powershell.exe
Token: 33	2316	powershell.exe
Token: 34	2316	powershell.exe
Token: 35	2316	powershell.exe
Token: 36	2316	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeIncreaseQuotaPrivilege	988	powershell.exe
Token: SeSecurityPrivilege	988	powershell.exe
Token: SeTakeOwnershipPrivilege	988	powershell.exe
Token: SeLoadDriverPrivilege	988	powershell.exe
Token: SeSystemProfilePrivilege	988	powershell.exe
Token: SeSystemtimePrivilege	988	powershell.exe
Token: SeProfSingleProcessPrivilege	988	powershell.exe
Token: SeIncBasePriorityPrivilege	988	powershell.exe
Token: SeCreatePagefilePrivilege	988	powershell.exe
Token: SeBackupPrivilege	988	powershell.exe
Token: SeRestorePrivilege	988	powershell.exe
Token: SeShutdownPrivilege	988	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeSystemEnvironmentPrivilege	988	powershell.exe
Token: SeRemoteShutdownPrivilege	988	powershell.exe
Token: SeUndockPrivilege	988	powershell.exe
Token: SeManageVolumePrivilege	988	powershell.exe
Token: 33	988	powershell.exe
Token: 34	988	powershell.exe
Token: 35	988	powershell.exe
Token: 36	988	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeIncreaseQuotaPrivilege	1344	powershell.exe
Token: SeSecurityPrivilege	1344	powershell.exe
Token: SeTakeOwnershipPrivilege	1344	powershell.exe
Token: SeLoadDriverPrivilege	1344	powershell.exe
Token: SeSystemProfilePrivilege	1344	powershell.exe
Token: SeSystemtimePrivilege	1344	powershell.exe
Token: SeProfSingleProcessPrivilege	1344	powershell.exe
Token: SeIncBasePriorityPrivilege	1344	powershell.exe
Token: SeCreatePagefilePrivilege	1344	powershell.exe
Token: SeBackupPrivilege	1344	powershell.exe
Token: SeRestorePrivilege	1344	powershell.exe
Token: SeShutdownPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeSystemEnvironmentPrivilege	1344	powershell.exe
Token: SeRemoteShutdownPrivilege	1344	powershell.exe
Token: SeUndockPrivilege	1344	powershell.exe
Token: SeManageVolumePrivilege	1344	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 3272	5460	wscript.exe	89
PID 3272 wrote to memory of 3840	3272	wscript.exe	90
PID 3840 wrote to memory of 3400	3840	powershell.exe	92
PID 3400 wrote to memory of 3788	3400	csc.exe	93
PID 3840 wrote to memory of 1540	3840	powershell.exe	94
PID 3840 wrote to memory of 1540	3840	powershell.exe	94
PID 3840 wrote to memory of 1540	3840	powershell.exe	94
PID 3840 wrote to memory of 1540	3840	powershell.exe	94
PID 3840 wrote to memory of 1540	3840	powershell.exe	94
PID 1540 wrote to memory of 2316	1540	MSBuild.exe	95
PID 1540 wrote to memory of 988	1540	MSBuild.exe	98
PID 1540 wrote to memory of 1344	1540	MSBuild.exe	100
PID 1540 wrote to memory of 1524	1540	MSBuild.exe	102
PID 1540 wrote to memory of 1136	1540	MSBuild.exe	104

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MB320843298AE.js
1⤵
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\c6zo1d7g\dat_35150_4964.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\c6zo1d7g\dat_99613_4925.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f45s2h1i\f45s2h1i.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3493.tmp" "c:\Users\Admin\AppData\Local\Temp\f45s2h1i\CSC7E2FA22F87C94D618B33EFAE058DE7.TMP"
        5⤵
        
        PID:3788
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Creates a file in the Startup directory
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1524
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1136

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3040

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2572

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 2315403008cafbaa74b5a487b5ed68becdd9fa43325cc2c73174020d9eface05
MD5 e24ed0491c2cbd4928580de2e7b03c4a
SHA1 ac1eaac0797c475f37da5c4c44a477a4729d93f9
SHA512 973d50a000a4eadff1080916f29d8d576ed08a07e5fe600cd491777d530eeb32d71ede41c1f016c9fd16bc9dc097d53913fd2529b2a6faec4754285a83c90fca
SSDEEP 384:W1XBaGX1iBiy4b0T58d9GC+nDbrr2Pn1IAEr4KVgN+fJzmz9pKtlGku/6Rzu3fbK:2XnF6iroTudsC+nT6NIAErHgNyJzEiz5
TLSH
T11492B768113F6DC7D8D122B414D602E7FBE4E088DA7551A4EF2BDE3B1C90ABA4FA1524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 ec47120149ec2db248b3947e5824dc716a2b477212f932c895a948e21d8d742e
MD5 dab1eaa74bcee2a70ebe94ee2d462cf7
SHA1 4872341fc850b3390625dde102e85045b59bc85c
SHA512 6b1f1ee3d4a23851bf553ebd9c9da595f3775afd51eef98e39cd8649cf7952de214172bd28818a5a15565b441c5d9716edb08adddbea6b49f6967b338c0ad1b1
SSDEEP 384:71eBaoT1iBGqGWYKiYgeT+geR5R2PsOEfzdC0qKOII+dW7OtuwXHbhNaNmlRtsAi:5exZ6GxWYKiY9T+WUNZC0qD+9V3bhNaB
TLSH
T1B7A2D86C202F5CC7D8D211F415910BEAFBA4D489DAE651D9BB0ADE1F4C40EBE9E901E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 f2952d34ae347f11ad69a5690ae1581064913349df0b084cd2d99a5ba95e7922
MD5 f53336877f1cbaab91318e2c0fa42634
SHA1 0069dea22e973211ffac93bca63f7f542e5ba69a
SHA512 680a219e071336dc492c93c96764cec4e957981970fd3ca5711480cc5949ea7a253dbf60c9ab77fb48a47b267cc11228e7abfc20e8b3b24ae77602d3abd115e1
SSDEEP 384:S1eBaoT1iBGQFGlbP63OCesNw4B/xaaHPsOEfzdC0wIACOIIQbQ1wNqBhwT7hNIh:SexZ6GQwluxJNw48KUNZC0wIAXDRGNMF
TLSH
T119A2F82C262F5DCBD89161B410820786FBF8D559EAE151DBEB0FC91F2C81A7E9E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 53150e00493e3c3f32e4fa1d6018da568db5220a7fc13a4292c0521142f403cb
MD5 3f62d125495e3693320c642dfbe77935
SHA1 65a8e94626e3b8ade06481a345414d462dd90b42
SHA512 6820cefd59c420250879266229de5caf4f391e053bf291c1593ed3a215e5d788e069e9f0b4d6526cfaaa649921acdcf917e43bac709e78cc83fdeedbd3960fab
SSDEEP 384:/1eBaoT1iBGCGl37tXf2rjVOgd/YR2jWOEPiUDzdC0MIACOII0bQ1V5qBUphv27q:dexZ6GZl37tP2fVOIJiN6UFC0MIAXD9f
TLSH
T1CEA20928266F4DCBCE5210B400C1079AFBF8E555A7E152DBEB5BC92F2C81A7E5E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3493.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3493.tmp
Size 1KB
SHA256 cd97304e26f9b7dd414b767016c388d38861f0d22a32569936c4efec0556045b
MD5 1f82fbafea83a288a4469b592f3f74fc
SHA1 c1ffd6b0cbcb050732c3b4a3847724ab180d9d3c
SHA512 a9d66d1dd94433255afc2b04475479acfe64b21559c8de197f6253cab4cef3e6d291ef5547ac212c8d4ea6292e75d5181b9a587d56637291d0174e964d60fbf1
TLSH
T1A421AF0693E9471FF0B3473179F6172FA274FD69EFA2A75B458402293C41504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_g5f01v3x.pvk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g5f01v3x.pvk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dat_35150_4964.vbs

Path C:\Users\Admin\AppData\Local\Temp\c6zo1d7g\dat_35150_4964.vbs
Size 228B
SHA256 29d4209e6ac4ffd99678c0fb0e310d9c32d001772e1b899272accb09081d9bb9
MD5 795393687e6ca69ce14ac4a345548fe2
SHA1 e0721b738e114af7d6a724879423d870c86c6d73
SHA512 6bd877d36640f7c7a764265f776ab93a04cd170b8c4e1da8a0998933731645af9df9e8929aa1ee8d60cedff578776b3cb9f045a3baaca666e37bfeee5b8d7967
TLSH
T169D0A7146579E20CAD29C5390166926C8593D4A936042751A7509A04BEC12B9CA5954D
MD5 SHA1 SHA512 TLSH

Submit Download

dat_99613_4925.ps1

Path C:\Users\Admin\AppData\Local\Temp\c6zo1d7g\dat_99613_4925.ps1
Size 68KB
SHA256 17685a0b5eb239871b3f89f3cf9c91dcd3bc203b4d42741c04ab43934074f122
MD5 d9e524c9b91e89845b87255a4c4ca250
SHA1 2fda7b397829ea3a66a4f8248197594931bd4a45
SHA512 14b0a340fb6f217582155584f2f8615eb353b1619227aa58f48d9d6f09c556feb6017631b4cbba62f4f78fde87f89309209d50ee576ead61e4ed34eebdf2c73d
SSDEEP 1536:qytSo12JS0whNwICr+MzAC/+MbvzYDypv69cIzHSzB3MzN:xtSoYJ1whNr0+MzACmMjzXN8eBMN
TLSH
T1CD63F10A6DB549FB08D3A779C0E39545EABBE5F750181C48F5EC91C0EF63A1482CE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f45s2h1i.dll

Path C:\Users\Admin\AppData\Local\Temp\f45s2h1i\f45s2h1i.dll
Size 3KB
SHA256 76900d840daf53fa9a6dd209e09808bd014042b4370be2d8dc1ada078b2630b7
MD5 033a386fc550abddb152d0430e815639
SHA1 0d06e1dd4e869fa760cf7b398c4bfeefc988772a
SHA512 8e2b2805281326ce4e7370308f51e7e50d6871a6e6105668107551a3461d200662c726768a2e891ec201bd790479dfd400f971500cc3dc367e1d5a5daf0e27c5
TLSH
T16851A71A57E88A6BE4770B31AEF3472677A4F8109FB2A31E19D01258AC616549A31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC7E2FA22F87C94D618B33EFAE058DE7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\f45s2h1i\CSC7E2FA22F87C94D618B33EFAE058DE7.TMP
Size 652B
SHA256 f37715cb73c8bfb2c839be6801c9c38ad6aacde0e1d574235ba5d3b09ecb798d
MD5 9369f5c0518dc6926a088636bf3d7983
SHA1 0769c2a4cf527f98fcc60b5449b596a1eb5862e7
SHA512 20f2576e5e327abc42c2c880d7b5c782d0942457625ee8d3a5c897b613840df348a8ee4b8b13c79fec7dfbc8f5ea8061f3b4367bf910f6307cbf90cfc3aef43d
TLSH
T1ADF05E4963F8020EF0F34B30BEF6836391A8BC64DE72A3ED1484035928645109972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

f45s2h1i.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\f45s2h1i\f45s2h1i.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

f45s2h1i.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\f45s2h1i\f45s2h1i.cmdline
Size 369B
SHA256 ffb55cbea12f652bdf19f11ff864c62203eff9c2d9088d11e77a9724ce0064f0
MD5 436cf96818fca32351afc6cd0da48c81
SHA1 3d1234900b8541b5a22c435186d8d932f137c273
SHA512 6d557bd46ff042aa70087af97fb74da1ec4aa448252d1ba090604284cc905ef12ea82268a17458f051003a8a799accd43e45bf1689dbd66d407a6962770fddd9
TLSH
T16BE0C02A5346C7FF06DD12073169C4ACD27207473948BF8452E0440DD21740C27D1F51
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-58-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/988-57-0x0000000006370000-0x00000000063BC000-memory.dmp

Download

memory/988-61-0x0000000007560000-0x0000000007603000-memory.dmp

Download

memory/1344-66-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/1524-73-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/1540-35-0x0000000004CC0000-0x0000000004D5C000-memory.dmp

Download

memory/1540-34-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/1540-87-0x0000000006C90000-0x0000000006D22000-memory.dmp

Download

memory/2316-46-0x00000000071A0000-0x00000000071D6000-memory.dmp

Download

memory/2316-45-0x00000000061F0000-0x000000000623C000-memory.dmp

Download

memory/2316-52-0x00000000075B0000-0x00000000075BA000-memory.dmp

Download

memory/2316-47-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/2316-51-0x0000000007490000-0x0000000007533000-memory.dmp

Download

memory/2316-50-0x00000000071E0000-0x0000000007200000-memory.dmp

Download

memory/2316-43-0x0000000005D30000-0x000000000608B000-memory.dmp

Download

memory/2916-85-0x0000000004E30000-0x0000000004F8A000-memory.dmp

Download

memory/2916-84-0x0000000002640000-0x000000000265A000-memory.dmp

Download

memory/2916-83-0x0000000000170000-0x00000000001B0000-memory.dmp

Download

memory/3840-15-0x0000000006900000-0x000000000694C000-memory.dmp

Download

memory/3840-10-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/3840-40-0x0000000074480000-0x0000000074C3C000-memory.dmp

Download

memory/3840-18-0x0000000006E60000-0x0000000006E7A000-memory.dmp

Download

memory/3840-38-0x0000000008D30000-0x00000000092EA000-memory.dmp

Download

memory/3840-33-0x0000000007AC0000-0x0000000007AC8000-memory.dmp

Download

memory/3840-36-0x0000000007BC0000-0x0000000007C56000-memory.dmp

Download

memory/3840-14-0x0000000006860000-0x000000000687E000-memory.dmp

Download

memory/3840-13-0x0000000006380000-0x00000000066DB000-memory.dmp

Download

memory/3840-17-0x00000000080F0000-0x000000000876C000-memory.dmp

Download

memory/3840-9-0x00000000062A0000-0x0000000006306000-memory.dmp

Download

memory/3840-8-0x0000000006100000-0x0000000006122000-memory.dmp

Download

memory/3840-7-0x0000000074480000-0x0000000074C3C000-memory.dmp

Download

memory/3840-6-0x0000000074480000-0x0000000074C3C000-memory.dmp

Download

memory/3840-5-0x0000000005A80000-0x00000000060CA000-memory.dmp

Download

memory/3840-4-0x00000000053F0000-0x0000000005426000-memory.dmp

Download

memory/3840-37-0x0000000007B50000-0x0000000007B72000-memory.dmp

Download

memory/3840-19-0x0000000007AA0000-0x0000000007AB6000-memory.dmp

Download

memory/3840-32-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

Download

memory/3840-3-0x0000000074492000-0x0000000074493000-memory.dmp

Download