xworm | 173b77f1dcd92e85897552c2e66591d8bca664e0f1147a80cf5f2b75a9f2511e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MB321883405AE.js
Size 239KB
Sample260819-gr96kaen2x
SHA256 173b77f1dcd92e85897552c2e66591d8bca664e0f1147a80cf5f2b75a9f2511e
MD5 4bb7f710a426b7b043dfb71b3f7f561e
SHA1 0e1e558357d3aec966c328eccedf594b99fc84c6
SHA512 610325a85f2b63f15e9815f5916a36a6bbfd03a7f71f33405405d78078a39fcfbcf60942f21e879594f3e1781a2ad79d467e07fffe4cd2f9ae056aaff4f16601
SSDEEP 6144:PcAGrlr3Ze1LIR5jp8Cd9AmHsgh+h0Dyxn/6tJ9G1:kAHSd99AmHp+8yB+jG1
TLSH
T1A9349EA05336964FB56B94F40D5F3B0790DBAC2BE8B4A6918F12C9E3791B4D1C874B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:1012

Mutex

aGO284VKfQVe8Vup

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4312-33-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4036	powershell.exe
840	powershell.exe
5324	powershell.exe
1168	powershell.exe
5348	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	MSBuild.exe

Executes dropped EXE 4 IoCs

pid	Process
3856	bin.exe
5820	MSBuild.exe
2640	bin.exe
4580	bin.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5348 set thread context of 4312	5348	powershell.exe	93

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5348	powershell.exe
5348	powershell.exe
4036	powershell.exe
4036	powershell.exe
840	powershell.exe
840	powershell.exe
5324	powershell.exe
5324	powershell.exe
1168	powershell.exe
1168	powershell.exe
4312	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
4312	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe
5820	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5348	powershell.exe
Token: SeDebugPrivilege	4312	MSBuild.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeIncreaseQuotaPrivilege	4036	powershell.exe
Token: SeSecurityPrivilege	4036	powershell.exe
Token: SeTakeOwnershipPrivilege	4036	powershell.exe
Token: SeLoadDriverPrivilege	4036	powershell.exe
Token: SeSystemProfilePrivilege	4036	powershell.exe
Token: SeSystemtimePrivilege	4036	powershell.exe
Token: SeProfSingleProcessPrivilege	4036	powershell.exe
Token: SeIncBasePriorityPrivilege	4036	powershell.exe
Token: SeCreatePagefilePrivilege	4036	powershell.exe
Token: SeBackupPrivilege	4036	powershell.exe
Token: SeRestorePrivilege	4036	powershell.exe
Token: SeShutdownPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeSystemEnvironmentPrivilege	4036	powershell.exe
Token: SeRemoteShutdownPrivilege	4036	powershell.exe
Token: SeUndockPrivilege	4036	powershell.exe
Token: SeManageVolumePrivilege	4036	powershell.exe
Token: 33	4036	powershell.exe
Token: 34	4036	powershell.exe
Token: 35	4036	powershell.exe
Token: 36	4036	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeIncreaseQuotaPrivilege	840	powershell.exe
Token: SeSecurityPrivilege	840	powershell.exe
Token: SeTakeOwnershipPrivilege	840	powershell.exe
Token: SeLoadDriverPrivilege	840	powershell.exe
Token: SeSystemProfilePrivilege	840	powershell.exe
Token: SeSystemtimePrivilege	840	powershell.exe
Token: SeProfSingleProcessPrivilege	840	powershell.exe
Token: SeIncBasePriorityPrivilege	840	powershell.exe
Token: SeCreatePagefilePrivilege	840	powershell.exe
Token: SeBackupPrivilege	840	powershell.exe
Token: SeRestorePrivilege	840	powershell.exe
Token: SeShutdownPrivilege	840	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeSystemEnvironmentPrivilege	840	powershell.exe
Token: SeRemoteShutdownPrivilege	840	powershell.exe
Token: SeUndockPrivilege	840	powershell.exe
Token: SeManageVolumePrivilege	840	powershell.exe
Token: 33	840	powershell.exe
Token: 34	840	powershell.exe
Token: 35	840	powershell.exe
Token: 36	840	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeIncreaseQuotaPrivilege	5324	powershell.exe
Token: SeSecurityPrivilege	5324	powershell.exe
Token: SeTakeOwnershipPrivilege	5324	powershell.exe
Token: SeLoadDriverPrivilege	5324	powershell.exe
Token: SeSystemProfilePrivilege	5324	powershell.exe
Token: SeSystemtimePrivilege	5324	powershell.exe
Token: SeProfSingleProcessPrivilege	5324	powershell.exe
Token: SeIncBasePriorityPrivilege	5324	powershell.exe
Token: SeCreatePagefilePrivilege	5324	powershell.exe
Token: SeBackupPrivilege	5324	powershell.exe
Token: SeRestorePrivilege	5324	powershell.exe
Token: SeShutdownPrivilege	5324	powershell.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeSystemEnvironmentPrivilege	5324	powershell.exe
Token: SeRemoteShutdownPrivilege	5324	powershell.exe
Token: SeUndockPrivilege	5324	powershell.exe
Token: SeManageVolumePrivilege	5324	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 5348	4068	wscript.exe	89
PID 5348 wrote to memory of 700	5348	powershell.exe	91
PID 700 wrote to memory of 2316	700	csc.exe	92
PID 5348 wrote to memory of 4312	5348	powershell.exe	93
PID 5348 wrote to memory of 4312	5348	powershell.exe	93
PID 5348 wrote to memory of 4312	5348	powershell.exe	93
PID 5348 wrote to memory of 4312	5348	powershell.exe	93
PID 5348 wrote to memory of 4312	5348	powershell.exe	93
PID 4312 wrote to memory of 4036	4312	MSBuild.exe	94
PID 4312 wrote to memory of 840	4312	MSBuild.exe	97
PID 4312 wrote to memory of 5324	4312	MSBuild.exe	99
PID 4312 wrote to memory of 1168	4312	MSBuild.exe	101
PID 4312 wrote to memory of 1756	4312	MSBuild.exe	103
PID 4312 wrote to memory of 4588	4312	MSBuild.exe	109
PID 4588 wrote to memory of 5444	4588	csc.exe	111
PID 4312 wrote to memory of 5820	4312	MSBuild.exe	112

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MB321883405AE.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\xsx6wavq\cfg_99698_51c7.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nnbba1mj\nnbba1mj.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA3C.tmp" "c:\Users\Admin\AppData\Local\Temp\nnbba1mj\CSCD5D250E04A834ED1B8366026C5FBF77F.TMP"
      4⤵
      PID:2316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Creates a file in the Startup directory
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:4312
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4036
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:840
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5324
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1168
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1756
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_dc92245943524ccd94c09b13a42df044.cs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3605.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC355CD70614B84C9194A51DE7C3BEEB.TMP"
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\MSBuild.exe" 4312
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5820

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3856

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 23997c8dfa0695071605d8f2a760272852bfc98a3a396ca4fbc5930430233c39
MD5 f067bfc9e23c1572a2324f5edd7d2dbe
SHA1 a5eb790215cbefd429c0341bd7e732388f83731c
SHA512 6a580d2fcb29ccbdd20d9cdb3a7f28594a514277bad11677e73918094bc13402c094cc267786d69e644b7f4dadedbac4afca3e63b3cf8e60c47671ad3f75e733
SSDEEP 384:R1XBaGX1iBuy4bkospxsFWbwe/r2PnBIAEr4KhgN+fJzmz9patlGkqbKCV3fbhN2:LXnF6urYoQxTbp6ZIAErrgNyJzEyzqmV
TLSH
T19A92B768513F6DC7D8D122B410D602E7FFE4D088DB7551A4EE2BDE3B1C90ABA4FA1520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3e4de42e9643a8f7879697a53f0241838ffc46efdb60ff029ed0c95b6f7f6ed2
MD5 58d5ded613f47a6dad91089ede3f738a
SHA1 e5ca4a64ccdece92a404a68dff15695d445dd0d9
SHA512 e9dd754a78f3d6decfb82b514e80d3ce3a0902f6988b98a84c4ea6a023de079c571a3d5eed54bf74e020fa55d791ea4489e15721907bb3c23e95f3045ce13ba6
SSDEEP 384:BSEboT1iBGqnib1IWGl3+jZ+sJKONhR2VWOEPiUDzdC0OK9JRWbCtuwLHbhNaAW6:n0Z6G0i5FjF+sYQSUN6UFC0ftVTbhNay
TLSH
T110A2E66C202F5CC3DC9211F415910BEAFBB8D44ADAD651D9B79ACE2F4C80ABE5E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 d7cd86e372aa68468eecd3ac3287142cc2772c630e17f18e23c5b4a270491221
MD5 f16d9c4c258d3bfd5d85230150de319f
SHA1 fd4ca587c8ef4eea5ed4182735deeffc724c210e
SHA512 638a3a3286572cc8d13a5096b84c2d4f968ef496d302979c5c65cd8e6ef2cc93ee0bff9d129f00a4e53efad0a546d3605dc79311ef18bff75425882f38cecbab
SSDEEP 384:dSEboT1iBG4Zyh64Sp+s+4BER2PgWOEPiUDzdC0wIACOII+pbEoaqB3KFptv27hz:z0Z6G4Zy64S1+4RZN6UFC0wIAXD+OoaO
TLSH
T1ACA2192D226F9DCBC89121B410C2439AFBE4D199E7E252DBEB4BC91F1C41A7E4E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 fd21789f423fbaab909900b3324ed9d1ac56b069a2caf0ba4c4a41ae9eac6c10
MD5 f5d89bade76893bcd645c301772c7048
SHA1 16b2ae669962810aa241a88935f66edbfc438cdd
SHA512 6bd8556f2e3b67834b2ac3913bf12be8eb1eb5b41ca631fc7a387c562c044655470bd7c9f99d3a919ce7aeca12974cc0cda04f352de412d62261748932b88526
SSDEEP 384:rSEboT1iBGKGW14bPyM0Pwk+geca5v2VWOEbDzdC0MIAgKIPbQNoaqB3KFp9v2sG:50Z6GRWi770Pf+j5eUNbFC0MIAgKhNo1
TLSH
T115A2F61D266F98CBC49161B410814387FBE8D568E7E252DBBB4FC91F2C41A7D9E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
Size 5KB
SHA256 cd70971a3b3a6b4f93599843345d1f9de53823b66051510cf290a017042fa153
MD5 294662116c92656bb5382c201316f88b
SHA1 e6dbf4a629aaa6c703071d140b9489b442e3d98a
SHA512 f0b12958810434b17b7535c6c8165818ccc10c55d4ddc5d2ffc99e7cc1f90d838c17a20a8726504cd957d9ff3af5c05c76d10415dd74e64d0aee259d9001db5c
SSDEEP 96:Cdew7V9bMLEgUyXqd8BynqgHlNxjEQn7yxx4zNt:CvkLwuUoyqgHj+A7Ka
TLSH
T17BC1C44697D847B7D066077078B3031167B8E812AA7BA79F29E4137A7EB675008033B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3605.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3605.tmp
Size 1KB
SHA256 5337f49c2d03f1d83696b57b3425a1ae79d393dbe59cd08e7a4728dbea712623
MD5 a84c569187290b6d4936854867614f7e
SHA1 5e4d1acf230f4cbc271e02b2ca6a3b5a6c23bd61
SHA512 11e8b3c5c62c01f00f618efea48c5b0615f34014c12dfc740fa292afe97595ec5f070a156224772c3c3ee5176f30317001349c65852552d65eea85f040033b3f
TLSH
T19041750083D84B1FE172433129F78319B678BE569E9A436EB484122F1F12740DDC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESCA3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCA3C.tmp
Size 1KB
SHA256 8ef1dbdb078d6578bee81e55fc44e47e8b7ca1642eccd0e83741bb737728433d
MD5 27bd95609a89aeb875c7e69ca8039571
SHA1 5f8ddb6bda57e82727ccf17c023f7acb1e5a6945
SHA512 733fff249880046e130916c6dc8a2c909411e8aeadf82b97bd682ba439793e58ea2d88417c718e980ce5bf8713e1f9ade3f1e7a3d95581ff5983a1edb92be5fc
TLSH
T1EF21AF0593E8470FF07357326EF6536FA278FC79EFA2935B858042282C51144EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1p5rlmwl.t1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1p5rlmwl.t1c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nnbba1mj.dll

Path C:\Users\Admin\AppData\Local\Temp\nnbba1mj\nnbba1mj.dll
Size 3KB
SHA256 e2515b56dde2389b8f266ac5115a25eeb7104818a6b090de9d776a9944de490e
MD5 16721504fcf75bed369b0f0a0972349c
SHA1 d8b018b27c1559ad9b4e395ded345e1f1ef31fa8
SHA512 27b08e07bb875868a38e8351e161f84947bcd514dc8700083db3f2f4069e7df2ec7d6733c61ad100e507251869a41371e4c973747174481737820113d41f666e
TLSH
T18F51DD0AA7E84A2BF4730B35ADF3472777B4FC109BB3A71E1D904218AD616544A31BF0
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_99698_51c7.ps1

Path C:\Users\Admin\AppData\Local\Temp\xsx6wavq\cfg_99698_51c7.ps1
Size 68KB
SHA256 55d68f8d59fa33b02bc83890c27cb586abab256a62ef67e4f1cbb4ee6c136ee3
MD5 e69783b095d8ed4d99d028f2885e0fcf
SHA1 894283334c30451ce8e1ac41d3844f726a41abc6
SHA512 7f521aaee5b00f3dddf4cdce2dc203d68bb78824cfdd76a042c266f415ca8ea412d483a9b34ef27d96301ff5b87e327b058056c64ca09b7b990d286e99878dc0
SSDEEP 1536:Pwea4Fdml+qaoHwXWX3uFklNLYzb1521wMzi:PwKFd1oHwXWX313LYv1c19i
TLSH
T14863015779AAA5EF06D71879EDF3054254C8812B220F188937CDB7C33F5D1348AEBA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 249KB
SHA256 151d0125c20cdde578d02de3f2a56eb904870a887bb7f1c59bf61471da231916
MD5 f8e68d6abe411ce0c71d6b8c1c1b9048
SHA1 77360aa532c299f636f424a2866016ee6bd5c09b
SHA512 3e6c59395c8c5f07d39db829aa335420ffe426fb9a4ab831cfe1273e803afd5f91912ee341e01b4e108b298349bdeea9e7e52874b05fa1723ebc408be896b650
SSDEEP 3072:6DEKKwBWmSEoRooC7GvORoQYiY35e8w2XpFU4rwOe+ZbZEFf02RFivFuv4GuhK:UHK2W0u1tvORstRXfM102bicw4
TLSH
T103446A01A7EC4615F6FF1A78B8B015158B76F867E866E35E388C61AC1F73740EA60363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC355CD70614B84C9194A51DE7C3BEEB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC355CD70614B84C9194A51DE7C3BEEB.TMP
Size 1KB
SHA256 a50a6f311d400c946c1444ca8be5df32c74461ece7f9e3b2b69446225a4d633c
MD5 61ffdac7eb1b54e0938a74d4496e4656
SHA1 5cffc47f2d55e1eb59f739c1eee23d4be1c9a200
SHA512 1afdfbb13c0e91288f1d5431aa58768987407556a0d9a1e05e5f52ace77446ac0e5ddfa845e22b6ab229f779dbcb64f3d751b79daaa31893bba5589013b8e12a
TLSH
T14C21AB41A2E8421EF2B3477079F2C363A16DBE569D7A43EC7888175F2F25A1085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_dc92245943524ccd94c09b13a42df044.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_dc92245943524ccd94c09b13a42df044.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCD5D250E04A834ED1B8366026C5FBF77F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nnbba1mj\CSCD5D250E04A834ED1B8366026C5FBF77F.TMP
Size 652B
SHA256 7306bd828a01376e9b5933eba0a7c29f4f6ad78003d3a8ebfadacf6f2bd43856
MD5 8e86e56fe537350cbcfb9abb58fa3eeb
SHA1 68ff15a9ad9155dd35edf6a0df0b55ac5c8baff8
SHA512 c914de6502009d1e53e2d14e7a512eefbb755cbb8671ffb8a7f20c846af8cedd9b8754f29d2d1964ef4dbaba00d06280088cb2f5129b9be616088ba01ce7134e
TLSH
T15FF05E0963F8120EF0F34B31BDF643A391A8BC65EE7293ED1440431968645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nnbba1mj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nnbba1mj\nnbba1mj.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

nnbba1mj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nnbba1mj\nnbba1mj.cmdline
Size 369B
SHA256 56370b000fc3908ef0235f0ba1fcb9ae7fbc313bbb73bd3eaaa1daa00bf4ccef
MD5 11156513212fa9f40354c689f4c4829f
SHA1 d517a429d65a9b58823dcb1ffa1215cda97dca5d
SHA512 f923f9de70fc116f35ab1cadfdfa4344f6f64526391609ca625476387e02cd217a0fcfc619dc4672492d606a180feccce38941860b21bcc661a2af6724731c5a
TLSH
T1B2E0683EA386C2BD81DA180F256AE4AC82730A432B40BF8C9161444DF1170086BD37C9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-56-0x00000000703B0000-0x00000000703FC000-memory.dmp

Download

memory/840-54-0x0000000005FB0000-0x000000000630B000-memory.dmp

Download

memory/1168-70-0x0000000005BC0000-0x0000000005F1B000-memory.dmp

Download

memory/1168-72-0x00000000703B0000-0x00000000703FC000-memory.dmp

Download

memory/3856-83-0x00000000054B0000-0x00000000054CA000-memory.dmp

Download

memory/3856-82-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Download

memory/3856-84-0x0000000005680000-0x00000000057DA000-memory.dmp

Download

memory/4036-45-0x00000000703B0000-0x00000000703FC000-memory.dmp

Download

memory/4036-48-0x0000000007570000-0x0000000007590000-memory.dmp

Download

memory/4036-50-0x0000000007750000-0x000000000775A000-memory.dmp

Download

memory/4036-49-0x0000000007630000-0x00000000076D3000-memory.dmp

Download

memory/4036-44-0x0000000007530000-0x0000000007566000-memory.dmp

Download

memory/4036-43-0x0000000006930000-0x000000000697C000-memory.dmp

Download

memory/4312-87-0x00000000076B0000-0x00000000076B8000-memory.dmp

Download

memory/4312-86-0x0000000007610000-0x000000000768C000-memory.dmp

Download

memory/4312-33-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4312-34-0x0000000005360000-0x00000000053FC000-memory.dmp

Download

memory/4312-99-0x00000000083E0000-0x00000000085A2000-memory.dmp

Download

memory/4312-85-0x0000000007470000-0x0000000007502000-memory.dmp

Download

memory/5324-64-0x00000000703B0000-0x00000000703FC000-memory.dmp

Download

memory/5324-62-0x0000000005780000-0x0000000005ADB000-memory.dmp

Download

memory/5348-17-0x00000000073B0000-0x00000000073CA000-memory.dmp

Download

memory/5348-13-0x0000000006260000-0x00000000062AC000-memory.dmp

Download

memory/5348-37-0x0000000008670000-0x0000000008C2A000-memory.dmp

Download

memory/5348-36-0x00000000074E0000-0x0000000007502000-memory.dmp

Download

memory/5348-35-0x0000000007550000-0x00000000075E6000-memory.dmp

Download

memory/5348-32-0x0000000007440000-0x0000000007448000-memory.dmp

Download

memory/5348-31-0x0000000007430000-0x0000000007438000-memory.dmp

Download

memory/5348-18-0x0000000007400000-0x0000000007416000-memory.dmp

Download

memory/5348-1-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/5348-16-0x0000000007A30000-0x00000000080AC000-memory.dmp

Download

memory/5348-15-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/5348-39-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/5348-12-0x00000000061E0000-0x00000000061FE000-memory.dmp

Download

memory/5348-11-0x0000000005D80000-0x00000000060DB000-memory.dmp

Download

memory/5348-7-0x00000000054A0000-0x0000000005506000-memory.dmp

Download

memory/5348-8-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Download

memory/5348-6-0x0000000005400000-0x0000000005422000-memory.dmp

Download

memory/5348-5-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/5348-4-0x0000000005510000-0x0000000005B5A000-memory.dmp

Download

memory/5348-3-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/5348-2-0x0000000004D00000-0x0000000004D36000-memory.dmp

Download

memory/5820-98-0x00000000003F0000-0x00000000003F8000-memory.dmp

Download