ratonrat | d13ac483eba31885fe6d7eff5c4c26de8a0a1542dac420ab7654e15f522286af

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/09/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ratonBinded.exe
Size 11.9MB
Sample260921-v2aeksvt7p
SHA256 d13ac483eba31885fe6d7eff5c4c26de8a0a1542dac420ab7654e15f522286af
MD5 c0b0183032fa35540a9ef1ac994bdd7b
SHA1 bfa1b783309db182a56c41af7f1428bdef46e5b8
SHA512 ff63ead48fdc863226f4f639ebfc15d123fdf8d336bf89ae750ee56248aac3c0272a61a00037a7dbbacaeb960dc4e9dff8b7af4cfa6f9d4551f14e96e385c00d
SSDEEP 196608:GLgVzHASj5zRJewIfgGgam1z73iv1TgbUvnt/rJ9C1td:8IHL1JFI4Ggam1z73iv1TgbUvnZJ0/
TLSH
T13AC6AD15A37800D8D4ABC2B8C7465653D771784A03B0ABDF0A90AEE52F37EE51E7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

ratonrat

Version

Professional

86.100.111.230:3373

Mutex

T87STatfMISIyHpgW0eWw8s

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
password
t.me/junk_code
process_critical
false
raw
silly21
reconnect
3
startup
false
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/632-0-0x0000000000DA0000-0x0000000001990000-memory.dmp	family_ratonrat
behavioral1/files/0x0007000000024530-4.dat	family_ratonrat
behavioral1/memory/5848-10-0x000001D1328E0000-0x000001D132B56000-memory.dmp	family_ratonrat

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity__td3vw.lnk	neverlose.temp.exe

Executes dropped EXE 4 IoCs

pid	Process
5848	ratonClient.exe
5084	neverlose.temp.exe
4696	neverlose.temp.exe
5176	neverlose.temp.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate__2dgue4ga = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeCache\\7f5bed93\\neverlose.temp.exe"	neverlose.temp.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	neverlose.temp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	api.ipify.org
9	api.ipify.org
81	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3272	powershell.exe
3600	powershell.exe
3080	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5532	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2028	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3416	schtasks.exe
5584	schtasks.exe
3988	schtasks.exe
4696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1836	powershell.exe
1836	powershell.exe
3600	powershell.exe
3600	powershell.exe
5084	neverlose.temp.exe
5084	neverlose.temp.exe
5084	neverlose.temp.exe
5084	neverlose.temp.exe
5848	ratonClient.exe
3080	powershell.exe
3080	powershell.exe
3272	powershell.exe
3272	powershell.exe
5084	neverlose.temp.exe
5084	neverlose.temp.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	ratonClient.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeRestorePrivilege	1520	7z.exe
Token: 35	1520	7z.exe
Token: SeSecurityPrivilege	1520	7z.exe
Token: SeSecurityPrivilege	1520	7z.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 5848	632	ratonBinded.exe	86
PID 632 wrote to memory of 5084	632	ratonBinded.exe	87
PID 5084 wrote to memory of 3416	5084	neverlose.temp.exe	89
PID 5084 wrote to memory of 5584	5084	neverlose.temp.exe	91
PID 5084 wrote to memory of 2040	5084	neverlose.temp.exe	94
PID 5848 wrote to memory of 5532	5848	ratonClient.exe	109
PID 5532 wrote to memory of 2028	5532	cmd.exe	111
PID 5084 wrote to memory of 2372	5084	neverlose.temp.exe	115
PID 5084 wrote to memory of 3988	5084	neverlose.temp.exe	117
PID 5084 wrote to memory of 3524	5084	neverlose.temp.exe	119
PID 5084 wrote to memory of 2304	5084	neverlose.temp.exe	128
PID 5084 wrote to memory of 4696	5084	neverlose.temp.exe	130
PID 5084 wrote to memory of 1716	5084	neverlose.temp.exe	132
PID 5084 wrote to memory of 4840	5084	neverlose.temp.exe	139
PID 5084 wrote to memory of 1520	5084	neverlose.temp.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ratonBinded.exe
"C:\Users\Admin\AppData\Local\Temp\ratonBinded.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\ratonClient.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\ratonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2028
- C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks for any installed AV software in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "MicrosoftEdgeUpdate_vz3" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe\"" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /create /tn "VoidDcr5084_0" /tr "\"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\\\void_dec_VoidDcr5084_0.ps1\"" /ru SYSTEM /sc once /st 00:00 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /run /tn "VoidDcr5084_0"
    3⤵
    PID:2040
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /delete /tn "VoidDcr5084_0" /f
    3⤵
    PID:2372
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /create /tn "VoidDcr5084_1" /tr "\"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\\\void_dec_VoidDcr5084_1.ps1\"" /ru SYSTEM /sc once /st 00:00 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3988
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /run /tn "VoidDcr5084_1"
    3⤵
    PID:3524
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /delete /tn "VoidDcr5084_1" /f
    3⤵
    PID:2304
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /create /tn "VoidDcr5084_2" /tr "\"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\\\void_dec_VoidDcr5084_2.ps1\"" /ru SYSTEM /sc once /st 00:00 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /run /tn "VoidDcr5084_2"
    3⤵
    PID:1716
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /delete /tn "VoidDcr5084_2" /f
    3⤵
    PID:4840
- - C:\Program Files\7-Zip\7z.exe
    "C:\Program Files\7-Zip\7z.exe" a "-pd28dfcb2c9d8271a" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\535cb1-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\*"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1520

C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe
C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\\void_dec_VoidDcr5084_0.ps1"
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe
"C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe"
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\\void_dec_VoidDcr5084_1.ps1"
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\\void_dec_VoidDcr5084_2.ps1"
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ca3rywxe.1fm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ca3rywxe.1fm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp2987.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp2987.tmp.bat
Size 182B
SHA256 6b83a5bbd6de02004136938800db3dff7b10ad12575f754a53a0bb2a050babd8
MD5 153f8338d107649c4bc417fdd5c4d49e
SHA1 5231386ec9fb00fdb8499d2ece63490314aa1dd8
SHA512 645440be24b80abb27f01eec84b654c94fb346801622ed03389c3c8d62156276a740fcae36706e83f3ce39c23d9b58828c5946a530f3b34650897d70546ddcf4
TLSH
T174C0C04039C4F219150130130375D0CEA077DD162E006F90870C4408740040DE0B4300
MD5 SHA1 SHA512 TLSH

Submit Download

535cb1-Admin.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\535cb1-Admin.7z
Size 7KB
SHA256 6553c24af61246ca44ea30ce50275b51454818b2f6493687d39182f2d469def8
MD5 b04e6ad730e0d3033a7bbf51da8a6d15
SHA1 fe146404cc50c5b9b41c53994a4458ab0952802a
SHA512 183b70ee2638bfe5c6c98dbad17963fead1ddfa3f3add1119cc767ae029a1b5296bfa021875037bcbcc6fc49eb24763749de37a43a719fa37f1133fb2f4f3aec
SSDEEP 192:hmCEhy1IIY0E+sfRZ3HvELXtaJ8sKBprEavUwf5COOxg2hQQR4e6VE3K:hmHItE+sZFvELXta+DrEwfVKnhQQR4r3
TLSH
T183F1A01EDBE0F0048A270EFF305F4AB3516310E33E82609FF955704E47D9563A425142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Browser\Edge\Cookies.txt
Size 46B
SHA256 03268110152a71fcd4381f83056c18feecb75ddcdfa7e6bd7a10e89e31ee82f5
MD5 98e2d6e63d7f3f1709b09f345f125932
SHA1 83ebec55666174bd19ac1b1e090da18028f84f20
SHA512 80dcf55bc32ab6657d5aa2244b09cac00a5cad4e507ecb891bb2dfa534ea272be4f6943f91b28cc92cca05dbb8bd4ec13730878dcab8ab7194140767e53baf3d
MD5 SHA1 SHA512

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Browser\Firefox\Bookmarks.txt
Size 367B
SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
MD5 1e5809dc37fdb89a5f31aefd8d07e742
SHA1 7d7e459b5709f8480d7b4100ce232c2ce1e5d1ca
SHA512 e76ec273e7a47a9ef0bd69e36c44a601bc49a51005a2263c1f1d2c115c7702045e55a8d70518b750ae8fc4ad5aae23dcb116a5f322cd7f6922f52434e985128e
TLSH
T1F1E0D8A3627241EB4F018B1870297A16644B8708DFF959DEE046247244A93A440E6B4C
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Credentials\Edge\cookies.txt
Size 48B
SHA256 1a3b7780ecb9da83dd34690f42fb15049b780584ace80f1b26996278c55ba3dd
MD5 3fec78c5f79d0ffb29a66ad394ec3f4e
SHA1 99ca84bc57dc00f0ee025994fd2753dd76e95a7a
SHA512 607b36b2a191579e2036dc72f00fdb078c6fbd375db0d7d16a6f36bfd3da2327e44bc41eede58825a7d525aac87944aeb772598c942e619a2a9818109a0461d7
MD5 SHA1 SHA512

Submit Download

email_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Credentials\email_clients.txt
Size 205B
SHA256 57f1d3bd9f4d61539d2d12ed9aee27089e0d03e633dc753db2f069387386494c
MD5 cc7dc519fbe0b2bdd760ab02fc338482
SHA1 a80b9a25205ef80c313a20d7a9fded63de433379
SHA512 0eaef6d35ff72bb291a7f7c5e22d9bcbdcc1483b9b3399b3a4aeef0ef87ff6adc8378865f5d41208ef567b80e2fe4e94c7c3ad4d1358fd01de07e62f8450287a
TLSH
T1E1D01286432EA0238830FDD03611C6E83B96400A35972AC3108DEF0C42070A267EE49F
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Directories\Desktop.txt
Size 1KB
SHA256 d2674a36ab6e22dd34ee3c75a96d88e1406421d79b6d0fa1a4bf7d3b3a81eb48
MD5 6912e54a2993666ba6904c34a6da71c1
SHA1 2bc9598b5c85c9c2c405094d1018918283e9a9cc
SHA512 d848e733d7aeaab73f6957a3db2b41190431ccf766c87f0bb8e49bb846d694811cd31e59c3635987776f6411d5baadbd906fbdce6e5eb8aa9eb2713afeab2474
TLSH
T17B11CE8B5530DF1B29616EE90BA9F44702DC4DCAAE68FA623BCEC9760353605D035C16
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Directories\Documents.txt
Size 1KB
SHA256 caa518f6f0afa43799bd2b86d0674c5785b0181c48f2ea03489bf9a231860a1b
MD5 1886fdf838b396e306247534671c4ef8
SHA1 ecddf2ec12cdd4c4708fe09cfbeac21c52d3d410
SHA512 ac7f104e23825a727a16bffc25150c3dbc94ff13b9c46790caa8d66b10208a80eadaced23fd7fb156618f944f3bc1411d07d5b9f8ce71bf34f78f2551871534f
TLSH
T1461150CD5935EE1F18829EA55761B28306C90DCDDF76F59B37DFDD944043961A098C03
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Directories\Downloads.txt
Size 1KB
SHA256 8455dbd8bee3e1fde65c80c2a0e7499b0e7384e1a90a3d435a5da1c70f5dfb5b
MD5 cbabe098bb47657a04656c14850cb35e
SHA1 36d499fbe0bbed621cae26d62eddb601a4945b62
SHA512 c9e825a0e5ee84cc4f3b7f8778caaa50c685eedbe046e36a19026b29514a41efa6d14e9b0d32bf5dcb91a70e97abde6645d4f2012aa6c93b20d1b77c3ede140f
TLSH
T1862174E954B8DD2D3545ABF817A07E0309CA11C65CF0D2257BEECC74420EB1F01A6417
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Directories\Music.txt
Size 1KB
SHA256 6652284ff3b5d1c06ee0226e391ebef17e3c3a98bbe0e5ee45d923699b29472f
MD5 36778bc634f0e4fb329cb2dee931b696
SHA1 ebe13ba20cfacff602ff046dbf469ffd202ba613
SHA512 2dc36946cdcf8912fe01b77e4af0f62a4840aa8c1dcb35975b3005d4b8424d9a929bd2bbc31cfeb8d4b80be74127f7045d61b5722c2fc102c59c05eeba0f125e
TLSH
T193213208D63AEDBE4FD293790B20BA4796D958CE3EB1D27337D7CCB29201E065422803
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Directories\Pictures.txt
Size 653B
SHA256 d7cc998c3d0546d754412f50346a92f54e9ef7ea7f8784d1a132708c8adf9613
MD5 cb406795ced24426edd4d608901807f4
SHA1 904f67d199ac4131316aef35fed90d9ad3d19000
SHA512 88fabab9d421826d44ab5c8294079861493f631d75cb145311efc15382ec91f59a42cccc87225845c9467d0b0f5f5cd2a6a79a947de837bea46932f269433f5d
TLSH
T1C9F0A2093FAEDC222E450AF91736B5CB84C41CE61E42EDB333CD5D814A4665F8562C87
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\Bookmarks\items.txt
Size 467B
SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
MD5 98dea30b7155d5ace37749f44523438c
SHA1 6f9e7de66f62d2792eefcc130d844199d1dad0f1
SHA512 8d105b4804e6aadb379961a181effc9c6592f182ba34de63fde293d88d2591215d0b9634dfd483a63af381f989188214f91ce583e9903634fa21f343d64de519
TLSH
T156F0A763E5F1C5AD0F508928F5143109168B670CCBD9517EE046383269B63D810EC3CC
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\Email\items.txt
Size 239B
SHA256 fdc5156be618cad3a6dc864d09ad0f201851cc264694f0869321b17a6fabb562
MD5 6e81ec8acf6e71124eea77e8aab6c0f3
SHA1 8306b6163bfa65ad637caa33f70c94b9c41bf96c
SHA512 c2f2a93957a955d7dc3f2db408f8a9ed74de39a5da37eec1816d90de2d76c625aaa4d037f1b0303c992a1494d28cb17b4613c6faaced805e176054643cf194ac
TLSH
T116D0C702D96DE1234570BC992E50C6E03B6F041E745756F744E6FB4876331EA42FC1AE
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\Environment\items.txt
Size 655B
SHA256 03556c9835c4f62d89020de010f811e4f2039d02187878ec33fe02f48b4dcf24
MD5 95f886449516eb769314480ebc396e20
SHA1 bddf52f804bb70d5737f9b1741cafbddf15ffb1a
SHA512 83d7b982e86ec01772413a044c38a453fd55853303988e2c39c4987711044f6eed3ba78975d0d5b1e361efdb86b388ecf5334c994684f23b885460621af8dc15
TLSH
T19FF03126ECD4F2BE14F0E63D1D9311488979281CEA49273BE2B3661F3E7443C97C9689
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\Fingerprint\items.txt
Size 429B
SHA256 fde2f300429c335659d51122b3ffac248439322802ac99b858c14d76c4abd0e8
MD5 31300be6064a71f0595674a2368980f8
SHA1 7882f502c208621f957f9a71b5ec7f7634e33a51
SHA512 08e061fab91a74a1fe408a1596420cf1efab4ddd67997b0b09d36595c49084ee8d0ce21e53890c614a0c3bfb238761c6bbef62c6f0fdf8e9d105585ddfb8eaee
TLSH
T1B0E02232EAE8C0AF2C64D43D0D629660132A382EC044437EC0EBA03E3E3115C52DC70B
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\Processes\items.txt
Size 7KB
SHA256 3dbf2093ea0e2fa56911128c95b07cf6fb01c00da05f10b9dfebc0388178a177
MD5 93e5816a92ba248f4c8e6fec88a57fa3
SHA1 7bfbb561610743bea8fbe04d1a7f9307bb4b44cf
SHA512 778d81defe5ec500c40758625514eeb2385ae4efa933f7b3914bb1e1a8c2939b49d6a9d9b4707b220303b160638e9fbd1041afc97e72841dfbd7d9d83891b7df
SSDEEP 192:Vq54axIqQbKpN4tVYnc5AntVsV+kn3GA0Pl+L2LQq7pg0K6nbenWqGL8pwn72+0n:Vq54axIqQbKpN4tVYnc5AntVsVXn3GAv
TLSH
T19DE1AE21E9EDC09F157481B71AB1401316EF1D1DC009C5FABE9AD8B97E3424FD2EAE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\ProductKey\items.txt
Size 199B
SHA256 102c44f103ccdf3a7af524686a06ed1bd5c5751f99512fcd3f3ee2fd67dab660
MD5 ebfa84d2348d6b328bdd6b755814ee03
SHA1 0a24cf4786c1de98220d2ab514230512c10e0208
SHA512 54d620b196cd8703ff511398bd93cc8a7142437ba698c85f81c233b109799367c3e35ba0a44a4f8b41282e3b36dcab02561fd0d412f62fc394664f521e0ff874
TLSH
T1C8D012A1CCB9C52595B4446354AF2781261E34BFD0895475A4D2A155BD70A0E4395268
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\Other\Software\items.txt
Size 2KB
SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
MD5 28bd85dc25bc0c55db6291d1db885a12
SHA1 0b019bf7c9e28d7be0687733395b2fbae6111517
SHA512 d7a38124242a0f1c39c434c6c1e936ae2c09436a398e5aa733d904849382e393a0c14880e790effc1e286a284c6d4a38dc670087d120a6487f6b80734f74f03c
TLSH
T1DE51061EDBE4C0BE5F20AA939E321C30225E259FF6508A36C1EB152A6E332DD45EC755
MD5 SHA1 SHA512 TLSH

Submit Download

Antivirus.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\System\Antivirus.txt
Size 31B
SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
MD5 e2da04c91dc82476ba3aebdaa6f40eb6
SHA1 abcd50cd2dbabf56fb88210f5083ce94d5bb34f0
SHA512 735c51ad836d453deea37e2e5f44d05006bdfb433149495e503161131ec32bb01389405bb65a3207b45799e27b694708031b98a5f675346d8cbb1ab2188607d6
MD5 SHA1 SHA512

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\System\MAC Addresses.txt
Size 34B
SHA256 f506f1091212395e1da6291e6fe3a1cfa4034f6f46887d00ae61b5d929585fb7
MD5 6c6c6416d00278694483c233d6e9364c
SHA1 e57e4ea87721971ce88251c23e3e5ccfc19ffe86
SHA512 b785b1d8fe07ade244ee178c6b0be59ea2e27f8813cd609eddd1163ca26f8811deb392240166dacb35960c6c4b90669ad2004ea227a4193c8a3b9d21c51b72e5
MD5 SHA1 SHA512

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\System\System Info.txt
Size 679B
SHA256 567ced2b536b03faaa73c7aeb02909677bbcab8ec2cdc6f864bfc9a8d841320d
MD5 6d53ab09bbdd7d162017de3adba42beb
SHA1 7a7e48ef11bd171a1e72898445bdd667db79308e
SHA512 df09b212d58c7b51644dd264dd78a9e4ccab592bba3abe1007db2808dc1a2e6ae2a5af1dc62a858946fdf8ce9e9139d0cf5953e0c6136acd0f1dbb498f6c8748
TLSH
T12D01C0E0625C0002C7AB23F51317575731F55AC7359BA86D61DE81CC2ED71C5D799145
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\System\Task List.txt
Size 2KB
SHA256 4b26422ab7d567d72c7d03c8acf5896661fffec3baed7e820cb6959a196ce173
MD5 6cb498804882becd904a31137c5daacd
SHA1 7de5f964c1267283d3aaa9b5d5203c23b379f01c
SHA512 32ef326cd8ae90b32cbef729b908f5ca4bd611e0272d48eaefafc4cf51da1aeee77af9a4be9f094ccfc8e04090f52d99598271c7d3cfb5d5e264967a4b0302cc
TLSH
T1C341B70BC48FA5CDE6C925EF3E60566F5BAB051C000F5DE9725206EC29B0C1DDA8BB1E
MD5 SHA1 SHA512 TLSH

Submit Download

results.json

Path C:\Users\Admin\AppData\Local\Temp\vg__g8j81a\organized\results.json
Size 34KB
SHA256 15e6c799be3e0ab2996c56bbe11f7331d3b152fd12ce7d9007e251840b1580ba
MD5 4567c47bff854dce4029c6a6ac8e02cc
SHA1 66c921902e6383400fd18b9eaa14e446fc337e92
SHA512 46b61e9f827206503f99f266df3e5d66b84aee07db2e3150ab334695571145db8a6fea8e8d6701d44b2c95cdb1f57f5f557d1751f61fb7fb06d896600a360fbd
SSDEEP 384:wUg0yTa8czaTLoWxDl+t3R48cOTwSzrASeOGHq7XdlcTNpuAAshEKHFvqHpDuzpD:g0yORaT
TLSH
T13EF2D33ED5B80CE3188DA4B11576064372A0454B8E697EA87B4CC9CCAF8CD1F65BB69C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

void_dec_VoidDcr5084_0.ps1

Path C:\Users\Admin\AppData\Local\Temp\void_dec_VoidDcr5084_0.ps1
Size 1KB
SHA256 99af248ff785cbb84c36c4876ecd2c43fdd3b432b3af7f4fd4f807831c33364e
MD5 c6fbb5c4731b9da2081ebc79694dacc4
SHA1 30ea90f71cf415425291860e4cf0aa7ab5537ec3
SHA512 7af3799b67ffb4a38b6b36faa4b640b55ead49937d5c5b81d7b929705f1a24d873c59b7da638a894e426cb2c4e4fe576b1231e4a743f83c62387e9ff64bf4a5f
TLSH
T1E8210208678BDE444C65A537DF22F8CE4813065C1BDEB607F3A5D1B06C85E26B238754
MD5 SHA1 SHA512 TLSH

Submit Download

void_dec_VoidDcr5084_1.ps1

Path C:\Users\Admin\AppData\Local\Temp\void_dec_VoidDcr5084_1.ps1
Size 1KB
SHA256 404bd74585530f7f34c7651074f2f5b1a6e29b33b63f4bb17bfb241eb2a5eb02
MD5 9a7ee1d33a21672a7efff92ac29005df
SHA1 8ef5fba6096b7c39d4f1b9affdcbe5059434ab43
SHA512 4054b4b8697c7613613fa156307d3a1f600bd6df721f19c25fa99a4caf1f0e4deacb9b1b0b0c1ab5a0fecb814f6f5cfd3eef708b9d425ee65dc7409cbf7eaa2e
TLSH
T127210208678BDE444C65A537DF22F8CF4813065C1BDEB607F3A5D1B06C85E26B238754
MD5 SHA1 SHA512 TLSH

Submit Download

void_dec_VoidDcr5084_2.ps1

Path C:\Users\Admin\AppData\Local\Temp\void_dec_VoidDcr5084_2.ps1
Size 1KB
SHA256 5f767a2e73ee1ce79bdd86b781c82c4dbf4ba93ece998437e04c07aef0dad470
MD5 6b955b778b08195784f910fabffb5056
SHA1 6c14207129835ad8eff5c5944af6970e8f25b009
SHA512 eb6f52530738941440a6fc02d0fff51197c1d71b058c890b9d9e952256b7146eb2074bd7bb9c883445930bdfc5414043af0f989ed8ecff7e1a95c38640cf8b78
TLSH
T1EA210208678BDE444C65A537DF22F8CE4813064C1BDEB607F3A5D1B06C85E26B238754
MD5 SHA1 SHA512 TLSH

Submit Download

neverlose.temp.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\neverlose.temp.exe
Size 9.5MB
SHA256 6ef8ba5300ac7d444677e7e9c03490fdb2f7a679b4f4b538670977eeac8b33cf
MD5 daec50f91b44af961dabd6e3db57e711
SHA1 76da9d885a9c522b8036a5bbe87134514277b1ba
SHA512 997f08a5a516fe5d58868684e3bc4d2b9950d9cac6560e404ebe74dda3c67c7084304ffadfdfc873ecc5cc86b1036980def973287c94130c4a18a7cd72853c5a
SSDEEP 98304:Nf39UTGgam1z73iv1cnmgCAUvnt/rJ9C8Msg+Cvp:NfgGgam1z73iv1TgbUvnt/rJ9C1tdx
TLSH
T16EA68C15E37800E8D4ABC2B8C7465257D771744A03B0ABDF1A90AEE52F27AE51E7F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ratonClient.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\7f5bed93\ratonClient.exe
Size 2.4MB
SHA256 7577fe48151e67e278123555e49bba5dbb4603d24034df1e68e3a71d6c4c8287
MD5 adc01bd751509cf349da40c2a6b4047b
SHA1 9cc52e4a40a9826542907feca1e7b7e96453e453
SHA512 72a22c21eef1c6fa12597d5c640d7cad24909e4f47400fe32373e6539e6e25d196e7be73d61c96e14bdf89a55cfd7a6549ef79ce16e1b39639c7282582b2f7f4
SSDEEP 49152:N6sgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw49KN:NLgVUuHjkDGjYQDGuRxzew
TLSH
T148C5016833F98A0CF1BF0BF4A4B149664B71FC079C96D76D18A579DE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
TLSH
T183112223F38C8921CC961639509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 47002672443e80410e55a0b6d683573ac27d70d803b57ee3c2818d1008669710
MD5 ef647504cf229a16d02de14a16241b90
SHA1 81480caca469857eb93c75d494828b81e124fda0
SHA512 a6d8c08c708eee6f7e700880ce79d2ba7cd0acbe8529d96e18f3e90ea1f3cf33fd801dd6eba6017cdd02769e968c48278c090c1deeac710124f79423cd862ee1
TLSH
T110112223F38C89A1CC961639509DAC5172B686CB81AEDEDF7FC0C210E1AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-0-0x0000000000DA0000-0x0000000001990000-memory.dmp

Download

memory/1836-98-0x000001F2563B0000-0x000001F256426000-memory.dmp

Download

memory/1836-96-0x000001F255F60000-0x000001F255FA4000-memory.dmp

Download

memory/1836-79-0x000001F23B010000-0x000001F23B032000-memory.dmp

Download

memory/5848-106-0x000001D134910000-0x000001D134920000-memory.dmp

Download

memory/5848-86-0x000001D14E0E0000-0x000001D14E194000-memory.dmp

Download

memory/5848-82-0x000001D14E010000-0x000001D14E01A000-memory.dmp

Download

memory/5848-56-0x000001D134AE0000-0x000001D134AEA000-memory.dmp

Download

memory/5848-13-0x000001D134910000-0x000001D134920000-memory.dmp

Download

memory/5848-10-0x000001D1328E0000-0x000001D132B56000-memory.dmp

Download

memory/5848-100-0x000001D14E1E0000-0x000001D14E212000-memory.dmp

Download

memory/5848-103-0x000001D14E1A0000-0x000001D14E1BA000-memory.dmp

Download