njrat | 99fcad0458d8b26b8a566ce54d6d1e4c753a5a7bf5b44d096dfcf196411e017b

Analysis

user interaction
yes
max time kernel
74s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Initializer.exe
Size 149KB
Sample261001-yn49ksxgna
SHA256 99fcad0458d8b26b8a566ce54d6d1e4c753a5a7bf5b44d096dfcf196411e017b
MD5 245686ddc38f1b62ee95dac100a16f85
SHA1 7aee685f9553a5df40efc07c85271d2d0d7f8843
SHA512 ba4f64ad0b7e7fa4c5558915a580a585b2901a0e536b0bb9726d3afcfb633efec9507900d801f0561865822d8bcf4965d73d944851735542a414e985fdd1dbd8
SSDEEP 3072:etgC4VgISwJ2ThX7JLwvl5OxmARmPqGzvAMlG9J7:etgOiwTt7J0OYAIPqGzS
TLSH
T15AE3EF4129DC432AD1E6D9B11F832578FB33FB86854286BE9C82F2B7F106A44CCD612D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hackedby4444 hecked defense_evasion discovery execution njrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

jakarta-seduce.tun.ply.gg:20862

Attributes

Install_directory
%AppData%
install_file
USB.exe

Extracted

Family

njrat

Botnet

Hecked

Mutex

53$79$73$74$65$6d

Attributes

reg_key
53$79$73$74$65$6d
splitter
|-F-|

Extracted

Family

njrat

Version

0.7d

Botnet

HackedBy4444

jakarta-seduce.tun.ply.gg:20862

Mutex

5fa281e7afe817d0cddab69afa7bd69f

Attributes

reg_key
5fa281e7afe817d0cddab69afa7bd69f
splitter
Y262SUCZ4UJJ

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0004000000023243-4.dat	family_xworm
behavioral1/memory/2092-28-0x00000000001B0000-0x00000000001C4000-memory.dmp	family_xworm

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
964	netsh.exe
4444	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	SystemAUDIO_D.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	tmp8FC3.tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Initializer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	SystemAUDIO.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	SystemInit.exe

Creates a file in the Startup directory 1 TTPs 6 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemAUDIO.lnk	SystemAUDIO.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemAUDIO.lnk	SystemAUDIO.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	SystemAUDIO_D.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	SystemAUDIO_D.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5fa281e7afe817d0cddab69afa7bd69f.exe	WindowsServices.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5fa281e7afe817d0cddab69afa7bd69f.exe	WindowsServices.exe

Executes dropped EXE 10 IoCs

pid	Process
2092	SystemAUDIO.exe
3672	SystemAUDIO_D.exe
2144	SystemInit.exe
1772	SystemAUDIO.exe
1868	WindowsServices.exe
4364	SystemAUDIO_D.exe
2492	SystemAUDIO_D.exe
5032	WindowsServices.exe
1924	SystemAUDIO.exe
1772	tmp8FC3.tmp.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemAUDIO = "C:\\Users\\Admin\\AppData\\Roaming\\SystemAUDIO.exe"	SystemAUDIO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\SystemAUDIO_D.exe"	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5fa281e7afe817d0cddab69afa7bd69f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .."	WindowsServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5fa281e7afe817d0cddab69afa7bd69f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .."	WindowsServices.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemAUDIO_D.exe\" .."	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Admin\\AppData\\Roaming\\SystemAUDIO_D.exe\" .."	SystemAUDIO_D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\SystemAUDIO_D.exe"	SystemAUDIO_D.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemAUDIO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemAUDIO_D.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemAUDIO_D.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsServices.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemAUDIO.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemInit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemAUDIO_D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemAUDIO_D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemAUDIO_D.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
224	schtasks.exe
3824	schtasks.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	SystemAUDIO.exe
Token: SeDebugPrivilege	2092	SystemAUDIO.exe
Token: SeDebugPrivilege	1772	SystemAUDIO.exe
Token: SeDebugPrivilege	3672	SystemAUDIO_D.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: SeDebugPrivilege	1868	WindowsServices.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe
Token: SeDebugPrivilege	1924	SystemAUDIO.exe
Token: 33	1868	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1868	WindowsServices.exe
Token: 33	3672	SystemAUDIO_D.exe
Token: SeIncBasePriorityPrivilege	3672	SystemAUDIO_D.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2092	1596	Initializer.exe	89
PID 1596 wrote to memory of 3672	1596	Initializer.exe	90
PID 1596 wrote to memory of 2144	1596	Initializer.exe	91
PID 2092 wrote to memory of 224	2092	SystemAUDIO.exe	98
PID 3672 wrote to memory of 964	3672	SystemAUDIO_D.exe	104
PID 2144 wrote to memory of 1868	2144	SystemInit.exe	106
PID 1868 wrote to memory of 4444	1868	WindowsServices.exe	114
PID 3672 wrote to memory of 1772	3672	SystemAUDIO_D.exe	127
PID 1772 wrote to memory of 3824	1772	tmp8FC3.tmp.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Initializer.exe
"C:\Users\Admin\AppData\Local\Temp\Initializer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe
  "C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SystemAUDIO" /tr "C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:224
- C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe
  "C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe" "SystemAUDIO_D.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:964
- - C:\Users\Admin\AppData\Local\Temp\tmp8FC3.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8FC3.tmp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\MasonSmil.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonSmil.exe"
      4⤵
      PID:1784
- C:\Users\Admin\AppData\Roaming\SystemInit.exe
  "C:\Users\Admin\AppData\Roaming\SystemInit.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4444

C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe
C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe
"C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe" ..
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4364

C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe
C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2492

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" ..
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032

C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe
C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Users\Admin\AppData\Local\Temp\MasonMBR.exe
C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe
1⤵
PID:2364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x394
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemAUDIO_D.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SystemAUDIO_D.exe.log
Size 411B
SHA256 e81508d529d4607729ea190c95e5bf809bad250638ed22fa58c307de7c8d0161
MD5 b5766774c3ec5c3c2bd98da37069b64a
SHA1 230ab2667e627ef2252bdd19a2eb39fc86aa521c
SHA512 23038bdddc0db8830608e5c440e825e675338c30d79833c5173499bee105bd8d92896a397cd138359485228b98369d122a19e4e24b1cec13ad1679a609a47d23
TLSH
T1B2E06830373298E80C202A110811BFDA51FF4357BBA8DF2C6669535DED2A497EB112E3
MD5 SHA1 SHA512 TLSH

Submit Download

SystemAUDIO.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SystemAUDIO.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
TLSH
T1D9F0DD242221E1C489127F111C0D2A4452BF4797B760EE0C7554529FD8312275F203E7
MD5 SHA1 SHA512 TLSH

Submit Download

MasonMBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR.exe
Size 93KB
SHA256 190e70e1df7f1b7b526c557c0ef0da3b67d3da130a56dc52666a65266b8146af
MD5 03eadaa6ca74c654b50d544ead5350af
SHA1 383fdb5317129f46bc5ec164a481563d941f6ddf
SHA512 404ea870675104ed57d8c87f380abcf2658e5e4c201dfe157dee0ab040f80f425395b5d74ed695f0b3bebdf9c178fe04827dbe5afa686932a24be99a3619f20b
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2o8fpP3ybZD:Tv5MYRIMPqiTJx+ZqreRQ5/hXoQP3ybl
TLSH
T1D5936C43B9D288B1E5B21D301871CAA19A6FB9210E748E6B3394177E5F340D19E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonSmil.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonSmil.exe
Size 161KB
SHA256 fc18ac689568aea34f287e1ff20bfee7cfec3f3f626aab3d2c23a180969ae0a6
MD5 2672a80cf701037e262f1bb55c5202b5
SHA1 fe35a751182023ea77e876a327d5e47f1e02885b
SHA512 e1356770d6e23795170d855ae8cecfa29521a0dee86993e45c875f6cde2f0682d79a56d5ba6ad5b88817e886e21485e5755960a80bafd59d2bdd175ce845237a
SSDEEP 3072:QiG22Q1qS2U6A5nHpIT999Vyai8AXUtmDGZLCLCZnuY02eI0/90jkrTxrWqY:QojqSd6A5n6n9TCX+CugC50tz/90jkrV
TLSH
T185F3024956B96453D7F5C2732CFF7E004364A66F9B169BDF388CD86A6F16384221330A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp8FC3.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp8FC3.tmp.exe
Size 365KB
SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
MD5 ea210a16c2cd0f7d84d3961bccbfe73a
SHA1 598a97e9c7aef20ccc65ed04aa9449564b53f48f
SHA512 baad73a63e0e4c56bea3283f0072ff7682e37afa96403c99e714373ab49b20e990044f6a221a89d27fd8c763af06e7418886880d41cc557be9892daeb3877c65
SSDEEP 6144:iT+DPxVn9PvkYyeryYpaVexc6dJ1QYsjHf6EnJrNlT9Fb+3jqSd6A5n6n9TCX+Ct:iT+rxV93k4HpaVexd/FuHfFLEjdnC9At
TLSH
T18A84135561BDF193EAF9917318FFA004961A972FA3056BAF1C84D937AF0AF84320791C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp967B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp967B.tmp
Size 109KB
SHA256 fe74cb06318fd7451fed5ad5ce5605bb746bb5ef55da3fe96f52ba20e159db49
MD5 7ccccd0ddf864a061e175cf9e5114a46
SHA1 c0b798cd725d5f270f347790e2ad13dab60108e3
SHA512 8ad1bb6375e7f35e0dc41353d2e79499285cc401c412ea16fdbb123c3a53aef315186f594364a4f4156a58fa780c973bbc7e0202e6a1ed8380742b6c45058132
SSDEEP 192:jDWSMSBDWSMSBDWSMSBDWSMSBDWSMSBDWSMSBDWSMn:jDTDTDTDTDTDTDS
TLSH
T1A9B3C0678051249C540E892283FA1DB66CAB2FB07A7CF549AE37BCB553B32D36053E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemAUDIO.exe

Path C:\Users\Admin\AppData\Roaming\SystemAUDIO.exe
Size 52KB
SHA256 b858e6ad0ceb982a904133704d80744dece9db68caf1b5a94d22bb1d3ba43b11
MD5 af73bbab5c83acc530168a4329d8b902
SHA1 5bebacae123189131ab0a765d13f9b396d947f88
SHA512 32d1bdcd29c915c2d8614cdc91e8b67507c38a12de774fd49462d3348d42f66424f6402fcfd6aa7320f96edeaceafd66714f2c7245458711b7d4a62c5c5c4f21
SSDEEP 1536:6/NMnvw108klZUHHQzb3FmNAtx3GOBBxj:fnoS8OTzb3xCOBPj
TLSH
T1D3338D4CB7A68231C2FE5BB519B26162D774F3138913972F28D841EB4B2768DCA503F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemAUDIO_D.exe

Path C:\Users\Admin\AppData\Roaming\SystemAUDIO_D.exe
Size 48KB
SHA256 0ca7b7f0713ac828dee1324c09a5085263ce6787b5c99d5d214bdb3c26d323eb
MD5 7bd28cd4459ef30d396c73bf02057e26
SHA1 88a0bdf317ff6de137837e026103320c62ad58ff
SHA512 5b18ccdde457cae2110928a3c37bd8e243bfd2c4562444aa36757aba81ca3da9c842bd87441bb2615bae2466eb7b53868ed6b4b0d38331388094cea753f46b33
SSDEEP 768:IzNmAGBQCDkypibaSrtMPArsMdYMd590TRXZ66QDY/X9u0hcbJyU:OYAGBQCDk5baSVrsMdYMiKY/Xg8cbJy
TLSH
T172231B4973D59525C5FD9E348565A20207BAB20BA81BFB0D0CEBDCE91BF37D10D40AEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemInit.exe

Path C:\Users\Admin\AppData\Roaming\SystemInit.exe
Size 31KB
SHA256 7d06a6d3d7ab19fc826f9d94747a004f0a96e0ee1b99b109668d2e5da5e84b8a
MD5 bbf18a4fb76d0bca0a80d559d52bce54
SHA1 d87485b567a58d8f0cb7da15ce81e3185a155bb9
SHA512 7befa6a366520053ce600be7d4b9909c965a4b9703a47f6a47107ddf32c087f16ed70b0b49acab7ba4414c5e751f6a54745c429c902c6b399d556841a76e6af4
SSDEEP 768:EO5CcKdTtrUzxf6voo2DT39vhvjQmIDUu0tikEj:taoZpRQVkcj
TLSH
T142E22AADFBE64469C1BD0AB50571951053B8E043E513F77E4ECA24A62B3B3D84B88DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-0-0x0000000000AF0000-0x0000000000B1C000-memory.dmp

Download

memory/1772-70-0x0000000002EB0000-0x0000000002EE8000-memory.dmp

Download

memory/1772-69-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1784-88-0x0000000000830000-0x000000000085E000-memory.dmp

Download

memory/1784-92-0x0000000005FA0000-0x0000000006032000-memory.dmp

Download

memory/2092-28-0x00000000001B0000-0x00000000001C4000-memory.dmp

Download

memory/2144-31-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/3672-48-0x0000000001310000-0x0000000001320000-memory.dmp

Download

memory/3672-30-0x0000000001310000-0x0000000001320000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads