dcrat | c36ab8841d94861719e99c97d55a92c36d2a27c67e0d66a815dd31a50d2c538e

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35FA07119FCEC6389BAC83D4FB7F4CD8.exe
Size 2.2MB
Sample261014-ce8dzsty9r
SHA256 c36ab8841d94861719e99c97d55a92c36d2a27c67e0d66a815dd31a50d2c538e
MD5 35fa07119fcec6389bac83d4fb7f4cd8
SHA1 8c29c5240f485bbf9d6e6b9c3ccc1f63888e20d8
SHA512 9fcb8171dab033f5edb7e414cba4bd64a4baecb7e5cb9c6abfa5bb8cd1055ce8f8bf448f0eb699ff5b20806e37a111e125700d183e6c737fabac9f0c656af524
SSDEEP 24576:f2G/nvxW3Ww0toautb3DPlC9XxQpH9hl9AwLcIlDQ20NBtCxi4zyFoBkkAqmR3/j:fbA30o7t/9rhcwHp6RAWanq3/DiN
TLSH
T1F8B5BE017E44CE11F0191633C2EF4A0447B4AD51AAA6E72B7EFA37AD15223937D1DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/276-1-0x00000000003E0000-0x0000000000620000-memory.dmp	dcrat
behavioral2/files/0x001500000001c4a2-7.dat	dcrat
behavioral2/files/0x000d00000001c4da-47.dat	dcrat
behavioral2/memory/2056-49-0x0000000000080000-0x0000000000198000-memory.dmp	dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5928	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5400	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5864	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3892	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5664	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	4496	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	4496	schtasks.exe	95

Executes dropped EXE 12 IoCs

pid	Process
3408	DCRatBuild.exe
2896	FunSkyCollector.exe
2056	winbroker.exe
2748	conhost.exe
2108	SecurityHealthSystray.exe
1472	RuntimeBroker.exe
3388	csrss.exe
2656	explorer.exe
5916	cmd.exe
1676	dwm.exe
5788	System.exe
2968	explorer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2256	WScript.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe	winbroker.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\7a0fd90576e088	winbroker.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\SecurityHealthSystray.exe	winbroker.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\27b434ba3dcee9	winbroker.exe
File created	C:\Program Files\Windows Mail\dwm.exe	winbroker.exe
File created	C:\Program Files\Windows Mail\6cb0b6c459d5d3	winbroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3768	cmd.exe
5216	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winbroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winbroker.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	winbroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4908	schtasks.exe
4348	schtasks.exe
1112	schtasks.exe
5320	schtasks.exe
1144	schtasks.exe
2216	schtasks.exe
2404	schtasks.exe
3772	schtasks.exe
5864	schtasks.exe
4012	schtasks.exe
980	schtasks.exe
5664	schtasks.exe
2628	schtasks.exe
2408	schtasks.exe
3892	schtasks.exe
1140	schtasks.exe
5028	schtasks.exe
4272	schtasks.exe
2944	schtasks.exe
5928	schtasks.exe
2604	schtasks.exe
5400	schtasks.exe
1732	schtasks.exe
984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2056	winbroker.exe
2056	winbroker.exe
2056	winbroker.exe
2056	winbroker.exe
2056	winbroker.exe
2056	winbroker.exe
2056	winbroker.exe
2056	winbroker.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	winbroker.exe
Token: SeDebugPrivilege	2108	SecurityHealthSystray.exe
Token: SeDebugPrivilege	2748	conhost.exe
Token: SeDebugPrivilege	3388	csrss.exe
Token: SeDebugPrivilege	1472	RuntimeBroker.exe
Token: SeDebugPrivilege	5916	cmd.exe
Token: SeDebugPrivilege	2656	explorer.exe
Token: SeDebugPrivilege	5788	System.exe
Token: SeDebugPrivilege	1676	dwm.exe
Token: SeDebugPrivilege	2968	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 3408	276	35FA07119FCEC6389BAC83D4FB7F4CD8.exe	89
PID 276 wrote to memory of 2896	276	35FA07119FCEC6389BAC83D4FB7F4CD8.exe	90
PID 3408 wrote to memory of 2256	3408	DCRatBuild.exe	91
PID 2256 wrote to memory of 3768	2256	WScript.exe	92
PID 3768 wrote to memory of 2056	3768	cmd.exe	94
PID 2056 wrote to memory of 5216	2056	winbroker.exe	130
PID 5216 wrote to memory of 5888	5216	cmd.exe	136
PID 5216 wrote to memory of 2968	5216	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\35FA07119FCEC6389BAC83D4FB7F4CD8.exe
"C:\Users\Admin\AppData\Local\Temp\35FA07119FCEC6389BAC83D4FB7F4CD8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Users\Admin\AppData\Local\Temp\bnd_3dd324fb\DCRatBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_3dd324fb\DCRatBuild.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Portagent\e1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Portagent\G3Qfs1kOHl20hun6eQCKvPdReFy.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Portagent\winbroker.exe
        
        "C:\Portagent\winbroker.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Reads the TCP/IP host and domain name from the registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2056
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EW3OjitKRu.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5888
        
        C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe
        
        "C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
- C:\Users\Admin\AppData\Local\Temp\bnd_3dd324fb\FunSkyCollector.exe
  "C:\Users\Admin\AppData\Local\Temp\bnd_3dd324fb\FunSkyCollector.exe"
  2⤵
  - Executes dropped EXE
  PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\host\fxr\6.0.27\SecurityHealthSystray.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystray" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\6.0.27\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SecurityHealthSystrayS" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\host\fxr\6.0.27\SecurityHealthSystray.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Portagent\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Portagent\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Portagent\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows.old\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows.old\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows.old\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows.old\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows.old\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows.old\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Portagent\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Portagent\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Portagent\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Mail\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Portagent\conhost.exe
"C:\Portagent\conhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Program Files\dotnet\host\fxr\6.0.27\SecurityHealthSystray.exe
"C:\Program Files\dotnet\host\fxr\6.0.27\SecurityHealthSystray.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows.old\csrss.exe
"C:\Windows.old\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows.old\RuntimeBroker.exe
"C:\Windows.old\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe
"C:\Program Files\dotnet\host\fxr\6.0.27\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Users\Default User\cmd.exe
"C:\Users\Default User\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Program Files\Windows Mail\dwm.exe
"C:\Program Files\Windows Mail\dwm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Portagent\System.exe
"C:\Portagent\System.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

G3Qfs1kOHl20hun6eQCKvPdReFy.bat

Path C:\Portagent\G3Qfs1kOHl20hun6eQCKvPdReFy.bat
Size 28B
SHA256 da95098b260b19107c2bde79353dfcada4efa91f9ab00926ffdee2f57a060e5e
MD5 5d50925a530c6b91d981bf76ea10d176
SHA1 bc1b8c061a32dd86a71f7fe7e273ec40e066518c
SHA512 e1ad1f684a57f9c85f3067c42f4ae9b1f8a8228a74012b379dbebd50fea5d06be6666430215305f1280873cc4f3bffee11ba6bb2d05e4d74110b0a39c463213c
MD5 SHA1 SHA512

Submit Download

e1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe

Path C:\Portagent\e1zmNuk6PgHvGo3oCCD0Yo1C0Wi.vbe
Size 213B
SHA256 2c164cb303436c840b2fc4bd93bfb91ce3417cb97b9d3bea64eb4776ae433f6f
MD5 6aca5b97e7bec1134d7d26980e55cfcf
SHA1 45fc52714da691e458c98576b8101a29a210b1b1
SHA512 29449809937fd55727b045ab91c385ae7da9543b63c618c48f7f56615e32fee07415dcce64d0eb32585c0b223442445b0a8ef8b2c1836f4e985d43fc95911018
TLSH
T1A1D023598433674C9D04A8DDC345D8391DA2BE7F4B417993C554DD4A9400197351C7E7
MD5 SHA1 SHA512 TLSH

Submit Download

winbroker.exe

Path C:\Portagent\winbroker.exe
Size 1.1MB
SHA256 c6ed1c7e207d9a18d5b8e0a009526da568295cb0de5a030c4607b34cb4edb02c
MD5 7b7e613ebf31774a1883442fa1728a9b
SHA1 061d5068fd55b56e72c6c47d4bafdc7001d1fefd
SHA512 46e12b0615a15cece3ebb5d2ea6e375b13ba5afdc1caca1dc410004ba66f42babcd5dc66ea8f232e79d02b9691f3ddb917f41a0e241532be73720291dcb0b569
SSDEEP 24576:mautb3DPlC9XxQpH9hl9AwLcIlDQ20NBtCx:m7t/9rhcwHp6R
TLSH
T1853549057E44CE11F0191633C2EF4A4887B49D51A6A6E32B7DFA37AE15123A77C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EW3OjitKRu.bat

Path C:\Users\Admin\AppData\Local\Temp\EW3OjitKRu.bat
Size 217B
SHA256 5d4f0fa5cfbc07585983f161337c3aa8a80c7c60bf2dfc5637340a2c0df91681
MD5 6e0a82f930e390e9d8f820990d5ba50f
SHA1 0c3bfb96134e8b46701f3c18d0c9ee3b8219f0b5
SHA512 89f24ec23179141872db967be8a079b5880ed88975bbf645c44d95e66f36ec51b6b55791185ad71932be9fe0458340883e3e0ba06c8093d34b780abd20120ee9
TLSH
T1BCD023438405CB55145318430B49118D60172C48B7C45D701F998558554F4B6725E7C2
MD5 SHA1 SHA512 TLSH

Submit Download

DCRatBuild.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_3dd324fb\DCRatBuild.exe
Size 1.4MB
SHA256 b028b2b4a6a39c51841a13e12f483b901339995a3ba40f46c63b4055d7a781a9
MD5 a0ffb31d84c2f5ffacd879f4f12c1ce6
SHA1 2280ee7e5d7dbf727306dd6b47025bd547172a57
SHA512 25d06639cf3bb8ca353f96bbd55d5ff5298a4022b86c57f1416932a8411d1bf49a1b65d267d0a67aaade5299e57f2982196780cace8b5e7a46a4b2833b300087
SSDEEP 24576:U2G/nvxW3Ww0toautb3DPlC9XxQpH9hl9AwLcIlDQ20NBtCxC:UbA30o7t/9rhcwHp6Rr
TLSH
T11F657B017E44CE11F0191633C2EF4A0447B4AC51AAA6E72B7EFA376E55223937D1DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FunSkyCollector.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_3dd324fb\FunSkyCollector.exe
Size 718KB
SHA256 7aadeaa5e380ae6f1272164db24dd4e194850dc6268a96e7bc1231f36f46ddf6
MD5 91530f4c0db3a69c204f5f1d7c44544d
SHA1 4b701ef5244177d90df6c66ecfadaff1ebdc6c63
SHA512 3eaea277fd91d737c3beb82d49ccc1ab42dbc1ae3bbe55f89114828b22c6199eb3b95e3fdf0b67f4c5bffd4a9ebe252ea5b0b1d2bbc269adb2bfbc8db1bd194e
SSDEEP 12288:hkmhDJRryFot2wkda7EqmR3/DSKsfxdNJcjAGvdGTC:24zyFoBkkAqmR3/DhuNJSdGT
TLSH
T178F4127A237C4E56D39F8678149502820BB2736B9F02DB4D664E74DC2A2336797327E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/276-33-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/276-4-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/276-1-0x00000000003E0000-0x0000000000620000-memory.dmp

Download

memory/276-0-0x00007FFB5CCAF000-0x00007FFB5CCB0000-memory.dmp

Download

memory/2056-53-0x00000000022F0000-0x00000000022FC000-memory.dmp

Download

memory/2056-51-0x00000000022E0000-0x00000000022E8000-memory.dmp

Download

memory/2056-52-0x0000000002420000-0x0000000002436000-memory.dmp

Download

memory/2056-50-0x00000000022D0000-0x00000000022DE000-memory.dmp

Download

memory/2056-49-0x0000000000080000-0x0000000000198000-memory.dmp

Download

memory/2896-38-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-39-0x00000197DBE20000-0x00000197DBEDA000-memory.dmp

Download

memory/2896-42-0x00000197C29A0000-0x00000197C29AE000-memory.dmp

Download

memory/2896-40-0x00000197C2990000-0x00000197C2998000-memory.dmp

Download

memory/2896-43-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-44-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-45-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-41-0x00000197DB2D0000-0x00000197DB30E000-memory.dmp

Download

memory/2896-37-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-36-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-35-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-32-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-27-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-20-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download

memory/2896-19-0x00000197C0B80000-0x00000197C0C38000-memory.dmp

Download

memory/2896-77-0x00007FFB5CB20000-0x00007FFB5D4C4000-memory.dmp

Download