asyncrat | 1dcc081671b33b3992e859d1ae4318fdccb0ca6044543f40a144fdf19fef2b3b

Analysis

max time kernel
11s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3NTER.exe
Size 1.1MB
Sample261107-k9zdkab18k
SHA256 1dcc081671b33b3992e859d1ae4318fdccb0ca6044543f40a144fdf19fef2b3b
MD5 accb3d2e39ba1433fc7425417c90b412
SHA1 77132ed45bb772faf34a97d977541ab6823ee3d6
SHA512 95d834282906f439e34a1a1c0e987db2950290257e8d4adad4ff4114e9fe9c834e3f67b9a30850cec69b05840cbd1de9d0660935ebeacd485ff014c27e2f349f
SSDEEP 24576:NXx7q40X1UtGJzuCJj4C5De+d+jyT42J4tpVRvgXJMP0hM:VxG4MiGqCJj55Dt++XJ4tpVRQJMP0hM
TLSH
T15D353369BAEF15ADF16DF93BE581309826B5C027C184E3A7E434B3D1A6C753CC26422D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

3o defense_evasion discovery execution asyncrat umbral persistence rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

f3en305f3en-35578.portmap.host:305
f3en305f3en-35578.portmap.host:61793
anble3en-61793.portmap.host:305
anble3en-61793.portmap.host:61793

Attributes

delay
1
install
true
install_file
svhost.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c5b7-31.dat	family_asyncrat
behavioral2/memory/1552-62-0x0000022FA1B00000-0x0000022FA1B16000-memory.dmp	family_asyncrat

Detects Umbral payload 3 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c5b6-25.dat	family_umbral_obfuscated
behavioral2/memory/2864-38-0x0000020D4A240000-0x0000020D4A2B0000-memory.dmp	family_umbral_obfuscated
behavioral2/memory/2864-49-0x0000020D64980000-0x0000020D649C0000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3136	powershell.exe
1656	powershell.exe
1320	powershell.exe
3524	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1656	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1656	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
3480	3NTR.exe
6040	tput.exe
2864	system.exe
1552	x.exe
4616	elnun2ht.3ab.exe
5712	doeag034.g5r.exe
6092	svhost.exe
3268	ljilslom.agc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3480	3NTR.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	3NTR.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
6048	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5104	cmd.exe
4348	cmd.exe
5784	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	system.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	system.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5104	cmd.exe
5688	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3NTR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3NTR.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4396	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4932	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3NTR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	3NTR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	3NTR.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5688	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3480	3NTR.exe
3480	3NTR.exe
4616	elnun2ht.3ab.exe
4616	elnun2ht.3ab.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
2864	system.exe
2864	system.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
2864	system.exe
3136	powershell.exe
3136	powershell.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
3136	powershell.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
2864	system.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
3136	powershell.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
1552	x.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
1552	x.exe
1552	x.exe
1552	x.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
3136	powershell.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe
5712	doeag034.g5r.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	system.exe
Token: SeDebugPrivilege	4616	elnun2ht.3ab.exe
Token: SeDebugPrivilege	1552	x.exe
Token: SeDebugPrivilege	5712	doeag034.g5r.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	1552	x.exe
Token: SeIncreaseQuotaPrivilege	3136	powershell.exe
Token: SeSecurityPrivilege	3136	powershell.exe
Token: SeTakeOwnershipPrivilege	3136	powershell.exe
Token: SeLoadDriverPrivilege	3136	powershell.exe
Token: SeSystemProfilePrivilege	3136	powershell.exe
Token: SeSystemtimePrivilege	3136	powershell.exe
Token: SeProfSingleProcessPrivilege	3136	powershell.exe
Token: SeIncBasePriorityPrivilege	3136	powershell.exe
Token: SeCreatePagefilePrivilege	3136	powershell.exe
Token: SeBackupPrivilege	3136	powershell.exe
Token: SeRestorePrivilege	3136	powershell.exe
Token: SeShutdownPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeSystemEnvironmentPrivilege	3136	powershell.exe
Token: SeRemoteShutdownPrivilege	3136	powershell.exe
Token: SeUndockPrivilege	3136	powershell.exe
Token: SeManageVolumePrivilege	3136	powershell.exe
Token: 33	3136	powershell.exe
Token: 34	3136	powershell.exe
Token: 35	3136	powershell.exe
Token: 36	3136	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3636	svchost.exe
Token: SeIncreaseQuotaPrivilege	3636	svchost.exe
Token: SeSecurityPrivilege	3636	svchost.exe
Token: SeTakeOwnershipPrivilege	3636	svchost.exe
Token: SeLoadDriverPrivilege	3636	svchost.exe
Token: SeSystemtimePrivilege	3636	svchost.exe
Token: SeBackupPrivilege	3636	svchost.exe
Token: SeRestorePrivilege	3636	svchost.exe
Token: SeShutdownPrivilege	3636	svchost.exe
Token: SeSystemEnvironmentPrivilege	3636	svchost.exe
Token: SeUndockPrivilege	3636	svchost.exe
Token: SeManageVolumePrivilege	3636	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3636	svchost.exe
Token: SeIncreaseQuotaPrivilege	3636	svchost.exe
Token: SeSecurityPrivilege	3636	svchost.exe
Token: SeTakeOwnershipPrivilege	3636	svchost.exe
Token: SeLoadDriverPrivilege	3636	svchost.exe
Token: SeSystemtimePrivilege	3636	svchost.exe
Token: SeBackupPrivilege	3636	svchost.exe
Token: SeRestorePrivilege	3636	svchost.exe
Token: SeShutdownPrivilege	3636	svchost.exe
Token: SeSystemEnvironmentPrivilege	3636	svchost.exe
Token: SeUndockPrivilege	3636	svchost.exe
Token: SeManageVolumePrivilege	3636	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3636	svchost.exe
Token: SeIncreaseQuotaPrivilege	3636	svchost.exe
Token: SeSecurityPrivilege	3636	svchost.exe
Token: SeTakeOwnershipPrivilege	3636	svchost.exe
Token: SeLoadDriverPrivilege	3636	svchost.exe
Token: SeSystemtimePrivilege	3636	svchost.exe
Token: SeBackupPrivilege	3636	svchost.exe
Token: SeRestorePrivilege	3636	svchost.exe
Token: SeShutdownPrivilege	3636	svchost.exe
Token: SeSystemEnvironmentPrivilege	3636	svchost.exe
Token: SeUndockPrivilege	3636	svchost.exe
Token: SeManageVolumePrivilege	3636	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3636	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3480	3NTR.exe
2820	Conhost.exe
4256	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 3480	5832	3NTER.exe	89
PID 5832 wrote to memory of 6040	5832	3NTER.exe	93
PID 6040 wrote to memory of 2864	6040	tput.exe	94
PID 6040 wrote to memory of 1552	6040	tput.exe	95
PID 2864 wrote to memory of 4616	2864	system.exe	96
PID 1552 wrote to memory of 5712	1552	x.exe	97
PID 5712 wrote to memory of 748	5712	doeag034.g5r.exe	5
PID 5712 wrote to memory of 996	5712	doeag034.g5r.exe	9
PID 5712 wrote to memory of 1004	5712	doeag034.g5r.exe	10
PID 5712 wrote to memory of 1012	5712	doeag034.g5r.exe	11
PID 5712 wrote to memory of 1036	5712	doeag034.g5r.exe	13
PID 5712 wrote to memory of 1124	5712	doeag034.g5r.exe	14
PID 5712 wrote to memory of 1208	5712	doeag034.g5r.exe	15
PID 5712 wrote to memory of 1256	5712	doeag034.g5r.exe	16
PID 5712 wrote to memory of 1288	5712	doeag034.g5r.exe	17
PID 5712 wrote to memory of 1364	5712	doeag034.g5r.exe	18
PID 5712 wrote to memory of 1384	5712	doeag034.g5r.exe	19
PID 5712 wrote to memory of 1560	5712	doeag034.g5r.exe	22
PID 5712 wrote to memory of 1600	5712	doeag034.g5r.exe	23
PID 5712 wrote to memory of 1636	5712	doeag034.g5r.exe	24
PID 5712 wrote to memory of 1720	5712	doeag034.g5r.exe	25
PID 5712 wrote to memory of 1764	5712	doeag034.g5r.exe	26
PID 5712 wrote to memory of 1768	5712	doeag034.g5r.exe	27
PID 5712 wrote to memory of 2008	5712	doeag034.g5r.exe	28
PID 5712 wrote to memory of 1032	5712	doeag034.g5r.exe	29
PID 5712 wrote to memory of 2056	5712	doeag034.g5r.exe	30
PID 5712 wrote to memory of 2080	5712	doeag034.g5r.exe	31
PID 5712 wrote to memory of 2096	5712	doeag034.g5r.exe	32
PID 5712 wrote to memory of 2240	5712	doeag034.g5r.exe	33
PID 5712 wrote to memory of 2292	5712	doeag034.g5r.exe	34
PID 5712 wrote to memory of 2348	5712	doeag034.g5r.exe	35
PID 5712 wrote to memory of 2420	5712	doeag034.g5r.exe	36
PID 5712 wrote to memory of 2524	5712	doeag034.g5r.exe	37
PID 5712 wrote to memory of 2572	5712	doeag034.g5r.exe	38
PID 5712 wrote to memory of 2688	5712	doeag034.g5r.exe	39
PID 5712 wrote to memory of 2708	5712	doeag034.g5r.exe	40
PID 5712 wrote to memory of 2744	5712	doeag034.g5r.exe	41
PID 5712 wrote to memory of 2808	5712	doeag034.g5r.exe	42
PID 5712 wrote to memory of 2968	5712	doeag034.g5r.exe	43
PID 5712 wrote to memory of 2140	5712	doeag034.g5r.exe	44
PID 5712 wrote to memory of 2236	5712	doeag034.g5r.exe	45
PID 5712 wrote to memory of 3152	5712	doeag034.g5r.exe	47
PID 5712 wrote to memory of 3172	5712	doeag034.g5r.exe	48
PID 5712 wrote to memory of 3484	5712	doeag034.g5r.exe	50
PID 5712 wrote to memory of 3548	5712	doeag034.g5r.exe	51
PID 5712 wrote to memory of 3556	5712	doeag034.g5r.exe	52
PID 5712 wrote to memory of 3628	5712	doeag034.g5r.exe	53
PID 5712 wrote to memory of 3636	5712	doeag034.g5r.exe	54
PID 5712 wrote to memory of 3644	5712	doeag034.g5r.exe	55
PID 5712 wrote to memory of 3668	5712	doeag034.g5r.exe	56
PID 5712 wrote to memory of 3344	5712	doeag034.g5r.exe	57
PID 5712 wrote to memory of 940	5712	doeag034.g5r.exe	58
PID 5712 wrote to memory of 4368	5712	doeag034.g5r.exe	59
PID 5712 wrote to memory of 4412	5712	doeag034.g5r.exe	60
PID 5712 wrote to memory of 4460	5712	doeag034.g5r.exe	61
PID 5712 wrote to memory of 4540	5712	doeag034.g5r.exe	62
PID 5712 wrote to memory of 4792	5712	doeag034.g5r.exe	63
PID 5712 wrote to memory of 5032	5712	doeag034.g5r.exe	64
PID 5712 wrote to memory of 5180	5712	doeag034.g5r.exe	65
PID 5712 wrote to memory of 5248	5712	doeag034.g5r.exe	66
PID 5712 wrote to memory of 5288	5712	doeag034.g5r.exe	67
PID 5712 wrote to memory of 5628	5712	doeag034.g5r.exe	70
PID 5712 wrote to memory of 5024	5712	doeag034.g5r.exe	72
PID 5712 wrote to memory of 5044	5712	doeag034.g5r.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4308	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:1004
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1208

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:996

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d18e1885-3c4e-439e-93e6-4145df7cd17b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0ad9c1a7-c9ec-4adf-8a09-a5fa74c8e442 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5ffe954c-9389-4395-a437-8082c0300715 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c24a2087-cfc7-45f3-ab86-21c78f0d1f10 -LifetimeId:1d321fc3-3808-49c8-8475-fd2ff232b44f -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2008
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5768
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\3NTER.exe
      "C:\Users\Admin\AppData\Local\Temp\3NTER.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\3NTR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3NTR.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks for VirtualBox DLLs, possible anti-VM trick
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\tput.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tput.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\system.exe
        
        "C:\Users\Admin\AppData\Local\Temp\system.exe"
        6⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\elnun2ht.3ab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\elnun2ht.3ab.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s ""
        7⤵
        Views/modifies file attributes
        
        PID:4308
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3136
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        7⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Disables automatic submission of suspicious files to Microsoft by Windows Defender
        
        PID:1656
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:3680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1320
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:5136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        
        PID:1220
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        7⤵
        
        PID:1616
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        7⤵
        
        PID:2672
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        Queries system WMI classes for hardware identifiers
        
        PID:6048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3524
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:4932
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "" && pause
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5104
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\x.exe
        
        "C:\Users\Admin\AppData\Local\Temp\x.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\doeag034.g5r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\doeag034.g5r.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"' & exit
        7⤵
        Executes a command shell one-liner
        
        PID:4348
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "svhost" /tr '"C:\Users\Admin\AppData\Roaming\svhost.exe"'
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5903.tmp.bat""
        7⤵
        Executes a command shell one-liner
        
        PID:5784
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1992
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        8⤵
        Delays execution with timeout.exe
        
        PID:4396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2524
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2968

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3172

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:940

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4540

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4792

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5180

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5248

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2960

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4164

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3952

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4256

C:\Users\Admin\AppData\Roaming\svhost.exe
"C:\Users\Admin\AppData\Roaming\svhost.exe"
1⤵
- Executes dropped EXE
PID:6092
- C:\Users\Admin\AppData\Local\Temp\ljilslom.agc.exe
  "C:\Users\Admin\AppData\Local\Temp\ljilslom.agc.exe"
  2⤵
  - Executes dropped EXE
  PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 6acc5ca8ed17a66a6fbc3181c5831894af713d8ebd598af1e330ec1ea4145d2b
MD5 3145bb8fe352142f4835f1517c3c4630
SHA1 757afcda1b976b480490bc898157e93aa9ec5823
SHA512 0749d7ab22cc3950960193cd0d6ce2531af11fe2342369e589e427893faaee28c3c44bc78032f15bd2dcd92dd507b9a1547fa36fa720c5d94584fafade4f875b
TLSH
T166116633F3CC8624DC59403650CEAD1136B68BCB40DECE6B7B80D154B42F689DF611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ecf454d8b55b7bc57249021d41b3bb8ae49c6db962c081c3fcfec87c41d5373
MD5 610f4038baf99b8ee9e40266597a6f8f
SHA1 7a3f9b3694b4dd63df5788b22183418f653cda19
SHA512 150d4cc311601c7bb6d9d7068471d9217791411ee172e5a14272e4034e2bdb8b82578dcf838e0a192e9abe5a573ff170870608e353e553d46383762188c14fa0
TLSH
T1C4215333F3CC8624C89A413A50CEAC1036B687DB419ECFABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

3NTR.exe

Path C:\Users\Admin\AppData\Local\Temp\3NTR.exe
Size 1.3MB
SHA256 da790bcf7c028f524c2fe5b5b6e6ead3abf9649161fb4f65fe237ae21ea7fd73
MD5 c2ece908db03c94c308b4f7232031835
SHA1 52f7c3469917d1cab75abcb743e2b1f0a58d84e4
SHA512 0df32dc0af64ef90153e9fb119d9750bb3453d7f9970020e63fd3e5dd2725b05b478ac8f89d5f407607267a18e615eec33bd984892ab2b25b34a1f3b24b077df
SSDEEP 24576:AT0cYPOIMOL4s32mk44jpZVni2GYzwoFihT20pnXz9EHhoDB:AQcUOIUsGk4jvVnJAh7nXz9EHhoD
TLSH
T1B855AE47B2B450E9C07EE175DA46B50FEA713868072088DB13E455A82FF37F56BBA312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kppam4fb.urm.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kppam4fb.urm.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

elnun2ht.3ab.exe

Path C:\Users\Admin\AppData\Local\Temp\elnun2ht.3ab.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\Users\Admin\AppData\Local\Temp\system.exe
Size 427KB
SHA256 dfa88df0b571641944089f21c8570c197eb9b0a468137c6bd09c39a331553d66
MD5 353463d2a7d2b97ab1bb04d8e2dcd5dc
SHA1 8bea86abfe944b10f64de9fef29a94647ad4034a
SHA512 f807996e69f132a2eaaaa2fc0e75dd85a9caf1147b37ea74f8d664b06014c8b17b7a07f8ef5863f85b4b3633d4ec044fa91e80810bafa9e6dd9fa7a817477923
SSDEEP 6144:mPy/te/PKkvoXNTTwlJXQUEMlqJ8eFNLJ+1/5bTgVziHzZnSKrCbYMcRbl82q:ISkvodkY+4NA1/5/gVziHlBrCbYt8/
TLSH
T1D8946B51E2A482A3E16F87798D635B07A7B2F0379611E7DF0E8458D83E23790AC19F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5903.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5903.tmp.bat
Size 150B
SHA256 f6f3966231b067530fe47f8c15f4d198565ae0aecb92563c6a38fdaca2761320
MD5 082e920d713690ef28f0684bf3f3f318
SHA1 58cddb236f1bfe788ce6c3f0246ef0fa9db20a78
SHA512 19e645662c400046853eaf126a074677eee428ba62dac2ab0abaadab3436c33e195053bb66536ff9dc3592b72583e5eb95685df4af974a9f93eac125f737906f
TLSH
T151C02B4255C5EA0F2805141302FAD99DA272AC1B3F44BF80D708400E578045CF4DA341
MD5 SHA1 SHA512 TLSH

Submit Download

tput.exe

Path C:\Users\Admin\AppData\Local\Temp\tput.exe
Size 308KB
SHA256 2227a37063a9ceed3784f4ae74463b726ce8276848125b14a7e3a77cd89d91bc
MD5 5b3fe8434becc5cd65e96eb858aba9d1
SHA1 899d3f2164c3da9feda397dcba4e23bf7ce00128
SHA512 5cd6c13dca966ddec071cdd0ec494f82afc5bd311c292a88142107bde370f20e42e233d74d37114163762b89ba73f9098ccf27232867ca86dbcc10cbbfed7d73
SSDEEP 6144:vkIi17YaD4Ejy7xTryyzD4Qw0kq3tqtNHpO6rHLeVoaCmiqga7FRn2f:TsPtjy7dt3M0J6ppOwHLIoaCX5av2
TLSH
T140642367BAFB02BDF63D353B66AA20F30177C513624CD168C6997D3DA64007C66A227C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 262KB
SHA256 26e5a91dba56ec9c51dad33aee68e15d6dcdb3546055ef5fe2ccd6ef2eb90a6a
MD5 3c5aaaebd131b5b54316212f88941b47
SHA1 5c027ab857f8bd4b788576795ea5526d1ee9cda7
SHA512 1a9bc534aabcfb7dd251d08543c7de0109b7fae934a1089a2dca5b2f3f4499afe067b36307e53fe92a0dcdb95c1a34a3dfc689b15410956d81b91433254da7a8
SSDEEP 6144:X6Lb05/5bTgVziHzZnSKrCbYMcJbJ8iq:X605/5/gVziHlBrCbYN8L
TLSH
T1F0444952F69040FAD4BA81748D635B0277B2F0361711DBEF1E84489E7F63BE05D2ABA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svhost

Path C:\Windows\System32\Tasks\svhost
Size 3KB
SHA256 f985159e53dc120c363679a961e69f661d7acd712b44762ff0a1f2e7e4065e03
MD5 755be5dbd9cbf927811600d4defbf313
SHA1 081cd087561623d5d2599c20d53f5a7d9617518d
SHA512 267bf72a74a1210688e9401db5ebe0421c908ce03b0ae65052478a91580267fda58c8276ca0df8aa7958892ef1801acf1b34cbc30aa771f456f1ed879ebb0003
TLSH
T151617B536BEE1109F2F36B6CAEB750224E67BD515938C46D00AC250DCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 69KB
SHA256 0888ef30abf226b43d4713b4407b6c2aec15258a9f0b403bcbf7212ea01d9728
MD5 2b5000eee7bc1a500cf46bd8337afbe1
SHA1 81fbb991eb5ef3487978db0d344a49f2ea13dce1
SHA512 bf7d0b71e111220e8722a68c0f8da9e2cb5898a8e56eee99e27f4eecc0188a55586cbe620815dd5f06c7064c6b1730d80db9a55207c4d49d2c142a4f760284e3
SSDEEP 1536:pPLasfSWuWe5wPm5y/ju7j62lDDsGk7FdRYn6qmRzPdcstdydbI47j1+EBNnom9s:VYzmZ
TLSH
T142633A0584D8C649C9B719B27655EE70D63A6A9A730F4EE530EC6300DEC3F153BBA07A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-65-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/748-63-0x00000267B2F70000-0x00000267B2F95000-memory.dmp

Download

memory/748-64-0x00000267B2FA0000-0x00000267B2FCB000-memory.dmp

Download

memory/996-71-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/996-70-0x000001EC42C50000-0x000001EC42C7B000-memory.dmp

Download

memory/1004-73-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1004-69-0x000002D302300000-0x000002D30232B000-memory.dmp

Download

memory/1012-139-0x0000017729BF0000-0x0000017729C1B000-memory.dmp

Download

memory/1012-141-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1032-192-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1032-191-0x00000210F37D0000-0x00000210F37FB000-memory.dmp

Download

memory/1036-155-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1036-154-0x0000020C28E40000-0x0000020C28E6B000-memory.dmp

Download

memory/1124-158-0x0000016F6F3A0000-0x0000016F6F3CB000-memory.dmp

Download

memory/1124-159-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1208-79-0x0000022C650F0000-0x0000022C6511B000-memory.dmp

Download

memory/1208-80-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1256-162-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1256-161-0x0000017A4E9D0000-0x0000017A4E9FB000-memory.dmp

Download

memory/1288-165-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1288-164-0x0000026DD2BB0000-0x0000026DD2BDB000-memory.dmp

Download

memory/1364-167-0x000002092A4A0000-0x000002092A4CB000-memory.dmp

Download

memory/1364-168-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1384-170-0x000001BC88A10000-0x000001BC88A3B000-memory.dmp

Download

memory/1384-171-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1552-62-0x0000022FA1B00000-0x0000022FA1B16000-memory.dmp

Download

memory/1552-39-0x0000022F9FC10000-0x0000022F9FC58000-memory.dmp

Download

memory/1560-88-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1560-87-0x000001BA2D490000-0x000001BA2D4BB000-memory.dmp

Download

memory/1600-173-0x0000020C7FBF0000-0x0000020C7FC1B000-memory.dmp

Download

memory/1600-174-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1636-176-0x000001BFD97A0000-0x000001BFD97CB000-memory.dmp

Download

memory/1636-177-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1720-179-0x00000209E69E0000-0x00000209E6A0B000-memory.dmp

Download

memory/1720-180-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1764-183-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1764-182-0x000002142FB50000-0x000002142FB7B000-memory.dmp

Download

memory/1768-186-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/1768-185-0x000002820AB70000-0x000002820AB9B000-memory.dmp

Download

memory/2008-188-0x000002061C680000-0x000002061C6AB000-memory.dmp

Download

memory/2008-189-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2056-194-0x0000021D565D0000-0x0000021D565FB000-memory.dmp

Download

memory/2056-195-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2080-197-0x000002B9C1510000-0x000002B9C153B000-memory.dmp

Download

memory/2080-198-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2096-201-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2096-200-0x000001F14FD90000-0x000001F14FDBB000-memory.dmp

Download

memory/2240-203-0x000001AEBEE00000-0x000001AEBEE2B000-memory.dmp

Download

memory/2240-204-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2292-207-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2292-206-0x0000026E5BED0000-0x0000026E5BEFB000-memory.dmp

Download

memory/2348-211-0x000002236D300000-0x000002236D32B000-memory.dmp

Download

memory/2348-213-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2420-209-0x000001E587E90000-0x000001E587EBB000-memory.dmp

Download

memory/2420-210-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2524-215-0x0000014E14570000-0x0000014E1459B000-memory.dmp

Download

memory/2524-216-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/2572-218-0x0000028C847E0000-0x0000028C8480B000-memory.dmp

Download

memory/2864-656-0x0000020D65020000-0x0000020D65032000-memory.dmp

Download

memory/2864-619-0x0000020D64CF0000-0x0000020D64D0E000-memory.dmp

Download

memory/2864-615-0x0000020D64D20000-0x0000020D64D70000-memory.dmp

Download

memory/2864-614-0x0000020D64D70000-0x0000020D64DE6000-memory.dmp

Download

memory/2864-38-0x0000020D4A240000-0x0000020D4A2B0000-memory.dmp

Download

memory/2864-49-0x0000020D64980000-0x0000020D649C0000-memory.dmp

Download

memory/2864-40-0x0000020D4BEB0000-0x0000020D4BEDC000-memory.dmp

Download

memory/2864-655-0x0000020D64FF0000-0x0000020D64FFA000-memory.dmp

Download

memory/3136-362-0x0000016D1FE20000-0x0000016D1FED2000-memory.dmp

Download

memory/3136-358-0x0000016D1FA20000-0x0000016D1FA42000-memory.dmp

Download

memory/3136-361-0x0000016D1FBF0000-0x0000016D1FC0E000-memory.dmp

Download

memory/3136-363-0x0000016D1FFE0000-0x0000016D1FFEA000-memory.dmp

Download

memory/4440-148-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/4440-147-0x0000000005BD0000-0x0000000005BFB000-memory.dmp

Download

memory/4616-52-0x00007FFBF8270000-0x00007FFBF8337000-memory.dmp

Download

memory/4616-51-0x00007FFBF88E0000-0x00007FFBF8B43000-memory.dmp

Download

memory/5032-134-0x00007FFBB8A20000-0x00007FFBB8A30000-memory.dmp

Download

memory/5032-132-0x0000025F89CB0000-0x0000025F89CDB000-memory.dmp

Download

memory/5712-60-0x00007FFBF88E0000-0x00007FFBF8B43000-memory.dmp

Download

memory/5712-61-0x00007FFBF8270000-0x00007FFBF8337000-memory.dmp

Download

memory/5832-21-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp

Download

memory/5832-1-0x0000000000210000-0x0000000000326000-memory.dmp

Download

memory/5832-4-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp

Download

memory/5832-2-0x00007FFBD5B60000-0x00007FFBD6504000-memory.dmp

Download

memory/5832-0-0x00007FFBD5CEF000-0x00007FFBD5CF0000-memory.dmp

Download

memory/6040-20-0x0000000000780000-0x00000000007D4000-memory.dmp

Download

memory/6092-430-0x000001E97C130000-0x000001E97C178000-memory.dmp

Download

memory/6092-789-0x000001E97F180000-0x000001E97F1B4000-memory.dmp

Download