kpot | dc68a0a13aa0a1bf5394dd04e59ef2916f0b31a964730a17b0ff4afeac5888dc

General

Target

dc02167cff131c6e6c0a2801f1eb3b0c.exe
Size

399KB
MD5

dc02167cff131c6e6c0a2801f1eb3b0c
SHA1

20d395af135774018632b34dd6987ebfe43db43d
SHA256

dc68a0a13aa0a1bf5394dd04e59ef2916f0b31a964730a17b0ff4afeac5888dc
SHA512

438864813274ec6a5a9350391994de17512d957eccd4ffb4d7113e15e69e3c5171d94eb90c0081ac05c1a616ffe53999fd5bc46dda242847b4dcd7eaa1837362

Score

10^/10

kpot discovery spyware stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1440-7-0x0000000000290000-0x00000000002AE000-memory.dmp	family_kpot

Executes dropped EXE 1 IoCs

Processes:

wotsuper.exe

pid process

1440 wotsuper.exe
Loads dropped DLL 1 IoCs

Processes:

dc02167cff131c6e6c0a2801f1eb3b0c.exe

pid process

900 dc02167cff131c6e6c0a2801f1eb3b0c.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1440	wotsuper.exe

pid	process
900	dc02167cff131c6e6c0a2801f1eb3b0c.exe

Drops file in Program Files directory 3 IoCs

Processes:

dc02167cff131c6e6c0a2801f1eb3b0c.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	dc02167cff131c6e6c0a2801f1eb3b0c.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	dc02167cff131c6e6c0a2801f1eb3b0c.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	dc02167cff131c6e6c0a2801f1eb3b0c.exe

Drops file in Windows directory 1 IoCs

Processes:

dc02167cff131c6e6c0a2801f1eb3b0c.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg dc02167cff131c6e6c0a2801f1eb3b0c.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	dc02167cff131c6e6c0a2801f1eb3b0c.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bb643e8954d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67199931-C07C-11EA-BEB3-DE4D81BBE446} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab8000000000200000000001066000000010000200000003112369fb4b89ef8f932bb288f1aaf6ab71c269ddfadd1ce315467685f4f0204000000000e80000000020000200000009a762d42ee723ddf09f29eb5cb490ca08f95abb55001100a9641d5b8a81c261b20000000f8d5f97dbd1bad444135fe566530dd2902ea82b4b88d4dd5135ac672ff85252740000000c076d5490e8481f82115ac40286e9b4fc204618f859aaa22a5b182223e55b920021fc8448dee7000efe7a00633fa576cefdf497a2a0068b5650a1a003d19bba9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "300910088"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b0829a874ca164698fa08cb019bbab800000000020000000000106600000001000020000000bc20094db9c9d97f38be3cdd74aedfb5ddcee49457b3ac992a760e8cd3ff1113000000000e800000000200002000000092e966019899a2f81ae7791b11de5b040ca6d22dec9e01c485803cd2584f55c190000000a1eeb03eb8bba2778c2158e2146cb830673c7a1134e05af464efd305e5f48b16311fbbc066ccd29cdb80a46f1484295102a5db1fda1f2723475baac9597b26fedc754f37c90601231d3ae422c11b86c358b546990a30515e2fa18afe947dd2e999403f56f366413d0ec81760e324699d0d847148945aa75e07b547528384b09807abe63e3fd3c16a23382557e3ca009a40000000403e438ef6beeeec10129b70a3d1e11e84c1b8154038081adaa4dcc0b3409272eb1424074c4686ebb569d3a9510646ac058c5000f45b1bd0b042066d8b91b4de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

wotsuper.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wotsuper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	wotsuper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wotsuper.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}	wotsuper.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\32-e2-17-db-d2-77	wotsuper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	wotsuper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionReason = "1"	wotsuper.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecisionTime = 101a98328954d601	wotsuper.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadNetworkName = "Network"	wotsuper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	wotsuper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wotsuper.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wotsuper.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 101a98328954d601	wotsuper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	wotsuper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wotsuper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C7121406-7FD4-42C9-B2AC-0BA026A12C21}\WpadDecision = "0"	wotsuper.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	wotsuper.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

832 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1544 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

wotsuper.exe

pid process

1440 wotsuper.exe
1440 wotsuper.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

wotsuper.exe

description pid process

Token: SeDebugPrivilege 1440 wotsuper.exe
Token: SeCreateTokenPrivilege 1440 wotsuper.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1288 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1288 iexplore.exe
1288 iexplore.exe
1536 IEXPLORE.EXE
1536 IEXPLORE.EXE
1536 IEXPLORE.EXE
1536 IEXPLORE.EXE

pid	process
832	regedit.exe

pid	process
1544	PING.EXE

pid	process
1440	wotsuper.exe
1440	wotsuper.exe

description	pid	process
Token: SeDebugPrivilege	1440	wotsuper.exe
Token: SeCreateTokenPrivilege	1440	wotsuper.exe

pid	process
1288	iexplore.exe

pid	process
1288	iexplore.exe
1288	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

dc02167cff131c6e6c0a2801f1eb3b0c.exeiexplore.exewotsuper.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1288	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	iexplore.exe
PID 900 wrote to memory of 1288	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	iexplore.exe
PID 900 wrote to memory of 1288	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	iexplore.exe
PID 900 wrote to memory of 1288	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	iexplore.exe
PID 900 wrote to memory of 1440	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	wotsuper.exe
PID 900 wrote to memory of 1440	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	wotsuper.exe
PID 900 wrote to memory of 1440	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	wotsuper.exe
PID 900 wrote to memory of 1440	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	wotsuper.exe
PID 900 wrote to memory of 832	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	regedit.exe
PID 900 wrote to memory of 832	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	regedit.exe
PID 900 wrote to memory of 832	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	regedit.exe
PID 900 wrote to memory of 832	900	dc02167cff131c6e6c0a2801f1eb3b0c.exe	regedit.exe
PID 1288 wrote to memory of 1536	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 1536	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 1536	1288	iexplore.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 1536	1288	iexplore.exe	IEXPLORE.EXE
PID 1440 wrote to memory of 836	1440	wotsuper.exe	cmd.exe
PID 1440 wrote to memory of 836	1440	wotsuper.exe	cmd.exe
PID 1440 wrote to memory of 836	1440	wotsuper.exe	cmd.exe
PID 1440 wrote to memory of 836	1440	wotsuper.exe	cmd.exe
PID 836 wrote to memory of 1544	836	cmd.exe	PING.EXE
PID 836 wrote to memory of 1544	836	cmd.exe	PING.EXE
PID 836 wrote to memory of 1544	836	cmd.exe	PING.EXE
PID 836 wrote to memory of 1544	836	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\dc02167cff131c6e6c0a2801f1eb3b0c.exe
"C:\Users\Admin\AppData\Local\Temp\dc02167cff131c6e6c0a2801f1eb3b0c.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1Ldta7.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1536
- C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
  "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1544
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
  2⤵
  - Runs .reg file with regedit
  PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

MD5
c95ff8d6534c9c121f4b0d86f34bd7e3

SHA1
dd169fd7795ceea01da3986e8865bec51fe32c6b

SHA256
0829eb19b5fed988fbaf35fe8511f80ed8bad93068bc2ad6a56b611454e67036

SHA512
ab2be16ce08a690841d59e36ea40e83950a20e76ab2a97a47f80d4238adc5c45dab47225bb3c9bf5080bb66f32493a10c987139ebef03f6b7c93fe9d86b61842

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

MD5
c95ff8d6534c9c121f4b0d86f34bd7e3

SHA1
dd169fd7795ceea01da3986e8865bec51fe32c6b

SHA256
0829eb19b5fed988fbaf35fe8511f80ed8bad93068bc2ad6a56b611454e67036

SHA512
ab2be16ce08a690841d59e36ea40e83950a20e76ab2a97a47f80d4238adc5c45dab47225bb3c9bf5080bb66f32493a10c987139ebef03f6b7c93fe9d86b61842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
6f7b84732633582f85e667b3453d46e0

SHA1
80d367a8a3489db353e2d4c207c192bbd1122968

SHA256
4210cd9e726cee0374ee6583f30060ed9b181d87f83c8a6a3dcece2dab154bae

SHA512
113c70bc40aa54acae9f7d6e512c3b15f52d4782b1c336cfe6e82da090601eb36f28dce9dfebc90452d6ee7e8a38b3dba251a917a5afc874f02ff11c10a7b6d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\j8hu3ld\imagestore.dat

MD5
b3c3311890eb25e8c74c65c996c680cf

SHA1
bfbf3f6ad0373a0985304fd1a8c3bb2d7243d57b

SHA256
1a4f161d7d86f516407e00b30ea89898527dbf1db85c6109f761d3c952c552bf

SHA512
1a3f5f806593dc763803bb0e6367c4eb2e39cfaf1261cafce870a6302d2d3b307c937eab73358767fdf2a79e2b028a9c931fee24e1c52109cba7e89ab0d076b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CWYJS62L.txt

MD5
6676dcce76a53817be412e91327a7726

SHA1
411e1ac78e36dbe5387b340af523181ca6a6838f

SHA256
e11f770efab6c668c180984723356d2e9607f7c6c35965ae9ef55232d119f5a5

SHA512
3dc1d36a52d585836eb0bcc198185dbb5cd378cdda9333e8e9dc9340edf4da082544c5d6827c7846bfdf426511780ca1ceede30756e6f6a648df5e3c30426800

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

MD5
c95ff8d6534c9c121f4b0d86f34bd7e3

SHA1
dd169fd7795ceea01da3986e8865bec51fe32c6b

SHA256
0829eb19b5fed988fbaf35fe8511f80ed8bad93068bc2ad6a56b611454e67036

SHA512
ab2be16ce08a690841d59e36ea40e83950a20e76ab2a97a47f80d4238adc5c45dab47225bb3c9bf5080bb66f32493a10c987139ebef03f6b7c93fe9d86b61842

Download Submit
memory/832-4-0x0000000000000000-mapping.dmp

Download
memory/836-11-0x0000000000000000-mapping.dmp

Download
memory/1288-0-0x0000000000000000-mapping.dmp

Download
memory/1440-7-0x0000000000290000-0x00000000002AE000-memory.dmp

Filesize
120KB

Download
memory/1440-5-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1440-2-0x0000000000000000-mapping.dmp

Download
memory/1536-8-0x0000000000000000-mapping.dmp

Download
memory/1544-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads