agenttesla | 3e3bf2b2439b584bb039f072d969a4b31f5eb4c03fd8033fec911ff3ed5c1878

Analysis

max time kernel
26s
max time network
146s
platform
windows10_x64
resource
win10-en
submitted
15-09-2021 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ac2d91af826847f3e2544b2420a814d.exe
Size

819KB
MD5

2ac2d91af826847f3e2544b2420a814d
SHA1

79101b95f1d8171e6e5c4ce4e9d9372466a6259d
SHA256

3e3bf2b2439b584bb039f072d969a4b31f5eb4c03fd8033fec911ff3ed5c1878
SHA512

9785737408c6345e35d4ebe9f438bd2647f2b9e230b53592a5d3eebfc70b1969d4e1d614bbe44d7579803af51211f84d2060f558b9052875169f55f91195b4fc

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
mailjege@yandex.com
Password:
recovery111

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1016-169-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1016-173-0x000000000043770E-mapping.dmp	family_agenttesla
behavioral2/memory/4404-1221-0x000000000043770E-mapping.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Nirsoft 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe	Nirsoft

Executes dropped EXE 3 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exeF1385DE3.exe

pid process

316 AdvancedRun.exe
3940 AdvancedRun.exe
1148 F1385DE3.exe
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2ac2d91af826847f3e2544b2420a814d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2ac2d91af826847f3e2544b2420a814d.exe

Drops startup file 2 IoCs

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe	2ac2d91af826847f3e2544b2420a814d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe	2ac2d91af826847f3e2544b2420a814d.exe

Windows security modification 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	2ac2d91af826847f3e2544b2420a814d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\2D17B9CF\svchost.exe = "0"	2ac2d91af826847f3e2544b2420a814d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	2ac2d91af826847f3e2544b2420a814d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	2ac2d91af826847f3e2544b2420a814d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe = "0"	2ac2d91af826847f3e2544b2420a814d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe = "0"	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	2ac2d91af826847f3e2544b2420a814d.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2ac2d91af826847f3e2544b2420a814d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2ac2d91af826847f3e2544b2420a814d.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2ac2d91af826847f3e2544b2420a814d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	2ac2d91af826847f3e2544b2420a814d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description pid process target process

PID 4000 set thread context of 1016 4000 2ac2d91af826847f3e2544b2420a814d.exe 2ac2d91af826847f3e2544b2420a814d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1088 1148 WerFault.exe F1385DE3.exe

description	pid	process	target process
PID 4000 set thread context of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe

pid	pid_target	process	target process
1088	1148	WerFault.exe	F1385DE3.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
316	AdvancedRun.exe
316	AdvancedRun.exe
316	AdvancedRun.exe
316	AdvancedRun.exe
3940	AdvancedRun.exe
3940	AdvancedRun.exe
3940	AdvancedRun.exe
3940	AdvancedRun.exe
3296	powershell.exe
3968	powershell.exe
592	powershell.exe
3264	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exe2ac2d91af826847f3e2544b2420a814d.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	316	AdvancedRun.exe
Token: SeImpersonatePrivilege	316	AdvancedRun.exe
Token: SeDebugPrivilege	3940	AdvancedRun.exe
Token: SeImpersonatePrivilege	3940	AdvancedRun.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	4000	2ac2d91af826847f3e2544b2420a814d.exe
Token: SeDebugPrivilege	3264	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

2ac2d91af826847f3e2544b2420a814d.exeAdvancedRun.exe

description	pid	process	target process
PID 4000 wrote to memory of 316	4000	2ac2d91af826847f3e2544b2420a814d.exe	AdvancedRun.exe
PID 4000 wrote to memory of 316	4000	2ac2d91af826847f3e2544b2420a814d.exe	AdvancedRun.exe
PID 4000 wrote to memory of 316	4000	2ac2d91af826847f3e2544b2420a814d.exe	AdvancedRun.exe
PID 316 wrote to memory of 3940	316	AdvancedRun.exe	AdvancedRun.exe
PID 316 wrote to memory of 3940	316	AdvancedRun.exe	AdvancedRun.exe
PID 316 wrote to memory of 3940	316	AdvancedRun.exe	AdvancedRun.exe
PID 4000 wrote to memory of 3296	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3296	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3296	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3968	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3968	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3968	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3264	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3264	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3264	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 592	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 592	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 592	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1268	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1268	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1268	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1148	4000	2ac2d91af826847f3e2544b2420a814d.exe	F1385DE3.exe
PID 4000 wrote to memory of 1148	4000	2ac2d91af826847f3e2544b2420a814d.exe	F1385DE3.exe
PID 4000 wrote to memory of 1148	4000	2ac2d91af826847f3e2544b2420a814d.exe	F1385DE3.exe
PID 4000 wrote to memory of 1692	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1692	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1692	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1996	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1996	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 1996	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3660	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3660	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 3660	4000	2ac2d91af826847f3e2544b2420a814d.exe	powershell.exe
PID 4000 wrote to memory of 2832	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 2832	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 2832	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe
PID 4000 wrote to memory of 1016	4000	2ac2d91af826847f3e2544b2420a814d.exe	2ac2d91af826847f3e2544b2420a814d.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

2ac2d91af826847f3e2544b2420a814d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2ac2d91af826847f3e2544b2420a814d.exe

C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe
"C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe"
1⤵
- Checks BIOS information in registry
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4000

C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316

C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe" /SpecialRun 4101d8 316
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe" -Force
2⤵
PID:1268

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe"
2⤵
- Executes dropped EXE
PID:1148

C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
PID:2644

C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe" /SpecialRun 4101d8 2644
4⤵
PID:4100

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe" -Force
3⤵
PID:4660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe" -Force
3⤵
PID:4780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2D17B9CF\svchost.exe" -Force
3⤵
PID:4876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe" -Force
3⤵
PID:4920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2D17B9CF\svchost.exe" -Force
3⤵
PID:408

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe"
3⤵
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe"
3⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 1772
3⤵
- Program crash
PID:1088

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2D17B9CF\svchost.exe" -Force
2⤵
PID:1692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe" -Force
2⤵
PID:1996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2D17B9CF\svchost.exe" -Force
2⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe
"C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe"
2⤵
PID:2832

C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe
"C:\Users\Admin\AppData\Local\Temp\2ac2d91af826847f3e2544b2420a814d.exe"
2⤵
PID:1016

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
71f1cd7681a0b887f835e3aadeea7767

SHA1
f784f0ff4b999ddfa59633e592aba8736763bf50

SHA256
f01aec7092ba6bdab328a091b414002487ae38c51df0917ffe57bc1254d11a42

SHA512
450d9ac3236ce36625d0a6585f9ee0bf430c2899f77211ba79d1dd23c070d9323d3a2c91673d44988f896e1b549d839f147148ac474cad9111714cf98cd56064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
54b389a19d2d06a6b9ae17ba1c96fc5e

SHA1
1970cf5bf46da7bef8305ad3f8543cc310354c92

SHA256
e87b38fc3f390a8b430c92ae83f5294c94208ca235aea8ee5762aac39740991b

SHA512
4c76fdbe3be1f8b46c099689bcb9edc4da848c542301052b49c313ad3721a0cdb176568bb77f78a2adf5c389184705fa0e4ffe0e6e728c67f27f8f8f384da1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
101343244d619fd29dc007b34351865b

SHA1
a721bf0ee99f24b3e6c263033cfa02a63d4175cc

SHA256
286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

SHA512
1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
c3a4ad4654dbe023b7edf49440b53c4b

SHA1
72d530ac70fc6e0372a3badcc0fdc804fdbbfed6

SHA256
63725a9192868d05d598ff54e0791f5eb904a1291a4506e397d8b6d69be0b407

SHA512
9c881da58890993b1580fd58ed10183e62f09c6c7d1d588a59aa324039625eb6ec07da0049fe45a9ba6996d4ab32d4154a92c30148d76c6afc5c2c42ccd44c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6d4f39b3159de48ac594b7808bea0bf2

SHA1
60e89b6e363814bd798b616d97c568c14fb8cd73

SHA256
fe44939cb1a5df493c95bd69211216632ae72b6029aed69157b8f249fa63691d

SHA512
5bf9c51005130064f39b61e9773695d632da425490904d18b46a4d51cffca1218f8c91bcd4f3a756adae5bf028b326e114ccfce9277c0d047a04bfe0991e2430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6d4f39b3159de48ac594b7808bea0bf2

SHA1
60e89b6e363814bd798b616d97c568c14fb8cd73

SHA256
fe44939cb1a5df493c95bd69211216632ae72b6029aed69157b8f249fa63691d

SHA512
5bf9c51005130064f39b61e9773695d632da425490904d18b46a4d51cffca1218f8c91bcd4f3a756adae5bf028b326e114ccfce9277c0d047a04bfe0991e2430

Download Submit
C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\801e38ed-d6d7-4abf-82df-2f9009dbe135\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5f454c9-b1b8-44c4-ba11-174ba3175c8d\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
MD5
2ac2d91af826847f3e2544b2420a814d

SHA1
79101b95f1d8171e6e5c4ce4e9d9372466a6259d

SHA256
3e3bf2b2439b584bb039f072d969a4b31f5eb4c03fd8033fec911ff3ed5c1878

SHA512
9785737408c6345e35d4ebe9f438bd2647f2b9e230b53592a5d3eebfc70b1969d4e1d614bbe44d7579803af51211f84d2060f558b9052875169f55f91195b4fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
MD5
2ac2d91af826847f3e2544b2420a814d

SHA1
79101b95f1d8171e6e5c4ce4e9d9372466a6259d

SHA256
3e3bf2b2439b584bb039f072d969a4b31f5eb4c03fd8033fec911ff3ed5c1878

SHA512
9785737408c6345e35d4ebe9f438bd2647f2b9e230b53592a5d3eebfc70b1969d4e1d614bbe44d7579803af51211f84d2060f558b9052875169f55f91195b4fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
MD5
2ac2d91af826847f3e2544b2420a814d

SHA1
79101b95f1d8171e6e5c4ce4e9d9372466a6259d

SHA256
3e3bf2b2439b584bb039f072d969a4b31f5eb4c03fd8033fec911ff3ed5c1878

SHA512
9785737408c6345e35d4ebe9f438bd2647f2b9e230b53592a5d3eebfc70b1969d4e1d614bbe44d7579803af51211f84d2060f558b9052875169f55f91195b4fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F1385DE3.exe
MD5
2ac2d91af826847f3e2544b2420a814d

SHA1
79101b95f1d8171e6e5c4ce4e9d9372466a6259d

SHA256
3e3bf2b2439b584bb039f072d969a4b31f5eb4c03fd8033fec911ff3ed5c1878

SHA512
9785737408c6345e35d4ebe9f438bd2647f2b9e230b53592a5d3eebfc70b1969d4e1d614bbe44d7579803af51211f84d2060f558b9052875169f55f91195b4fc

Download Submit
memory/316-122-0x0000000000000000-mapping.dmp

Download
memory/408-1299-0x0000000004522000-0x0000000004523000-memory.dmp

Filesize
4KB

Download
memory/408-1279-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/408-2324-0x000000007FD90000-0x000000007FD91000-memory.dmp

Filesize
4KB

Download
memory/408-1149-0x0000000000000000-mapping.dmp

Download
memory/592-161-0x00000000072D2000-0x00000000072D3000-memory.dmp

Filesize
4KB

Download
memory/592-130-0x0000000000000000-mapping.dmp

Download
memory/592-394-0x000000007EDF0000-0x000000007EDF1000-memory.dmp

Filesize
4KB

Download
memory/592-481-0x00000000072D3000-0x00000000072D4000-memory.dmp

Filesize
4KB

Download
memory/592-199-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/1016-173-0x000000000043770E-mapping.dmp

Download
memory/1016-197-0x0000000005150000-0x000000000564E000-memory.dmp

Filesize
5.0MB

Download
memory/1016-169-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1016-187-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1148-203-0x0000000005380000-0x000000000587E000-memory.dmp

Filesize
5.0MB

Download
memory/1148-134-0x0000000000000000-mapping.dmp

Download
memory/1268-380-0x000000007F000000-0x000000007F001000-memory.dmp

Filesize
4KB

Download
memory/1268-163-0x0000000006D00000-0x0000000006D01000-memory.dmp

Filesize
4KB

Download
memory/1268-131-0x0000000000000000-mapping.dmp

Download
memory/1268-454-0x0000000006D03000-0x0000000006D04000-memory.dmp

Filesize
4KB

Download
memory/1268-165-0x0000000006D02000-0x0000000006D03000-memory.dmp

Filesize
4KB

Download
memory/1692-468-0x0000000006A63000-0x0000000006A64000-memory.dmp

Filesize
4KB

Download
memory/1692-388-0x000000007F6D0000-0x000000007F6D1000-memory.dmp

Filesize
4KB

Download
memory/1692-175-0x0000000006A60000-0x0000000006A61000-memory.dmp

Filesize
4KB

Download
memory/1692-140-0x0000000000000000-mapping.dmp

Download
memory/1692-185-0x0000000006A62000-0x0000000006A63000-memory.dmp

Filesize
4KB

Download
memory/1996-399-0x000000007DF30000-0x000000007DF31000-memory.dmp

Filesize
4KB

Download
memory/1996-476-0x0000000004A63000-0x0000000004A64000-memory.dmp

Filesize
4KB

Download
memory/1996-189-0x0000000004A62000-0x0000000004A63000-memory.dmp

Filesize
4KB

Download
memory/1996-144-0x0000000000000000-mapping.dmp

Download
memory/1996-183-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/2644-994-0x0000000000000000-mapping.dmp

Download
memory/3264-406-0x0000000004FB3000-0x0000000004FB4000-memory.dmp

Filesize
4KB

Download
memory/3264-195-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3264-129-0x0000000000000000-mapping.dmp

Download
memory/3264-207-0x0000000004FB2000-0x0000000004FB3000-memory.dmp

Filesize
4KB

Download
memory/3264-310-0x000000007ED40000-0x000000007ED41000-memory.dmp

Filesize
4KB

Download
memory/3296-418-0x0000000006D33000-0x0000000006D34000-memory.dmp

Filesize
4KB

Download
memory/3296-324-0x000000007F680000-0x000000007F681000-memory.dmp

Filesize
4KB

Download
memory/3296-127-0x0000000000000000-mapping.dmp

Download
memory/3296-136-0x0000000006C00000-0x0000000006C01000-memory.dmp

Filesize
4KB

Download
memory/3296-142-0x0000000007370000-0x0000000007371000-memory.dmp

Filesize
4KB

Download
memory/3296-158-0x0000000006D30000-0x0000000006D31000-memory.dmp

Filesize
4KB

Download
memory/3296-181-0x00000000072C0000-0x00000000072C1000-memory.dmp

Filesize
4KB

Download
memory/3296-167-0x0000000006D32000-0x0000000006D33000-memory.dmp

Filesize
4KB

Download
memory/3296-198-0x0000000007B80000-0x0000000007B81000-memory.dmp

Filesize
4KB

Download
memory/3296-204-0x0000000007C20000-0x0000000007C21000-memory.dmp

Filesize
4KB

Download
memory/3660-372-0x000000007F260000-0x000000007F261000-memory.dmp

Filesize
4KB

Download
memory/3660-194-0x00000000065D2000-0x00000000065D3000-memory.dmp

Filesize
4KB

Download
memory/3660-460-0x00000000065D3000-0x00000000065D4000-memory.dmp

Filesize
4KB

Download
memory/3660-149-0x0000000000000000-mapping.dmp

Download
memory/3660-191-0x00000000065D0000-0x00000000065D1000-memory.dmp

Filesize
4KB

Download
memory/3940-125-0x0000000000000000-mapping.dmp

Download
memory/3968-178-0x00000000069B2000-0x00000000069B3000-memory.dmp

Filesize
4KB

Download
memory/3968-317-0x000000007F630000-0x000000007F631000-memory.dmp

Filesize
4KB

Download
memory/3968-128-0x0000000000000000-mapping.dmp

Download
memory/3968-171-0x00000000069B0000-0x00000000069B1000-memory.dmp

Filesize
4KB

Download
memory/3968-412-0x00000000069B3000-0x00000000069B4000-memory.dmp

Filesize
4KB

Download
memory/4000-120-0x0000000005500000-0x0000000005568000-memory.dmp

Filesize
416KB

Download
memory/4000-119-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/4000-159-0x0000000006A20000-0x0000000006A21000-memory.dmp

Filesize
4KB

Download
memory/4000-118-0x0000000005580000-0x0000000005A7E000-memory.dmp

Filesize
5.0MB

Download
memory/4000-121-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/4000-117-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/4000-115-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4000-116-0x0000000005A80000-0x0000000005A81000-memory.dmp

Filesize
4KB

Download
memory/4000-176-0x0000000006A50000-0x0000000006A53000-memory.dmp

Filesize
12KB

Download
memory/4100-999-0x0000000000000000-mapping.dmp

Download
memory/4404-1308-0x0000000004BD0000-0x00000000050CE000-memory.dmp

Filesize
5.0MB

Download
memory/4404-1221-0x000000000043770E-mapping.dmp

Download
memory/4660-1084-0x0000000000000000-mapping.dmp

Download
memory/4660-1203-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/4660-2451-0x000000007E240000-0x000000007E241000-memory.dmp

Filesize
4KB

Download
memory/4660-1267-0x0000000004EF2000-0x0000000004EF3000-memory.dmp

Filesize
4KB

Download
memory/4780-1258-0x00000000071D0000-0x00000000071D1000-memory.dmp

Filesize
4KB

Download
memory/4780-2214-0x000000007F160000-0x000000007F161000-memory.dmp

Filesize
4KB

Download
memory/4780-1100-0x0000000000000000-mapping.dmp

Download
memory/4780-1325-0x00000000071D2000-0x00000000071D3000-memory.dmp

Filesize
4KB

Download
memory/4876-1115-0x0000000000000000-mapping.dmp

Download
memory/4876-1316-0x0000000007242000-0x0000000007243000-memory.dmp

Filesize
4KB

Download
memory/4876-2441-0x000000007E7A0000-0x000000007E7A1000-memory.dmp

Filesize
4KB

Download
memory/4876-1334-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/4920-1288-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/4920-1132-0x0000000000000000-mapping.dmp

Download
memory/4920-2446-0x000000007E920000-0x000000007E921000-memory.dmp

Filesize
4KB

Download
memory/4920-1343-0x0000000004422000-0x0000000004423000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads