njrat | 078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615

General

Target

078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe
Size

350KB
MD5

5d06ee3b0572ce04a5e53e25233dc693
SHA1

0aad02d7f40c706876c82bec8a2b67a1b81b678c
SHA256

078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615
SHA512

7ac400882991331e077af57cad5ebdd7d0614c5c1f24ca397865a9f80c3bfe8d4f68e0a00ca807a05196a0d1acef95f3fce0cc2d4efe8e9a21e9f71e61415787

Score

10^/10

njrat hack persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

hack

C2

gazik500.ddns.net:4444

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

Dannie.exeserver.exesvchost.exe

pid process

3472 Dannie.exe
1916 server.exe
384 svchost.exe

pid	process
3472	Dannie.exe
1916	server.exe
384	svchost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exeDannie.exeserver.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	Dannie.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	server.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Drops file in Program Files directory 6 IoCs

Processes:

Dannie.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\d;	Dannie.exe
File created	C:\Program Files (x86)\d;\__tmp_rar_sfx_access_check_240559578	Dannie.exe
File created	C:\Program Files (x86)\d;\11.jpg	Dannie.exe
File opened for modification	C:\Program Files (x86)\d;\11.jpg	Dannie.exe
File created	C:\Program Files (x86)\d;\Server.exe	Dannie.exe
File opened for modification	C:\Program Files (x86)\d;\Server.exe	Dannie.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PaintStudio.View.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	PaintStudio.View.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	PaintStudio.View.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	PaintStudio.View.exe

Modifies registry class 17 IoCs

Processes:

PaintStudio.View.exe078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheVersion = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\MuiCache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheVersion = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

PaintStudio.View.exe

pid process

3516 PaintStudio.View.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mspaint.exe

pid process

3264 mspaint.exe
3264 mspaint.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

server.exesvchost.exe

pid process

1916 server.exe
384 svchost.exe

pid	process
3516	PaintStudio.View.exe

pid	process
3264	mspaint.exe
3264	mspaint.exe

pid	process
1916	server.exe
384	svchost.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

PaintStudio.View.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3516	PaintStudio.View.exe
Token: SeDebugPrivilege	3516	PaintStudio.View.exe
Token: SeDebugPrivilege	3516	PaintStudio.View.exe
Token: SeDebugPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe
Token: 33	384	svchost.exe
Token: SeIncBasePriorityPrivilege	384	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mspaint.exePaintStudio.View.exe

pid process

3264 mspaint.exe
3516 PaintStudio.View.exe

pid	process
3264	mspaint.exe
3516	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exeDannie.exeserver.exe

description	pid	process	target process
PID 1452 wrote to memory of 3472	1452	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe	Dannie.exe
PID 1452 wrote to memory of 3472	1452	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe	Dannie.exe
PID 1452 wrote to memory of 3472	1452	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe	Dannie.exe
PID 1452 wrote to memory of 3264	1452	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe	mspaint.exe
PID 1452 wrote to memory of 3264	1452	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe	mspaint.exe
PID 1452 wrote to memory of 3264	1452	078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe	mspaint.exe
PID 3472 wrote to memory of 1916	3472	Dannie.exe	server.exe
PID 3472 wrote to memory of 1916	3472	Dannie.exe	server.exe
PID 3472 wrote to memory of 1916	3472	Dannie.exe	server.exe
PID 1916 wrote to memory of 384	1916	server.exe	svchost.exe
PID 1916 wrote to memory of 384	1916	server.exe	svchost.exe
PID 1916 wrote to memory of 384	1916	server.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe
"C:\Users\Admin\AppData\Local\Temp\078e63578cd61942f85311134a4edf3978070b26577b612ffc4ef1de2a179615.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\Dannie.exe
"C:\Users\Admin\AppData\Local\Temp\Dannie.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3472

C:\Program Files (x86)\d;\server.exe
"C:\Program Files (x86)\d;\server.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:384

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\166740_after.png" /ForceBootstrapPaint3D
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:5072

C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:4616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\d;\Server.exe
Filesize
43KB

MD5
4890d2eb768ec17a3a6ee2ab12209d74

SHA1
9bc2b46e4760e26bf95541b13a39348dfa0b2680

SHA256
1110e17ee226f56a7f3feed52e8b69fc4d8b3a5edc018f20af96d199009c3d64

SHA512
78d0b1024b2d0d14184934db2b45d29fff083e52fd665b28f7776ea01d2fe0196452961a2cb16f4658751a5c01a3f64dab2436ff47786b2de1a3a7724aa828e1

Download Submit
C:\Program Files (x86)\d;\server.exe
Filesize
43KB

MD5
4890d2eb768ec17a3a6ee2ab12209d74

SHA1
9bc2b46e4760e26bf95541b13a39348dfa0b2680

SHA256
1110e17ee226f56a7f3feed52e8b69fc4d8b3a5edc018f20af96d199009c3d64

SHA512
78d0b1024b2d0d14184934db2b45d29fff083e52fd665b28f7776ea01d2fe0196452961a2cb16f4658751a5c01a3f64dab2436ff47786b2de1a3a7724aa828e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dannie.exe
Filesize
304KB

MD5
58c9d12aa7923001d6811467593d9f3a

SHA1
006c7e47c382a2699fcbc1acc55b4b2b280a3397

SHA256
eceb366ff2ee65642c96dcba00b02c22888b5b99a64ff3edf2d6ecbc69ef630b

SHA512
34e511548c34b184cc13be67bf73a6e3dbc588698522567313871645870f99ff16b686a8be65cb01cebbc07e47a3edadd013b894647d646d6e25086ea9ef8e5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dannie.exe
Filesize
304KB

MD5
58c9d12aa7923001d6811467593d9f3a

SHA1
006c7e47c382a2699fcbc1acc55b4b2b280a3397

SHA256
eceb366ff2ee65642c96dcba00b02c22888b5b99a64ff3edf2d6ecbc69ef630b

SHA512
34e511548c34b184cc13be67bf73a6e3dbc588698522567313871645870f99ff16b686a8be65cb01cebbc07e47a3edadd013b894647d646d6e25086ea9ef8e5c

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
43KB

MD5
4890d2eb768ec17a3a6ee2ab12209d74

SHA1
9bc2b46e4760e26bf95541b13a39348dfa0b2680

SHA256
1110e17ee226f56a7f3feed52e8b69fc4d8b3a5edc018f20af96d199009c3d64

SHA512
78d0b1024b2d0d14184934db2b45d29fff083e52fd665b28f7776ea01d2fe0196452961a2cb16f4658751a5c01a3f64dab2436ff47786b2de1a3a7724aa828e1

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
43KB

MD5
4890d2eb768ec17a3a6ee2ab12209d74

SHA1
9bc2b46e4760e26bf95541b13a39348dfa0b2680

SHA256
1110e17ee226f56a7f3feed52e8b69fc4d8b3a5edc018f20af96d199009c3d64

SHA512
78d0b1024b2d0d14184934db2b45d29fff083e52fd665b28f7776ea01d2fe0196452961a2cb16f4658751a5c01a3f64dab2436ff47786b2de1a3a7724aa828e1

Download Submit
memory/384-141-0x0000000000000000-mapping.dmp

Download
memory/384-144-0x0000000005B40000-0x0000000005B4A000-memory.dmp

Filesize
40KB

Download
memory/1916-139-0x0000000006120000-0x00000000066C4000-memory.dmp

Filesize
5.6MB

Download
memory/1916-140-0x0000000005C10000-0x0000000005CA2000-memory.dmp

Filesize
584KB

Download
memory/1916-138-0x00000000057B0000-0x000000000584C000-memory.dmp

Filesize
624KB

Download
memory/1916-137-0x0000000000E50000-0x0000000000E62000-memory.dmp

Filesize
72KB

Download
memory/1916-134-0x0000000000000000-mapping.dmp

Download
memory/3264-133-0x0000000000000000-mapping.dmp

Download
memory/3472-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads