neshta | 9962349253d26898c5c7a6263ef88a378d603f8e9bfaf4651dd44f7f27bdfcb6

Analysis

max time kernel
151s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
13-06-2022 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Size

538KB
MD5

71c04c5d339db01981ea6896784ab4af
SHA1

c9a8e3ad849f7e146e8d33008df1eba0a367aa96
SHA256

b884f8567f4e5056c3d4b58869a277830c40658f89ec5fa1e696c2e78620d9a0
SHA512

b4c1425f40757da86175a9c4f4462619ce4118ccc6e81eedd6218091ec666a60e15dfd434f7e1330993ca0b722c3e7346e8f845901eb55de2680e74637a42209

Score

10^/10

neshta remcos remotehost persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

172.94.127.61:5888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-V4JCDL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exeuzcfwhcy.exeuzcfwhcy.exe

pid process

644 TRN-97366461563688738_CIF_00077637283651296368_doc.exe
1812 uzcfwhcy.exe
1836 uzcfwhcy.exe

pid	process
644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
1812	uzcfwhcy.exe
1836	uzcfwhcy.exe

Loads dropped DLL 8 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exeTRN-97366461563688738_CIF_00077637283651296368_doc.exeuzcfwhcy.exeWerFault.exe

pid	process
948	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
1812	uzcfwhcy.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
948	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

uzcfwhcy.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\jtwdnhcl = "C:\\Users\\Admin\\AppData\\Roaming\\rxefcwi\\umwgnbltdwwi.exe"	uzcfwhcy.exe

Drops file in Program Files directory 64 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Drops file in Windows directory 1 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description ioc process

File opened for modification C:\Windows\svchost.com TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 1836 WerFault.exe uzcfwhcy.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

pid	pid_target	process	target process
900	1836	WerFault.exe	uzcfwhcy.exe

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe	nsis_installer_1

Modifies registry class 1 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exeTRN-97366461563688738_CIF_00077637283651296368_doc.exeuzcfwhcy.exeuzcfwhcy.exe

description	pid	process	target process
PID 948 wrote to memory of 644	948	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 948 wrote to memory of 644	948	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 948 wrote to memory of 644	948	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 948 wrote to memory of 644	948	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 644 wrote to memory of 1812	644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 644 wrote to memory of 1812	644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 644 wrote to memory of 1812	644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 644 wrote to memory of 1812	644	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1812 wrote to memory of 1836	1812	uzcfwhcy.exe	uzcfwhcy.exe
PID 1836 wrote to memory of 900	1836	uzcfwhcy.exe	WerFault.exe
PID 1836 wrote to memory of 900	1836	uzcfwhcy.exe	WerFault.exe
PID 1836 wrote to memory of 900	1836	uzcfwhcy.exe	WerFault.exe
PID 1836 wrote to memory of 900	1836	uzcfwhcy.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
"C:\Users\Admin\AppData\Local\Temp\TRN-97366461563688738_CIF_00077637283651296368_doc.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe C:\Users\Admin\AppData\Local\Temp\rjiaygkayi
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1812

C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe C:\Users\Admin\AppData\Local\Temp\rjiaygkayi
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 172
5⤵
- Loads dropped DLL
- Program crash
PID:900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Filesize
498KB

MD5
5402342edb79f8ce8ce5cf77658710dd

SHA1
234ae4176f742615633f9f2334c61d62ed955d7a

SHA256
e54c822ca727d7988d741770e00a763b8ac2984bc1794a88f3c7f999ea86a8cd

SHA512
654b282cd7e8acfac67d4c799e5e6fac1592f9070e8673a6270f5f132e7bf24c376993ce07864bf0d691a160309dc1d324418c76b993749c16a479b299a046e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Filesize
498KB

MD5
5402342edb79f8ce8ce5cf77658710dd

SHA1
234ae4176f742615633f9f2334c61d62ed955d7a

SHA256
e54c822ca727d7988d741770e00a763b8ac2984bc1794a88f3c7f999ea86a8cd

SHA512
654b282cd7e8acfac67d4c799e5e6fac1592f9070e8673a6270f5f132e7bf24c376993ce07864bf0d691a160309dc1d324418c76b993749c16a479b299a046e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjiaygkayi
Filesize
6KB

MD5
26ad7648655c539e77a0945bb0a2d194

SHA1
2df236e98bf7f4d325f8a7731d00bcc70de57cc8

SHA256
33cfca43581c7a7327781e632108291283597814d28b2acf8e987ea7bb28509e

SHA512
61e0244149bdcf688e4b9577dd90c11c435a1b8ca5fed759ef354d5791fb05dda892349f38c310af35d2c827b64238fb2d535b71256d6adb9aac2f6bc5bd4d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\y2aqvixietuh6xwtq8u
Filesize
463KB

MD5
ea1f0dd2857b84a5ab5bcdcb159a023e

SHA1
d61eafa75f677e8d821a5bbad6314ff0d7990ead

SHA256
36ece4629965196d897edd441778ceb5ff1f6c90af9e34b878aebb531d6fb5e1

SHA512
095b8ed8ef124c3ca50548d4a33ecca7a5196d4f79d1b0aa3c85a10a4f370cae1f06c560e50a2aed89728cb82fed7a9e99943b427abfbbac8dd922059c9ff3e0

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Filesize
498KB

MD5
5402342edb79f8ce8ce5cf77658710dd

SHA1
234ae4176f742615633f9f2334c61d62ed955d7a

SHA256
e54c822ca727d7988d741770e00a763b8ac2984bc1794a88f3c7f999ea86a8cd

SHA512
654b282cd7e8acfac67d4c799e5e6fac1592f9070e8673a6270f5f132e7bf24c376993ce07864bf0d691a160309dc1d324418c76b993749c16a479b299a046e9

Download Submit
\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
memory/644-56-0x0000000000000000-mapping.dmp

Download
memory/900-83-0x0000000000000000-mapping.dmp

Download
memory/948-54-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/1812-62-0x0000000000000000-mapping.dmp

Download
memory/1836-69-0x0000000000000000-mapping.dmp

Download
memory/1836-71-0x0000000000070000-0x00000000000EB000-memory.dmp

Filesize
492KB

Download
memory/1836-76-0x0000000000070000-0x00000000000EB000-memory.dmp

Filesize
492KB

Download
memory/1836-82-0x0000000000070000-0x00000000000EB000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads