neshta | 9962349253d26898c5c7a6263ef88a378d603f8e9bfaf4651dd44f7f27bdfcb6

General

Target

TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Size

538KB
MD5

71c04c5d339db01981ea6896784ab4af
SHA1

c9a8e3ad849f7e146e8d33008df1eba0a367aa96
SHA256

b884f8567f4e5056c3d4b58869a277830c40658f89ec5fa1e696c2e78620d9a0
SHA512

b4c1425f40757da86175a9c4f4462619ce4118ccc6e81eedd6218091ec666a60e15dfd434f7e1330993ca0b722c3e7346e8f845901eb55de2680e74637a42209

Score

10^/10

neshta remcos remotehost persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.94.127.61:5888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-V4JCDL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 3 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exeuzcfwhcy.exeuzcfwhcy.exe

pid process

2092 TRN-97366461563688738_CIF_00077637283651296368_doc.exe
3804 uzcfwhcy.exe
4932 uzcfwhcy.exe

pid	process
2092	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
3804	uzcfwhcy.exe
4932	uzcfwhcy.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

uzcfwhcy.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jtwdnhcl = "C:\\Users\\Admin\\AppData\\Roaming\\rxefcwi\\umwgnbltdwwi.exe"	uzcfwhcy.exe

Drops file in Program Files directory 64 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI391D~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI9C33~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13157~1.61\MICROS~1.EXE	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Drops file in Windows directory 1 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description ioc process

File opened for modification C:\Windows\svchost.com TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe	nsis_installer_1

Modifies registry class 1 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	TRN-97366461563688738_CIF_00077637283651296368_doc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

uzcfwhcy.exe

pid process

4932 uzcfwhcy.exe

pid	process
4932	uzcfwhcy.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

TRN-97366461563688738_CIF_00077637283651296368_doc.exeTRN-97366461563688738_CIF_00077637283651296368_doc.exeuzcfwhcy.exe

description	pid	process	target process
PID 3004 wrote to memory of 2092	3004	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 3004 wrote to memory of 2092	3004	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 3004 wrote to memory of 2092	3004	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	TRN-97366461563688738_CIF_00077637283651296368_doc.exe
PID 2092 wrote to memory of 3804	2092	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 2092 wrote to memory of 3804	2092	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 2092 wrote to memory of 3804	2092	TRN-97366461563688738_CIF_00077637283651296368_doc.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe
PID 3804 wrote to memory of 4932	3804	uzcfwhcy.exe	uzcfwhcy.exe

C:\Users\Admin\AppData\Local\Temp\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
"C:\Users\Admin\AppData\Local\Temp\TRN-97366461563688738_CIF_00077637283651296368_doc.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004

C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092

C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe C:\Users\Admin\AppData\Local\Temp\rjiaygkayi
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3804

C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe C:\Users\Admin\AppData\Local\Temp\rjiaygkayi
4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Filesize
498KB

MD5
5402342edb79f8ce8ce5cf77658710dd

SHA1
234ae4176f742615633f9f2334c61d62ed955d7a

SHA256
e54c822ca727d7988d741770e00a763b8ac2984bc1794a88f3c7f999ea86a8cd

SHA512
654b282cd7e8acfac67d4c799e5e6fac1592f9070e8673a6270f5f132e7bf24c376993ce07864bf0d691a160309dc1d324418c76b993749c16a479b299a046e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\TRN-97366461563688738_CIF_00077637283651296368_doc.exe
Filesize
498KB

MD5
5402342edb79f8ce8ce5cf77658710dd

SHA1
234ae4176f742615633f9f2334c61d62ed955d7a

SHA256
e54c822ca727d7988d741770e00a763b8ac2984bc1794a88f3c7f999ea86a8cd

SHA512
654b282cd7e8acfac67d4c799e5e6fac1592f9070e8673a6270f5f132e7bf24c376993ce07864bf0d691a160309dc1d324418c76b993749c16a479b299a046e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjiaygkayi
Filesize
6KB

MD5
26ad7648655c539e77a0945bb0a2d194

SHA1
2df236e98bf7f4d325f8a7731d00bcc70de57cc8

SHA256
33cfca43581c7a7327781e632108291283597814d28b2acf8e987ea7bb28509e

SHA512
61e0244149bdcf688e4b9577dd90c11c435a1b8ca5fed759ef354d5791fb05dda892349f38c310af35d2c827b64238fb2d535b71256d6adb9aac2f6bc5bd4d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\uzcfwhcy.exe
Filesize
6KB

MD5
7bcee9a725d43e08cbc68a87f4407be5

SHA1
8c68ca49ec4916e19e43d71136ccf2e0e7419b7f

SHA256
c176716369ca34704c2599654abb00f9ee3ce3b471978316b23e3782f13402e4

SHA512
b9c8107e404194f1ed98e48d75cf34d69f4fac5a30609157e2550bcabf7c0cba455d8b4c0f7535f649e4bcc219ade11c0940f835a8d4bfeb2e6f2b96f08e6a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\y2aqvixietuh6xwtq8u
Filesize
463KB

MD5
ea1f0dd2857b84a5ab5bcdcb159a023e

SHA1
d61eafa75f677e8d821a5bbad6314ff0d7990ead

SHA256
36ece4629965196d897edd441778ceb5ff1f6c90af9e34b878aebb531d6fb5e1

SHA512
095b8ed8ef124c3ca50548d4a33ecca7a5196d4f79d1b0aa3c85a10a4f370cae1f06c560e50a2aed89728cb82fed7a9e99943b427abfbbac8dd922059c9ff3e0

Download Submit
memory/2092-130-0x0000000000000000-mapping.dmp

Download
memory/3804-133-0x0000000000000000-mapping.dmp

Download
memory/4932-138-0x0000000000000000-mapping.dmp

Download
memory/4932-140-0x0000000000160000-0x00000000001DB000-memory.dmp

Filesize
492KB

Download
memory/4932-145-0x0000000000160000-0x00000000001DB000-memory.dmp

Filesize
492KB

Download
memory/4932-150-0x0000000000160000-0x00000000001DB000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads