33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2

Analysis

max time kernel
151s
max time network
164s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
Size

596KB
MD5

249c550e875b88652be05b91c9dbe912
SHA1

93703c383168126607f78e6b1bcba8431782dcce
SHA256

33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2
SHA512

c4666bbfc139f9fb14cc3f847f57bbe2eab55b0e1bc2306b526fffb833b0bcf4b05030270fe405a89aca62aeeb01a2161bac102a8425dfa6a787ff74cf93c20d
SSDEEP

12288:+kzzt8P6dVi6gcb1JdbqXC2wP/NtKzQVF7mDMps:nJdVd1eyb/NtT+Das

Score

10^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\0b1aca41\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	X18fswS7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	coujal.exe

Executes dropped EXE 11 IoCs

pid	Process
960	X18fswS7.exe
1732	coujal.exe
772	2eaq.exe
1708	2eaq.exe
1084	2eaq.exe
540	2eaq.exe
1908	2eaq.exe
1644	2eaq.exe
1656	3eaq.exe
332	csrss.exe
636	X

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1708-83-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1708-84-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1708-85-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1708-91-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1708-94-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1084-93-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1084-95-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1084-106-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1908-119-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1908-121-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1708-130-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1908-134-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1644-133-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1084-132-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1644-131-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1908-129-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1644-127-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1908-118-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1084-103-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1084-90-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1644-140-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1644-143-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1644-147-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1908-152-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1284-180-0x0000000002990000-0x0000000002998000-memory.dmp	upx
behavioral1/memory/1708-188-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1084-189-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1284-191-0x0000000002990000-0x0000000002998000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1672	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
960	X18fswS7.exe
960	X18fswS7.exe
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
1656	3eaq.exe
1656	3eaq.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10
Destination IP	69.64.52.10

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /L"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /P"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /y"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /h"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /R"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /g"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /w"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /f"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /K"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /S"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /W"	coujal.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /X"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /O"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /j"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /q"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /i"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /Q"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /B"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /e"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /F"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /r"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /H"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /Y"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /D"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /p"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /l"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /U"	coujal.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	X18fswS7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /Z"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /J"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /V"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /z"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /v"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /x"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /k"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /o"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /s"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /c"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /b"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /T"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /G"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /N"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /n"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /m"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /u"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /t"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /C"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /M"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /I"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /R"	X18fswS7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /A"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /a"	coujal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\coujal = "C:\\Users\\Admin\\coujal.exe /E"	coujal.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2eaq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2eaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2eaq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2eaq.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 1708	772	2eaq.exe	34
PID 772 set thread context of 1084	772	2eaq.exe	38
PID 772 set thread context of 540	772	2eaq.exe	35
PID 772 set thread context of 1908	772	2eaq.exe	36
PID 772 set thread context of 1644	772	2eaq.exe	37
PID 1656 set thread context of 1944	1656	3eaq.exe	42

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1800	tasklist.exe
316	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}	3eaq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}\u = "188"	3eaq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}\cid = "4113056875798035600"	3eaq.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
960	X18fswS7.exe
960	X18fswS7.exe
1084	2eaq.exe
1732	coujal.exe
540	2eaq.exe
1656	3eaq.exe
1656	3eaq.exe
1656	3eaq.exe
1732	coujal.exe
1656	3eaq.exe
636	X
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1084	2eaq.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe
1732	coujal.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	tasklist.exe
Token: SeDebugPrivilege	1656	3eaq.exe
Token: SeDebugPrivilege	1656	3eaq.exe
Token: SeDebugPrivilege	316	tasklist.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
960	X18fswS7.exe
1732	coujal.exe
772	2eaq.exe
1708	2eaq.exe
1908	2eaq.exe
1644	2eaq.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 960	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	27
PID 972 wrote to memory of 960	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	27
PID 972 wrote to memory of 960	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	27
PID 972 wrote to memory of 960	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	27
PID 960 wrote to memory of 1732	960	X18fswS7.exe	28
PID 960 wrote to memory of 1732	960	X18fswS7.exe	28
PID 960 wrote to memory of 1732	960	X18fswS7.exe	28
PID 960 wrote to memory of 1732	960	X18fswS7.exe	28
PID 960 wrote to memory of 1168	960	X18fswS7.exe	29
PID 960 wrote to memory of 1168	960	X18fswS7.exe	29
PID 960 wrote to memory of 1168	960	X18fswS7.exe	29
PID 960 wrote to memory of 1168	960	X18fswS7.exe	29
PID 1168 wrote to memory of 1800	1168	cmd.exe	31
PID 1168 wrote to memory of 1800	1168	cmd.exe	31
PID 1168 wrote to memory of 1800	1168	cmd.exe	31
PID 1168 wrote to memory of 1800	1168	cmd.exe	31
PID 972 wrote to memory of 772	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	33
PID 972 wrote to memory of 772	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	33
PID 972 wrote to memory of 772	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	33
PID 972 wrote to memory of 772	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	33
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1708	772	2eaq.exe	34
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 1084	772	2eaq.exe	38
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 540	772	2eaq.exe	35
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1908	772	2eaq.exe	36
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 772 wrote to memory of 1644	772	2eaq.exe	37
PID 972 wrote to memory of 1656	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	40
PID 972 wrote to memory of 1656	972	33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
PID:1284
- C:\Users\Admin\AppData\Local\Temp\33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
  "C:\Users\Admin\AppData\Local\Temp\33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Users\Admin\X18fswS7.exe
    C:\Users\Admin\X18fswS7.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Users\Admin\coujal.exe
      "C:\Users\Admin\coujal.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del X18fswS7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
- - C:\Users\Admin\2eaq.exe
    C:\Users\Admin\2eaq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Users\Admin\2eaq.exe
      "C:\Users\Admin\2eaq.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
  - - C:\Users\Admin\2eaq.exe
      "C:\Users\Admin\2eaq.exe"
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:540
  - - C:\Users\Admin\2eaq.exe
      "C:\Users\Admin\2eaq.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1908
  - - C:\Users\Admin\2eaq.exe
      "C:\Users\Admin\2eaq.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
  - - C:\Users\Admin\2eaq.exe
      "C:\Users\Admin\2eaq.exe"
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:1084
- - C:\Users\Admin\3eaq.exe
    C:\Users\Admin\3eaq.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
  - - C:\Users\Admin\AppData\Local\0b1aca41\X
      *0*bc*c6eb7c90*69.64.52.10:53
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:636
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 33cfea3f51ead87b52c065ce8dcd753ff590d7b15b3d4061985029585d297ca2.exe
    3⤵
    - Deletes itself
    PID:1672
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:316

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1304

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
C:\Users\Admin\3eaq.exe

Filesize
264KB

MD5
9565c845de3f334675fc71d5bd4c061a

SHA1
efeffba8fe4b67df74d1f7712ca149e2b4f9ee86

SHA256
fa90339e4176277152fcda491efb1cf96d61942d6e9561175d8baced8dd6b096

SHA512
de5ac161e46fbdd15edf00b6620f45a8b917a3d651137314ffa1eb28e10b995486f02070d662d72e57ee999fbf9eb2e6bb1900a70228184fae1a65c8c6cc61f2

Download Submit
C:\Users\Admin\3eaq.exe

Filesize
264KB

MD5
9565c845de3f334675fc71d5bd4c061a

SHA1
efeffba8fe4b67df74d1f7712ca149e2b4f9ee86

SHA256
fa90339e4176277152fcda491efb1cf96d61942d6e9561175d8baced8dd6b096

SHA512
de5ac161e46fbdd15edf00b6620f45a8b917a3d651137314ffa1eb28e10b995486f02070d662d72e57ee999fbf9eb2e6bb1900a70228184fae1a65c8c6cc61f2

Download Submit
C:\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
C:\Users\Admin\X18fswS7.exe

Filesize
200KB

MD5
29a1dc687e40664309b0d1514ce55a33

SHA1
df8baac4323a38efce0a1c82d69328b6cf72edd7

SHA256
ee8b184ad66a53b835a9afe818d9e340cfd2c060994bd4fc975e239d8b35093e

SHA512
2bec6eceff9e9d8dccdefeb4b2e09810ccc160a42bc4c1c49a087b4220025e5ca910e12c8c2c7b72dda6f8a7f7175b3d469e866ef7bc7ffd0af256d116aae418

Download Submit
C:\Users\Admin\X18fswS7.exe

Filesize
200KB

MD5
29a1dc687e40664309b0d1514ce55a33

SHA1
df8baac4323a38efce0a1c82d69328b6cf72edd7

SHA256
ee8b184ad66a53b835a9afe818d9e340cfd2c060994bd4fc975e239d8b35093e

SHA512
2bec6eceff9e9d8dccdefeb4b2e09810ccc160a42bc4c1c49a087b4220025e5ca910e12c8c2c7b72dda6f8a7f7175b3d469e866ef7bc7ffd0af256d116aae418

Download Submit
C:\Users\Admin\coujal.exe

Filesize
200KB

MD5
d31a4eacae7c0050e6cc37ca2bf4f1e0

SHA1
da53141f1760fdc3af13dbe0d0e8902e5d360987

SHA256
286320d073e343f98d4071b53ab23d1c87c66eb16882346d71e38b25aca6f69e

SHA512
519f7a9c95ed53727b43b9b49e0eefdbdb35cd7d6ddb46273b7f8e0f252d495fab59ae3c4c27d92da3be2966a94f6a1df1b67671b1b3f1ca0272e67c567f0b41

Download Submit
C:\Users\Admin\coujal.exe

Filesize
200KB

MD5
d31a4eacae7c0050e6cc37ca2bf4f1e0

SHA1
da53141f1760fdc3af13dbe0d0e8902e5d360987

SHA256
286320d073e343f98d4071b53ab23d1c87c66eb16882346d71e38b25aca6f69e

SHA512
519f7a9c95ed53727b43b9b49e0eefdbdb35cd7d6ddb46273b7f8e0f252d495fab59ae3c4c27d92da3be2966a94f6a1df1b67671b1b3f1ca0272e67c567f0b41

Download Submit
C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
\Users\Admin\2eaq.exe

Filesize
232KB

MD5
4f9784bdba92717e8c5f8a0bc6dc38b7

SHA1
d591ab6db69a8ea40dd7b0e6976b57d220ff96c1

SHA256
da6483413ef262ada0dc9a6d92b08b7174d31c1d4fee6f8532e4312c142930d8

SHA512
5c9ccfdce08741f37cb2fb591636ff9caf11c0a7235d38b1c6c08282c9a5bd727c3f3b01bcf9922693ea42fec31631f431f1ed69420045cbf23e498194f19efb

Download Submit
\Users\Admin\3eaq.exe

Filesize
264KB

MD5
9565c845de3f334675fc71d5bd4c061a

SHA1
efeffba8fe4b67df74d1f7712ca149e2b4f9ee86

SHA256
fa90339e4176277152fcda491efb1cf96d61942d6e9561175d8baced8dd6b096

SHA512
de5ac161e46fbdd15edf00b6620f45a8b917a3d651137314ffa1eb28e10b995486f02070d662d72e57ee999fbf9eb2e6bb1900a70228184fae1a65c8c6cc61f2

Download Submit
\Users\Admin\3eaq.exe

Filesize
264KB

MD5
9565c845de3f334675fc71d5bd4c061a

SHA1
efeffba8fe4b67df74d1f7712ca149e2b4f9ee86

SHA256
fa90339e4176277152fcda491efb1cf96d61942d6e9561175d8baced8dd6b096

SHA512
de5ac161e46fbdd15edf00b6620f45a8b917a3d651137314ffa1eb28e10b995486f02070d662d72e57ee999fbf9eb2e6bb1900a70228184fae1a65c8c6cc61f2

Download Submit
\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\X18fswS7.exe

Filesize
200KB

MD5
29a1dc687e40664309b0d1514ce55a33

SHA1
df8baac4323a38efce0a1c82d69328b6cf72edd7

SHA256
ee8b184ad66a53b835a9afe818d9e340cfd2c060994bd4fc975e239d8b35093e

SHA512
2bec6eceff9e9d8dccdefeb4b2e09810ccc160a42bc4c1c49a087b4220025e5ca910e12c8c2c7b72dda6f8a7f7175b3d469e866ef7bc7ffd0af256d116aae418

Download Submit
\Users\Admin\X18fswS7.exe

Filesize
200KB

MD5
29a1dc687e40664309b0d1514ce55a33

SHA1
df8baac4323a38efce0a1c82d69328b6cf72edd7

SHA256
ee8b184ad66a53b835a9afe818d9e340cfd2c060994bd4fc975e239d8b35093e

SHA512
2bec6eceff9e9d8dccdefeb4b2e09810ccc160a42bc4c1c49a087b4220025e5ca910e12c8c2c7b72dda6f8a7f7175b3d469e866ef7bc7ffd0af256d116aae418

Download Submit
\Users\Admin\coujal.exe

Filesize
200KB

MD5
d31a4eacae7c0050e6cc37ca2bf4f1e0

SHA1
da53141f1760fdc3af13dbe0d0e8902e5d360987

SHA256
286320d073e343f98d4071b53ab23d1c87c66eb16882346d71e38b25aca6f69e

SHA512
519f7a9c95ed53727b43b9b49e0eefdbdb35cd7d6ddb46273b7f8e0f252d495fab59ae3c4c27d92da3be2966a94f6a1df1b67671b1b3f1ca0272e67c567f0b41

Download Submit
\Users\Admin\coujal.exe

Filesize
200KB

MD5
d31a4eacae7c0050e6cc37ca2bf4f1e0

SHA1
da53141f1760fdc3af13dbe0d0e8902e5d360987

SHA256
286320d073e343f98d4071b53ab23d1c87c66eb16882346d71e38b25aca6f69e

SHA512
519f7a9c95ed53727b43b9b49e0eefdbdb35cd7d6ddb46273b7f8e0f252d495fab59ae3c4c27d92da3be2966a94f6a1df1b67671b1b3f1ca0272e67c567f0b41

Download Submit
\Windows\System32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
7763b7ef275d7b12321257f473fcefb6

SHA1
fbe9bd8545472617fe958659b1d86a7a77c304e0

SHA256
3fddec5022e212c685352b96f4689b6b58477050f211df5d4eadbc4bd75f11fa

SHA512
31cad6b3e0b8be2e4af5bc2f1c4c3a47bb903a61911daf488e1de4a0e38437daf7ae84fd3fe0c50f10963d5b58c2b6f07d05f584ac6ef1cc99b0c2fefd491e9b

Download Submit
memory/332-179-0x0000000001F00000-0x0000000001F0B000-memory.dmp

Filesize
44KB

Download
memory/540-111-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-101-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-122-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-108-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-110-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-100-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-113-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-135-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/540-190-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/972-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1084-103-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-106-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-132-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-95-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-189-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1284-181-0x0000000002A70000-0x0000000002A7B000-memory.dmp

Filesize
44KB

Download
memory/1284-161-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/1284-157-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/1284-168-0x00000000029B0000-0x00000000029BB000-memory.dmp

Filesize
44KB

Download
memory/1284-180-0x0000000002990000-0x0000000002998000-memory.dmp

Filesize
32KB

Download
memory/1284-172-0x00000000029B0000-0x00000000029BB000-memory.dmp

Filesize
44KB

Download
memory/1284-153-0x0000000002990000-0x0000000002996000-memory.dmp

Filesize
24KB

Download
memory/1284-191-0x0000000002990000-0x0000000002998000-memory.dmp

Filesize
32KB

Download
memory/1644-127-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-147-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-143-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-140-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-133-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-131-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-126-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-185-0x000000000040E000-0x0000000000443000-memory.dmp

Filesize
212KB

Download
memory/1656-177-0x0000000030670000-0x00000000306BB000-memory.dmp

Filesize
300KB

Download
memory/1656-184-0x0000000030670000-0x00000000306BB000-memory.dmp

Filesize
300KB

Download
memory/1656-178-0x000000000040E000-0x0000000000443000-memory.dmp

Filesize
212KB

Download
memory/1708-84-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-188-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-130-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-94-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-91-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-85-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-83-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1708-82-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-129-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-118-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-121-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-152-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-134-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1908-119-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download