agenttesla | 57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
Size 1.1MB
Sample221011-pll6jsebbq
SHA256 57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be
MD5 b7fcbb8bad6d0b7829a81cb09b5465f4
SHA1 445026eb5798cb7b19a4bb0981b4113dc5c4eb63
SHA512 a2b0397a484306d097b202bdb59b286ff459ad5fcab7e87648d500ffc088cdfc0a3135f271c946568d389e8ae8926795e1270c7336a078d126ad747bdfb28555
SSDEEP 24576:SNriy/fTF3wHsOzj4j85M1hUQDAxzJX44g07:SNtTisOzj4jGM1aK4FXy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla remcos warzonerat remotehost collection evasion infostealer keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

harjahwool.ddnsfree.com:8372

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-EGNT8M
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

warzonerat

harjahwool.ddnsfree.com:2309

Extracted

Family

agenttesla

https://api.telegram.org/bot1841252439:AAFeBNk12wAgfxXFXtqpw50JT4iCgTc-FsM/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\lasdgas.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\nasdgas.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\PI.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\PI.exe,"	reg.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3548-220-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3536-168-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3876-170-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3876-171-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral2/memory/3536-168-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/1688-169-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3876-170-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3876-171-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2072-209-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/2072-211-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/2072-212-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Executes dropped EXE 11 IoCs

pid	Process
2712	PI.exe
2148	PIFDKJCKJ.exe
2412	PIFDKJCKJ.exe
1584	dwn.exe
3780	dgwn.exe
4776	lasdgas.exe
408	nasdgas.exe
2608	lasdgas.exe
4072	banNhsbA.exe
4888	banNhsbA.exe
3548	lasdgas.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	PIFDKJCKJ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	nasdgas.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	banNhsbA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	PI.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AddInProcess32.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 4660	2712	PI.exe	100
PID 4660 set thread context of 3876	4660	AddInProcess32.exe	108
PID 4660 set thread context of 3536	4660	AddInProcess32.exe	109
PID 4660 set thread context of 1688	4660	AddInProcess32.exe	111
PID 408 set thread context of 2072	408	nasdgas.exe	137
PID 4776 set thread context of 3548	4776	lasdgas.exe	138

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2672	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
4520	PING.EXE
4276	PING.EXE
1736	PING.EXE
1328	PING.EXE
3436	PING.EXE
3836	PING.EXE
4844	PING.EXE
2260	PING.EXE
4548	PING.EXE
1856	PING.EXE
3084	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
2712	PI.exe
2712	PI.exe
2712	PI.exe
2148	PIFDKJCKJ.exe
2412	PIFDKJCKJ.exe
2412	PIFDKJCKJ.exe
2412	PIFDKJCKJ.exe
2712	PI.exe
2712	PI.exe
3876	AddInProcess32.exe
3876	AddInProcess32.exe
1688	AddInProcess32.exe
1688	AddInProcess32.exe
3876	AddInProcess32.exe
3876	AddInProcess32.exe
3780	dgwn.exe
1584	dwn.exe
3780	dgwn.exe
1584	dwn.exe
1584	dwn.exe
3780	dgwn.exe
1584	dwn.exe
3780	dgwn.exe
1584	dwn.exe
1584	dwn.exe
1584	dwn.exe
3780	dgwn.exe
1584	dwn.exe
3780	dgwn.exe
1584	dwn.exe
1584	dwn.exe
3780	dgwn.exe
3780	dgwn.exe
1584	dwn.exe
1584	dwn.exe
3780	dgwn.exe
3780	dgwn.exe
1584	dwn.exe
1584	dwn.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4660	AddInProcess32.exe
4660	AddInProcess32.exe
4660	AddInProcess32.exe
4660	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
Token: SeDebugPrivilege	2712	PI.exe
Token: 33	4060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4060	AUDIODG.EXE
Token: SeDebugPrivilege	2148	PIFDKJCKJ.exe
Token: SeDebugPrivilege	2412	PIFDKJCKJ.exe
Token: SeDebugPrivilege	1688	AddInProcess32.exe
Token: SeDebugPrivilege	3780	dgwn.exe
Token: SeDebugPrivilege	1584	dwn.exe
Token: SeDebugPrivilege	4776	lasdgas.exe
Token: SeDebugPrivilege	408	nasdgas.exe
Token: SeDebugPrivilege	4072	banNhsbA.exe
Token: SeDebugPrivilege	4888	banNhsbA.exe
Token: SeDebugPrivilege	3548	lasdgas.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4660	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3976	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe	86
PID 1612 wrote to memory of 3976	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe	86
PID 1612 wrote to memory of 3976	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe	86
PID 3976 wrote to memory of 3836	3976	cmd.exe	88
PID 3976 wrote to memory of 3836	3976	cmd.exe	88
PID 3976 wrote to memory of 3836	3976	cmd.exe	88
PID 1612 wrote to memory of 2164	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe	90
PID 1612 wrote to memory of 2164	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe	90
PID 1612 wrote to memory of 2164	1612	SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe	90
PID 2164 wrote to memory of 3084	2164	cmd.exe	92
PID 2164 wrote to memory of 3084	2164	cmd.exe	92
PID 2164 wrote to memory of 3084	2164	cmd.exe	92
PID 3976 wrote to memory of 3860	3976	cmd.exe	94
PID 3976 wrote to memory of 3860	3976	cmd.exe	94
PID 3976 wrote to memory of 3860	3976	cmd.exe	94
PID 2164 wrote to memory of 4520	2164	cmd.exe	97
PID 2164 wrote to memory of 4520	2164	cmd.exe	97
PID 2164 wrote to memory of 4520	2164	cmd.exe	97
PID 2164 wrote to memory of 2712	2164	cmd.exe	99
PID 2164 wrote to memory of 2712	2164	cmd.exe	99
PID 2164 wrote to memory of 2712	2164	cmd.exe	99
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 2712 wrote to memory of 4660	2712	PI.exe	100
PID 4660 wrote to memory of 1576	4660	AddInProcess32.exe	103
PID 4660 wrote to memory of 1576	4660	AddInProcess32.exe	103
PID 4660 wrote to memory of 1576	4660	AddInProcess32.exe	103
PID 1576 wrote to memory of 2672	1576	cmd.exe	105
PID 1576 wrote to memory of 2672	1576	cmd.exe	105
PID 1576 wrote to memory of 2672	1576	cmd.exe	105
PID 2712 wrote to memory of 2148	2712	PI.exe	106
PID 2712 wrote to memory of 2148	2712	PI.exe	106
PID 2712 wrote to memory of 2148	2712	PI.exe	106
PID 2148 wrote to memory of 2412	2148	PIFDKJCKJ.exe	107
PID 2148 wrote to memory of 2412	2148	PIFDKJCKJ.exe	107
PID 2148 wrote to memory of 2412	2148	PIFDKJCKJ.exe	107
PID 4660 wrote to memory of 3876	4660	AddInProcess32.exe	108
PID 4660 wrote to memory of 3876	4660	AddInProcess32.exe	108
PID 4660 wrote to memory of 3876	4660	AddInProcess32.exe	108
PID 4660 wrote to memory of 3876	4660	AddInProcess32.exe	108
PID 4660 wrote to memory of 3536	4660	AddInProcess32.exe	109
PID 4660 wrote to memory of 3536	4660	AddInProcess32.exe	109
PID 4660 wrote to memory of 3536	4660	AddInProcess32.exe	109
PID 4660 wrote to memory of 3536	4660	AddInProcess32.exe	109
PID 4660 wrote to memory of 1084	4660	AddInProcess32.exe	110
PID 4660 wrote to memory of 1084	4660	AddInProcess32.exe	110
PID 4660 wrote to memory of 1084	4660	AddInProcess32.exe	110
PID 4660 wrote to memory of 1688	4660	AddInProcess32.exe	111
PID 4660 wrote to memory of 1688	4660	AddInProcess32.exe	111
PID 4660 wrote to memory of 1688	4660	AddInProcess32.exe	111
PID 4660 wrote to memory of 1688	4660	AddInProcess32.exe	111
PID 4660 wrote to memory of 1584	4660	AddInProcess32.exe	112
PID 4660 wrote to memory of 1584	4660	AddInProcess32.exe	112
PID 4660 wrote to memory of 1584	4660	AddInProcess32.exe	112
PID 4660 wrote to memory of 3780	4660	AddInProcess32.exe	113

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\PI.exe,"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 6
    3⤵
    - Runs ping.exe
    PID:3836
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\PI.exe,"
    3⤵
    - Modifies WinLogon for persistence
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621.exe" "C:\Users\Admin\AppData\Roaming\PI.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\AppData\Roaming\PI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 14
    3⤵
    - Runs ping.exe
    PID:3084
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 14
    3⤵
    - Runs ping.exe
    PID:4520
- - C:\Users\Admin\AppData\Roaming\PI.exe
    "C:\Users\Admin\AppData\Roaming\PI.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C sc stop Windefend
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1576
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop Windefend
        6⤵
        Launches sc.exe
        
        PID:2672
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\delnxhfgutmnrvidcapgfdgmrva"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3876
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\fgqfyaqiibestjehukchiiadskjxvrq"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:3536
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\qavyzsbbejwxdpsldvojtvvmbqbypchgtg"
        5⤵
        
        PID:1084
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\qavyzsbbejwxdpsldvojtvvmbqbypchgtg"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
    - - C:\Users\Admin\AppData\Roaming\dwn.exe
        
        "C:\Users\Admin\AppData\Roaming\dwn.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\lasdgas.exe,"
        6⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        7⤵
        Runs ping.exe
        
        PID:4276
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\lasdgas.exe,"
        7⤵
        Modifies WinLogon for persistence
        
        PID:3556
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\Users\Admin\AppData\Roaming\dwn.exe" "C:\Users\Admin\AppData\Roaming\lasdgas.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\AppData\Roaming\lasdgas.exe"
        6⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 14
        7⤵
        Runs ping.exe
        
        PID:2260
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 14
        7⤵
        Runs ping.exe
        
        PID:1856
        
        C:\Users\Admin\AppData\Roaming\lasdgas.exe
        
        "C:\Users\Admin\AppData\Roaming\lasdgas.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4776
        
        C:\Users\Admin\AppData\Roaming\lasdgas.exe
        
        "C:\Users\Admin\AppData\Roaming\lasdgas.exe"
        8⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Users\Admin\AppData\Roaming\lasdgas.exe
        
        "C:\Users\Admin\AppData\Roaming\lasdgas.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
    - - C:\Users\Admin\AppData\Roaming\dgwn.exe
        
        "C:\Users\Admin\AppData\Roaming\dgwn.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3780
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\nasdgas.exe,"
        6⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        7⤵
        Runs ping.exe
        
        PID:4844
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\nasdgas.exe,"
        7⤵
        Modifies WinLogon for persistence
        
        PID:308
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\Users\Admin\AppData\Roaming\dgwn.exe" "C:\Users\Admin\AppData\Roaming\nasdgas.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\AppData\Roaming\nasdgas.exe"
        6⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 14
        7⤵
        Runs ping.exe
        
        PID:1736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 14
        7⤵
        Runs ping.exe
        
        PID:1328
        
        C:\Users\Admin\AppData\Roaming\nasdgas.exe
        
        "C:\Users\Admin\AppData\Roaming\nasdgas.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\nasdgas.exe,"
        8⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        9⤵
        Runs ping.exe
        
        PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe
      "C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\PI.exe,"
      4⤵
      PID:1716
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        5⤵
        Runs ping.exe
        
        PID:4548
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\PI.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:948

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

PIFDKJCKJ.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PIFDKJCKJ.exe.log
Size 1KB
SHA256 90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c
MD5 7dca233df92b3884663fa5a40db8d49c
SHA1 208b8f27b708c4e06ac37f974471cc7b29c29b60
SHA512 d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07
MD5 SHA1 SHA512

Submit Download

banNhsbA.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\banNhsbA.exe.log
Size 1KB
SHA256 90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c
MD5 7dca233df92b3884663fa5a40db8d49c
SHA1 208b8f27b708c4e06ac37f974471cc7b29c29b60
SHA512 d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07
MD5 SHA1 SHA512

Submit Download

lasdgas.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lasdgas.exe.log
Size 1KB
SHA256 ef1cfbe683644d2583de43c8a38448e60ab1acaaac633296788e05e3ec494359
MD5 abce8ccd3a4a5a0d4645806e60ab870b
SHA1 950703f2ae2e9d0b1383475c23a1f2b0c3ecd612
SHA512 effb8bd2f006b7861c338e99faa501f47a346657f1f1fd4e47d10c82288788b83c84b029693edba1b4c2b60f9bec014d50af7299d93a27ed1fa4638321d1423b
MD5 SHA1 SHA512

Submit Download

PIFDKJCKJ.exe

Path C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

PIFDKJCKJ.exe

Path C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

PIFDKJCKJ.exe

Path C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

PIFDKJCKJ.txt

Path C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.txt
Size 51B
SHA256 ee467ec891636aa0ad341f28ec78d87efc34b5cc8150743ff8da83b875d6dc67
MD5 638bfeacfddf4e27d3626e18f3a79e08
SHA1 f9c00d8ae8d5c25a5ee523373eda77d2964ee3a3
SHA512 63cbee349d956c904aac644e80b0a4c45279e07efb46a1ac9132d2574da1229d716e376d2c3d6899cc0a195ce8c532821fec2eda2e4528aa4e741601d4242e03
MD5 SHA1 SHA512

Submit Download

PIFDKJCKJ.txt

Path C:\Users\Admin\AppData\Local\Temp\PIFDKJCKJ.txt
Size 51B
SHA256 b27c91955a2e953b3704c23966a387ee4dd615c4c910fdbd4d52c169844b03f7
MD5 576d4382d8acab2b13534185f68c48a7
SHA1 468e626f18fd1365ee268bca4439555be842bd69
SHA512 46da0662e4c76fb95e2fdcde351af4e68e4516225b618cd6716038ea11b5d3b63be1bfaf9bb0d85c283c370013f97d0dbf2ab00b77e64cd2d93704fc5c469ab8
MD5 SHA1 SHA512

Submit Download

banNhsbA.exe

Path C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

banNhsbA.exe

Path C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

banNhsbA.exe

Path C:\Users\Admin\AppData\Local\Temp\banNhsbA.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

banNhsbA.txt

Path C:\Users\Admin\AppData\Local\Temp\banNhsbA.txt
Size 55B
SHA256 9756692bb2d27cd616e795dfc5ed7f93e53326c23a329c99534eaad2c0ca717c
MD5 2986709799834f24e907de24016681c7
SHA1 24de37548077cf35ef8eac1483b0108c739946c2
SHA512 b49f505a1c9914857713b1bee2e141f55b8044029b8f9573856323afabdfb90c53e5c13ff47ecdddc98d73cfa6082c8a4f5a71e8e1fa0729c9034470ebf979a8
MD5 SHA1 SHA512

Submit Download

banNhsbA.txt

Path C:\Users\Admin\AppData\Local\Temp\banNhsbA.txt
Size 55B
SHA256 fc4f140da7e5c51f34b8f339af0bf395bbca9eb13c349bf433f60b223e587b8c
MD5 526b47b59dae87012f5f5b9760dbf9f7
SHA1 d58c50ff0daeb2a2a8d5666fedbc13705e7b20f8
SHA512 4fb7bc469dfcd09815cc6e9e0fec33b99e94e5aabb8edf67796e67a29d17794a9ad57f2fc1eb37214d57f8168b9483939eb95662eba0cd0c90b3a46154f130ec
MD5 SHA1 SHA512

Submit Download

banNhsbA.txt

Path C:\Users\Admin\AppData\Local\Temp\banNhsbA.txt
Size 55B
SHA256 fc4f140da7e5c51f34b8f339af0bf395bbca9eb13c349bf433f60b223e587b8c
MD5 526b47b59dae87012f5f5b9760dbf9f7
SHA1 d58c50ff0daeb2a2a8d5666fedbc13705e7b20f8
SHA512 4fb7bc469dfcd09815cc6e9e0fec33b99e94e5aabb8edf67796e67a29d17794a9ad57f2fc1eb37214d57f8168b9483939eb95662eba0cd0c90b3a46154f130ec
MD5 SHA1 SHA512

Submit Download

delnxhfgutmnrvidcapgfdgmrva

Path C:\Users\Admin\AppData\Local\Temp\delnxhfgutmnrvidcapgfdgmrva
Size 4KB
SHA256 bd8156713974af3003c418302d3647fa84f62836fe83613c05e8bc40cb06a867
MD5 952a930b9fe70f809a67cb4e765c9448
SHA1 7e6c235246cc1be14d8a01ee7688a2a2471d44c9
SHA512 10d12f2412fd2cb9ecf47cccd0261b17d9a3323957602c06795c4b2244306837d0a979ec6e552dc023ee81719ebcb9455bdb6f9d44f07788664994d1498452fb
SSDEEP 48:wvvv0DxfvvcDxfdvv0DxBvv0Dxakvv0D7:mvWxvep1vWPvWbvW7
MD5 SHA1 SHA512 SSDEEP

Submit Download

PI.exe

Path C:\Users\Admin\AppData\Roaming\PI.exe
Size 1.1MB
SHA256 57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be
MD5 b7fcbb8bad6d0b7829a81cb09b5465f4
SHA1 445026eb5798cb7b19a4bb0981b4113dc5c4eb63
SHA512 a2b0397a484306d097b202bdb59b286ff459ad5fcab7e87648d500ffc088cdfc0a3135f271c946568d389e8ae8926795e1270c7336a078d126ad747bdfb28555
SSDEEP 24576:SNriy/fTF3wHsOzj4j85M1hUQDAxzJX44g07:SNtTisOzj4jGM1aK4FXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

PI.exe

Path C:\Users\Admin\AppData\Roaming\PI.exe
Size 1.1MB
SHA256 57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be
MD5 b7fcbb8bad6d0b7829a81cb09b5465f4
SHA1 445026eb5798cb7b19a4bb0981b4113dc5c4eb63
SHA512 a2b0397a484306d097b202bdb59b286ff459ad5fcab7e87648d500ffc088cdfc0a3135f271c946568d389e8ae8926795e1270c7336a078d126ad747bdfb28555
SSDEEP 24576:SNriy/fTF3wHsOzj4j85M1hUQDAxzJX44g07:SNtTisOzj4jGM1aK4FXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dgwn.exe

Path C:\Users\Admin\AppData\Roaming\dgwn.exe
Size 605KB
SHA256 7d9604cab93bd9e08cb2544e564cd687165646f9657636a960338da604c5e825
MD5 e93679902cfae16e328f51227c9c6325
SHA1 40c7ad61eb0035263aa890b1e1bed28fca42dd00
SHA512 a773c52c565ca413f51912dc8e336ded17f2b93f6ad03bdeff0556988215ff80acc30267d8bb8e3b5233f2018053c4a45da34d6b714659af7729a8d49058c21c
SSDEEP 12288:pazUTpipJVJHWB8QBZkaZPyIlEnuwmQqbF:pNETRWBZkMbEuZF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dgwn.exe

Path C:\Users\Admin\AppData\Roaming\dgwn.exe
Size 605KB
SHA256 7d9604cab93bd9e08cb2544e564cd687165646f9657636a960338da604c5e825
MD5 e93679902cfae16e328f51227c9c6325
SHA1 40c7ad61eb0035263aa890b1e1bed28fca42dd00
SHA512 a773c52c565ca413f51912dc8e336ded17f2b93f6ad03bdeff0556988215ff80acc30267d8bb8e3b5233f2018053c4a45da34d6b714659af7729a8d49058c21c
SSDEEP 12288:pazUTpipJVJHWB8QBZkaZPyIlEnuwmQqbF:pNETRWBZkMbEuZF
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwn.exe

Path C:\Users\Admin\AppData\Roaming\dwn.exe
Size 629KB
SHA256 fe2e1ccda328ac1bef167e1331cc8ce87d688df6a9d425433f898711f7b30cdb
MD5 aefd2b160e043b45af25bea4022fd09f
SHA1 8d3b3cbfb43d3dda42d9b4b3cf132680b2ac5497
SHA512 bb8f3c94ed19d8031410594ff14a137a7ea5a241d35a3fbb9be99fab91c4b8afb37fa6671f895f0064d8789d47c7135690fdb509b540e9e857d8080a26bdfbc6
SSDEEP 12288:CazUTpipJVJH/PDK3Xuv5YaDuy+4So5xs+AA9:CNETR/PD2Qphz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dwn.exe

Path C:\Users\Admin\AppData\Roaming\dwn.exe
Size 629KB
SHA256 fe2e1ccda328ac1bef167e1331cc8ce87d688df6a9d425433f898711f7b30cdb
MD5 aefd2b160e043b45af25bea4022fd09f
SHA1 8d3b3cbfb43d3dda42d9b4b3cf132680b2ac5497
SHA512 bb8f3c94ed19d8031410594ff14a137a7ea5a241d35a3fbb9be99fab91c4b8afb37fa6671f895f0064d8789d47c7135690fdb509b540e9e857d8080a26bdfbc6
SSDEEP 12288:CazUTpipJVJH/PDK3Xuv5YaDuy+4So5xs+AA9:CNETR/PD2Qphz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

lasdgas.exe

Path C:\Users\Admin\AppData\Roaming\lasdgas.exe
Size 629KB
SHA256 fe2e1ccda328ac1bef167e1331cc8ce87d688df6a9d425433f898711f7b30cdb
MD5 aefd2b160e043b45af25bea4022fd09f
SHA1 8d3b3cbfb43d3dda42d9b4b3cf132680b2ac5497
SHA512 bb8f3c94ed19d8031410594ff14a137a7ea5a241d35a3fbb9be99fab91c4b8afb37fa6671f895f0064d8789d47c7135690fdb509b540e9e857d8080a26bdfbc6
SSDEEP 12288:CazUTpipJVJH/PDK3Xuv5YaDuy+4So5xs+AA9:CNETR/PD2Qphz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

lasdgas.exe

Path C:\Users\Admin\AppData\Roaming\lasdgas.exe
Size 629KB
SHA256 fe2e1ccda328ac1bef167e1331cc8ce87d688df6a9d425433f898711f7b30cdb
MD5 aefd2b160e043b45af25bea4022fd09f
SHA1 8d3b3cbfb43d3dda42d9b4b3cf132680b2ac5497
SHA512 bb8f3c94ed19d8031410594ff14a137a7ea5a241d35a3fbb9be99fab91c4b8afb37fa6671f895f0064d8789d47c7135690fdb509b540e9e857d8080a26bdfbc6
SSDEEP 12288:CazUTpipJVJH/PDK3Xuv5YaDuy+4So5xs+AA9:CNETR/PD2Qphz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

lasdgas.exe

Path C:\Users\Admin\AppData\Roaming\lasdgas.exe
Size 629KB
SHA256 fe2e1ccda328ac1bef167e1331cc8ce87d688df6a9d425433f898711f7b30cdb
MD5 aefd2b160e043b45af25bea4022fd09f
SHA1 8d3b3cbfb43d3dda42d9b4b3cf132680b2ac5497
SHA512 bb8f3c94ed19d8031410594ff14a137a7ea5a241d35a3fbb9be99fab91c4b8afb37fa6671f895f0064d8789d47c7135690fdb509b540e9e857d8080a26bdfbc6
SSDEEP 12288:CazUTpipJVJH/PDK3Xuv5YaDuy+4So5xs+AA9:CNETR/PD2Qphz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

lasdgas.exe

Path C:\Users\Admin\AppData\Roaming\lasdgas.exe
Size 629KB
SHA256 fe2e1ccda328ac1bef167e1331cc8ce87d688df6a9d425433f898711f7b30cdb
MD5 aefd2b160e043b45af25bea4022fd09f
SHA1 8d3b3cbfb43d3dda42d9b4b3cf132680b2ac5497
SHA512 bb8f3c94ed19d8031410594ff14a137a7ea5a241d35a3fbb9be99fab91c4b8afb37fa6671f895f0064d8789d47c7135690fdb509b540e9e857d8080a26bdfbc6
SSDEEP 12288:CazUTpipJVJH/PDK3Xuv5YaDuy+4So5xs+AA9:CNETR/PD2Qphz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

nasdgas.exe

Path C:\Users\Admin\AppData\Roaming\nasdgas.exe
Size 605KB
SHA256 7d9604cab93bd9e08cb2544e564cd687165646f9657636a960338da604c5e825
MD5 e93679902cfae16e328f51227c9c6325
SHA1 40c7ad61eb0035263aa890b1e1bed28fca42dd00
SHA512 a773c52c565ca413f51912dc8e336ded17f2b93f6ad03bdeff0556988215ff80acc30267d8bb8e3b5233f2018053c4a45da34d6b714659af7729a8d49058c21c
SSDEEP 12288:pazUTpipJVJHWB8QBZkaZPyIlEnuwmQqbF:pNETRWBZkMbEuZF
MD5 SHA1 SHA512 SSDEEP

Submit Download

nasdgas.exe

Path C:\Users\Admin\AppData\Roaming\nasdgas.exe
Size 605KB
SHA256 7d9604cab93bd9e08cb2544e564cd687165646f9657636a960338da604c5e825
MD5 e93679902cfae16e328f51227c9c6325
SHA1 40c7ad61eb0035263aa890b1e1bed28fca42dd00
SHA512 a773c52c565ca413f51912dc8e336ded17f2b93f6ad03bdeff0556988215ff80acc30267d8bb8e3b5233f2018053c4a45da34d6b714659af7729a8d49058c21c
SSDEEP 12288:pazUTpipJVJHWB8QBZkaZPyIlEnuwmQqbF:pNETRWBZkMbEuZF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-204-0x00000000006F0000-0x000000000078C000-memory.dmp

Download

memory/1584-180-0x0000000000BD0000-0x0000000000C72000-memory.dmp

Download

memory/1612-132-0x0000000000020000-0x0000000000144000-memory.dmp

Download

memory/1612-136-0x0000000005EB0000-0x0000000005EBA000-memory.dmp

Download

memory/1612-135-0x0000000005EC0000-0x0000000005F52000-memory.dmp

Download

memory/1612-134-0x0000000006370000-0x0000000006914000-memory.dmp

Download

memory/1612-133-0x00000000051C0000-0x000000000525C000-memory.dmp

Download

memory/1688-169-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2072-212-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2072-211-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2072-209-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2148-157-0x0000000000B80000-0x0000000000B9A000-memory.dmp

Download

memory/2712-146-0x0000000000A50000-0x0000000000B74000-memory.dmp

Download

memory/3536-168-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3548-227-0x0000000006660000-0x00000000066C6000-memory.dmp

Download

memory/3548-220-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3780-179-0x0000000000480000-0x000000000051C000-memory.dmp

Download

memory/3876-170-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3876-171-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4660-149-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4660-185-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4660-148-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4660-151-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4660-150-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4776-203-0x0000000000D30000-0x0000000000DD2000-memory.dmp

Download