5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618

General

Target

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Size

667KB
MD5

6f30aa9bd7e8aa967bba9e63eaa45580
SHA1

5fe1bf96805d5fc173d132d80545b307f6e3254b
SHA256

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618
SHA512

a496b924ddf5abfa920c5fd992f3908c04e580114d890827b4d3f6a8849ec6f1295217cc98bb5c8754c05200ba8486eae119128feb46ae6f4afa4f6b7480177d
SSDEEP

12288:/c0zvQ9wQflcC2C+w2P3z+qeWU+7FjiPPnYR9d2mUNpZ:/3zveflc5CP2/zt3F7FWfY1upZ

Score

9^/10

adware discovery exploit persistence stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\HfYTtHiI.dll	acprotect

Drops file in Drivers directory 1 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\50762a0a.sys 5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

1988 takeown.exe
2024 icacls.exe
956 takeown.exe
900 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\50762a0a.sys	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
1988	takeown.exe
2024	icacls.exe
956	takeown.exe
900	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\50762a0a\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\50762a0a.sys"	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\HfYTtHiI.dll	upx
behavioral1/memory/1048-71-0x0000000010000000-0x00000000105ED000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

316 cmd.exe

pid	process
316	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

900 icacls.exe
1988 takeown.exe
2024 icacls.exe
956 takeown.exe

pid	process
900	icacls.exe
1988	takeown.exe
2024	icacls.exe
956	takeown.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Drops file in System32 directory 5 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
File created	C:\Windows\SysWOW64\midimap.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File created	C:\Windows\SysWOW64\HfYTtHiI.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File created	C:\Windows\SysWOW64\qHDF1UJB.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
File opened for modification	C:\Windows\SysWOW64\wshtcpip.dll	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Modifies registry class 4 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe"	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "hJ2.dll"	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid process

464
1048 5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

pid	process
464
1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

takeown.exetakeown.exe5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1988	takeown.exe
Token: SeTakeOwnershipPrivilege	956	takeown.exe
Token: SeDebugPrivilege	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.execmd.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 1756	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 1756	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 1756	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 1756	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1756 wrote to memory of 1988	1756	cmd.exe	takeown.exe
PID 1756 wrote to memory of 1988	1756	cmd.exe	takeown.exe
PID 1756 wrote to memory of 1988	1756	cmd.exe	takeown.exe
PID 1756 wrote to memory of 1988	1756	cmd.exe	takeown.exe
PID 1756 wrote to memory of 2024	1756	cmd.exe	icacls.exe
PID 1756 wrote to memory of 2024	1756	cmd.exe	icacls.exe
PID 1756 wrote to memory of 2024	1756	cmd.exe	icacls.exe
PID 1756 wrote to memory of 2024	1756	cmd.exe	icacls.exe
PID 1048 wrote to memory of 1724	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 1724	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 1724	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 1724	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1724 wrote to memory of 956	1724	cmd.exe	takeown.exe
PID 1724 wrote to memory of 956	1724	cmd.exe	takeown.exe
PID 1724 wrote to memory of 956	1724	cmd.exe	takeown.exe
PID 1724 wrote to memory of 956	1724	cmd.exe	takeown.exe
PID 1724 wrote to memory of 900	1724	cmd.exe	icacls.exe
PID 1724 wrote to memory of 900	1724	cmd.exe	icacls.exe
PID 1724 wrote to memory of 900	1724	cmd.exe	icacls.exe
PID 1724 wrote to memory of 900	1724	cmd.exe	icacls.exe
PID 1048 wrote to memory of 316	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 316	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 316	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe
PID 1048 wrote to memory of 316	1048	5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe
"C:\Users\Admin\AppData\Local\Temp\5287163a5bf448dd4f15349e9b349e2e36774a185f64e10c7afb6fe4b9914618.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:900

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
- Deletes itself
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
Filesize
181B

MD5
4bc4681ba8c6f4fc81cdc017130edba4

SHA1
17334637f9dfe18b2dda6d0da0155719dd8ff1a3

SHA256
0ee763f971b22334907748e0e0563c53e75b1f3be6f02d827c25a0e564fbb349

SHA512
42df11991864c96ad88f86c3296a0f9d27b2247a379357c98731df6fd088d144fc54b13dc50d953fa1bcd9c5563617f244a565b58642cf41ee625211b8581ebb

Download Submit
\Users\Admin\AppData\Local\Temp\HfYTtHiI.dll
Filesize
5.9MB

MD5
68e20b2392a0ea354dcb03bb5e4be580

SHA1
16bcea6359e6e2e7412e0dedb12d80d364fa8aa4

SHA256
dde2a8a8cefb2ff1d5ebd8a88744194d66a43f0386d85979f73ed02e20e45be8

SHA512
81eb4ceb1f5aee03f25f28dec9c671bbe4811e5b97fe4c2f32d9ccb3f6a164f5e2646cdbcd9ce4e2fdea271cf6701841069394dd2e5da069e80502f819b23cb5

Download Submit
\Windows\SysWOW64\wshtcpip.dll
Filesize
19KB

MD5
e4c1fed7ff0f8e9ac9bd3c9c2543260b

SHA1
fb375a072a002c3da917aff412b8defe82916fcd

SHA256
66f16fba5b390a8845634ada9198266148907c6c4f75c893320213c85f022893

SHA512
5e459b3644e6cd5f1394bf79877df3b864e03e0cdf34a0522962792788c3656f91c59e721f3ec64d26ef36c98f74b0c141649eca3be46b536225a7c786084a94

Download Submit
memory/316-67-0x0000000000000000-mapping.dmp

Download
memory/900-62-0x0000000000000000-mapping.dmp

Download
memory/956-61-0x0000000000000000-mapping.dmp

Download
memory/1048-66-0x00000000719C1000-0x00000000719C5000-memory.dmp

Filesize
16KB

Download
memory/1048-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1048-63-0x0000000001000000-0x000000000177C000-memory.dmp

Filesize
7.5MB

Download
memory/1048-64-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/1048-56-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/1048-55-0x0000000001000000-0x000000000177C000-memory.dmp

Filesize
7.5MB

Download
memory/1048-70-0x0000000001000000-0x000000000177C000-memory.dmp

Filesize
7.5MB

Download
memory/1048-71-0x0000000010000000-0x00000000105ED000-memory.dmp

Filesize
5.9MB

Download
memory/1048-72-0x0000000010000000-0x00000000105ED000-memory.dmp

Filesize
5.9MB

Download
memory/1724-60-0x0000000000000000-mapping.dmp

Download
memory/1756-57-0x0000000000000000-mapping.dmp

Download
memory/1988-58-0x0000000000000000-mapping.dmp

Download
memory/2024-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads