redline | be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

Resubmissions

18/10/2022, 04:32

221018-e51g6seeb810

18/10/2022, 04:06

221018-epj59aedd67

18/10/2022, 03:34

221018-d417mseefj10

Analysis

max time kernel
1705s
max time network
1708s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
Size 521KB
Sample221018-e51g6seeb8
SHA256 be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b
MD5 c0318aa61a314fed79c87be28f0db3ba
SHA1 361e5206d2e0aeb88174c524e6c7cfb90c94670d
SHA512 619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586
SSDEEP 12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline birjro1 discovery infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

BirjRo1

79.137.197.136:23532

Attributes

auth_value
278e5c62cf6a9bb4e0ab732b17b0368e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000122ea-93.dat	family_redline
behavioral1/files/0x000d0000000122ea-94.dat	family_redline
behavioral1/files/0x000d0000000122ea-96.dat	family_redline
behavioral1/memory/1604-97-0x0000000000110000-0x0000000000138000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 15 IoCs

pid	Process
1524	svcmgr.exe
1604	extra.exe
1728	svcmgr.exe
1312	svcmgr.exe
1548	svcmgr.exe
1832	svcmgr.exe
364	svcmgr.exe
1528	svcmgr.exe
1500	svcmgr.exe
1448	svcmgr.exe
844	svcmgr.exe
1544	svcmgr.exe
780	svcmgr.exe
1728	svcmgr.exe
1312	svcmgr.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "C:\\Windows\\SvcManager\\svcnetwork.dll"	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

Deletes itself 1 IoCs

pid	Process
1724	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1512	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\WgaUtilAcc = "0"	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SvcManager\svcnetwork.dll	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
File opened for modification	C:\Windows\SvcManager\secedit.sdb	powershell.exe
File created	C:\Windows\SvcManager\tempexport.inf	SecEdit.exe
File opened for modification	C:\Windows\SvcManager\tempexport.inf	SecEdit.exe
File opened for modification	C:\Windows\SvcManager\tempimport.inf	powershell.exe
File opened for modification	C:\Windows\SvcManager\tempexport.inf	powershell.exe
File created	C:\Windows\SvcManager\svcmgr.exe	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
File created	C:\Windows\SvcManager\svcnetwork.dat	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
File created	C:\Windows\SvcManager\las.ps1	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svcmgr.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svcmgr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svcmgr.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	svcmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	svcmgr.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
240	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1748	powershell.exe
1252	powershell.exe
1780	powershell.exe
1604	extra.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1524	svcmgr.exe
Token: SeDebugPrivilege	1604	extra.exe
Token: SeDebugPrivilege	1728	svcmgr.exe
Token: SeDebugPrivilege	1312	svcmgr.exe
Token: SeDebugPrivilege	1548	svcmgr.exe
Token: SeDebugPrivilege	1832	svcmgr.exe
Token: SeDebugPrivilege	364	svcmgr.exe
Token: SeDebugPrivilege	1528	svcmgr.exe
Token: SeDebugPrivilege	1500	svcmgr.exe
Token: SeDebugPrivilege	1448	svcmgr.exe
Token: SeDebugPrivilege	844	svcmgr.exe
Token: SeDebugPrivilege	1544	svcmgr.exe
Token: SeDebugPrivilege	780	svcmgr.exe
Token: SeDebugPrivilege	1728	svcmgr.exe
Token: SeDebugPrivilege	1312	svcmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1256	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	29
PID 1764 wrote to memory of 1256	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	29
PID 1764 wrote to memory of 1256	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	29
PID 1764 wrote to memory of 1256	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	29
PID 1256 wrote to memory of 1752	1256	cmd.exe	30
PID 1256 wrote to memory of 1752	1256	cmd.exe	30
PID 1256 wrote to memory of 1752	1256	cmd.exe	30
PID 1256 wrote to memory of 1752	1256	cmd.exe	30
PID 1752 wrote to memory of 948	1752	net.exe	31
PID 1752 wrote to memory of 948	1752	net.exe	31
PID 1752 wrote to memory of 948	1752	net.exe	31
PID 1752 wrote to memory of 948	1752	net.exe	31
PID 1764 wrote to memory of 1268	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	32
PID 1764 wrote to memory of 1268	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	32
PID 1764 wrote to memory of 1268	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	32
PID 1764 wrote to memory of 1268	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	32
PID 1268 wrote to memory of 1748	1268	cmd.exe	33
PID 1268 wrote to memory of 1748	1268	cmd.exe	33
PID 1268 wrote to memory of 1748	1268	cmd.exe	33
PID 1268 wrote to memory of 1748	1268	cmd.exe	33
PID 1764 wrote to memory of 1168	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	34
PID 1764 wrote to memory of 1168	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	34
PID 1764 wrote to memory of 1168	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	34
PID 1764 wrote to memory of 1168	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	34
PID 1168 wrote to memory of 1252	1168	cmd.exe	35
PID 1168 wrote to memory of 1252	1168	cmd.exe	35
PID 1168 wrote to memory of 1252	1168	cmd.exe	35
PID 1168 wrote to memory of 1252	1168	cmd.exe	35
PID 1764 wrote to memory of 324	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 1764 wrote to memory of 324	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 1764 wrote to memory of 324	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 1764 wrote to memory of 324	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	36
PID 324 wrote to memory of 1780	324	cmd.exe	37
PID 324 wrote to memory of 1780	324	cmd.exe	37
PID 324 wrote to memory of 1780	324	cmd.exe	37
PID 324 wrote to memory of 1780	324	cmd.exe	37
PID 1780 wrote to memory of 836	1780	powershell.exe	38
PID 1780 wrote to memory of 836	1780	powershell.exe	38
PID 1780 wrote to memory of 836	1780	powershell.exe	38
PID 1780 wrote to memory of 836	1780	powershell.exe	38
PID 1780 wrote to memory of 1060	1780	powershell.exe	39
PID 1780 wrote to memory of 1060	1780	powershell.exe	39
PID 1780 wrote to memory of 1060	1780	powershell.exe	39
PID 1780 wrote to memory of 1060	1780	powershell.exe	39
PID 1780 wrote to memory of 1820	1780	powershell.exe	40
PID 1780 wrote to memory of 1820	1780	powershell.exe	40
PID 1780 wrote to memory of 1820	1780	powershell.exe	40
PID 1780 wrote to memory of 1820	1780	powershell.exe	40
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1780 wrote to memory of 1260	1780	powershell.exe	41
PID 1764 wrote to memory of 628	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	42
PID 1764 wrote to memory of 628	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	42
PID 1764 wrote to memory of 628	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	42
PID 1764 wrote to memory of 628	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	42
PID 1764 wrote to memory of 1804	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	43
PID 1764 wrote to memory of 1804	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	43
PID 1764 wrote to memory of 1804	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	43
PID 1764 wrote to memory of 1804	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	43
PID 1764 wrote to memory of 1512	1764	be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe	45

C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
"C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
1⤵
- Sets DLL path for service in the registry
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user %username%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\net.exe
    net user Admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin
      4⤵
      PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Set-ExecutionPolicy bypass -Force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Set-ExecutionPolicy bypass -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe C:\Windows\SvcManager\las.ps1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:324
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe C:\Windows\SvcManager\las.ps1
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\SecEdit.exe
      "C:\Windows\system32\SecEdit.exe" /export /cfg tempexport.inf
      4⤵
      Drops file in Windows directory
      PID:836
  - - C:\Windows\SysWOW64\SecEdit.exe
      "C:\Windows\system32\SecEdit.exe" /import /db secedit.sdb /cfg .\tempimport.inf
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\SecEdit.exe
      "C:\Windows\system32\SecEdit.exe" /configure /db secedit.sdb
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      4⤵
      PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f C:\Windows\SvcManager\las.ps1
  2⤵
  PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\extra.exe
  2⤵
  - Loads dropped DLL
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\extra.exe
    C:\Users\Admin\AppData\Local\Temp\\extra.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
  2⤵
  - Deletes itself
  PID:1724
- - C:\Windows\SysWOW64\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - Runs ping.exe
    PID:240

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\SvcManager\svcmgr.exe
C:\Windows\SvcManager\svcmgr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

extra.exe

Path C:\Users\Admin\AppData\Local\Temp\extra.exe
Size 137KB
SHA256 f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c
MD5 0072395e192397b4f98bbb6852d1d495
SHA1 8246494746644b90380a4458e9248e7f3341ad8f
SHA512 1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d
SSDEEP 3072:qYO/ZMTFFR4vIwr0T3zQaabwVyDFZyRP/hASSw6R:qYMZMBFR4vIrjzQaabZGp/hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

extra.exe

Path C:\Users\Admin\AppData\Local\Temp\extra.exe
Size 137KB
SHA256 f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c
MD5 0072395e192397b4f98bbb6852d1d495
SHA1 8246494746644b90380a4458e9248e7f3341ad8f
SHA512 1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d
SSDEEP 3072:qYO/ZMTFFR4vIwr0T3zQaabwVyDFZyRP/hASSw6R:qYMZMBFR4vIrjzQaabZGp/hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 76e08ede19dae4fc375aa89243dcff3c4cd0aa410790dae1bbbbc77f47f31b54
MD5 d7b2a3fd140e173632dd37b624d87697
SHA1 f36e7109ab2809e886b0aeeea1309fd72fcdb87a
SHA512 b1e9fa28cb7fa71ef747c1d3047dd9fdfe7171f9ebf1041160c52340d4aad3f7eb88bd386ce7694635888add1b16ff7591299aa74f187d780ce10a042beba2e2
SSDEEP 96:IxmxCoBM8onqvsqvJCwoW0v00xmxCoBM8onqvsEHyqvJCwor80v0qDOWQHfQ70Qf:4YEUozYEAHnorJ3qQ70Qf
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 76e08ede19dae4fc375aa89243dcff3c4cd0aa410790dae1bbbbc77f47f31b54
MD5 d7b2a3fd140e173632dd37b624d87697
SHA1 f36e7109ab2809e886b0aeeea1309fd72fcdb87a
SHA512 b1e9fa28cb7fa71ef747c1d3047dd9fdfe7171f9ebf1041160c52340d4aad3f7eb88bd386ce7694635888add1b16ff7591299aa74f187d780ce10a042beba2e2
SSDEEP 96:IxmxCoBM8onqvsqvJCwoW0v00xmxCoBM8onqvsEHyqvJCwor80v0qDOWQHfQ70Qf:4YEUozYEAHnorJ3qQ70Qf
MD5 SHA1 SHA512 SSDEEP

Submit Download

las.ps1

Path C:\Windows\SvcManager\las.ps1
Size 1KB
SHA256 f63923ddc20574ca230a3b51bf7a6bf158a53f84494e2081071c3469abb068ca
MD5 9a6fbc01aa4147aa5aa91fca92ef6dfd
SHA1 f8b47020022626abef69f2032d22e89b95b994a8
SHA512 a80c89c1daa41d8c1f5c71ec06db7eaf6f686f4726ef5cce8d8854371fec4dfa88b4649ee7f78c59ff4f1f00a7296a917696a760228ce59206c09d3d7e954990
MD5 SHA1 SHA512

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcmgr.exe

Path C:\Windows\SvcManager\svcmgr.exe
Size 788KB
SHA256 e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe
MD5 621074969d8ccca5585201b6268e2faf
SHA1 252f556025ec03884edfd793da95179e31b055e5
SHA512 0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a
SSDEEP 12288:fbnsaF6daR4j178d5d7QdQLCQGAb0AAaxyTNegqh7nx6kw+7wXel7DLSkwLTNjIo:fBH25wz7o8V0hvC7xq07DOLTqQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tempexport.inf

Path C:\Windows\SvcManager\tempexport.inf
Size 16KB
SHA256 85773e2c05d587ae800deae43ab836164aab7d35118cf4b2c0029a11fd17c8ee
MD5 4f9d9a31b38978d0a23c60f67fdbeedb
SHA1 7886fec6c38f0bff79930a97c4e75ceaba17ce32
SHA512 12465d2898a70335cc411dc3862c43cda1b19b4f36bd6a64f188401426f2d1153801cb6c74ab64ee212a34000928a1d6794b3bbe4924986e80b24bc7338c66bb
SSDEEP 96:rp36mOr9+gkz2DGU+SVjhOuScDcWcocGcvcecjcHc/cLcscAcqcsc9TVc7c7c9Tc:t9Brz7WhOu3TMTbXIXkOnB
MD5 SHA1 SHA512 SSDEEP

Submit Download

extra.exe

Path \Users\Admin\AppData\Local\Temp\extra.exe
Size 137KB
SHA256 f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c
MD5 0072395e192397b4f98bbb6852d1d495
SHA1 8246494746644b90380a4458e9248e7f3341ad8f
SHA512 1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d
SSDEEP 3072:qYO/ZMTFFR4vIwr0T3zQaabwVyDFZyRP/hASSw6R:qYMZMBFR4vIrjzQaabZGp/hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/364-110-0x00000000000C0000-0x000000000018C000-memory.dmp

Download

memory/780-124-0x0000000000CA0000-0x0000000000D6C000-memory.dmp

Download

memory/844-120-0x0000000019E20000-0x0000000019EC6000-memory.dmp

Download

memory/844-119-0x00000000001E0000-0x00000000002AC000-memory.dmp

Download

memory/1252-71-0x0000000073F90000-0x000000007453B000-memory.dmp

Download

memory/1252-70-0x0000000073F90000-0x000000007453B000-memory.dmp

Download

memory/1312-128-0x0000000000E70000-0x0000000000F3C000-memory.dmp

Download

memory/1448-116-0x0000000000840000-0x000000000090C000-memory.dmp

Download

memory/1448-117-0x0000000019560000-0x0000000019606000-memory.dmp

Download

memory/1500-114-0x00000000003E0000-0x00000000004AC000-memory.dmp

Download

memory/1524-99-0x00000000010B0000-0x0000000001156000-memory.dmp

Download

memory/1524-91-0x0000000001240000-0x000000000130C000-memory.dmp

Download

memory/1528-112-0x0000000000900000-0x00000000009CC000-memory.dmp

Download

memory/1544-122-0x00000000003F0000-0x00000000004BC000-memory.dmp

Download

memory/1604-97-0x0000000000110000-0x0000000000138000-memory.dmp

Download

memory/1728-126-0x0000000000390000-0x000000000045C000-memory.dmp

Download

memory/1748-60-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Download

memory/1748-65-0x0000000073FD0000-0x000000007457B000-memory.dmp

Download

memory/1748-64-0x0000000073FD0000-0x000000007457B000-memory.dmp

Download

memory/1764-85-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/1764-62-0x0000000000780000-0x0000000000821000-memory.dmp

Download

memory/1764-63-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/1764-101-0x0000000000698000-0x00000000006F5000-memory.dmp

Download

memory/1764-54-0x0000000000698000-0x00000000006F5000-memory.dmp

Download

memory/1764-84-0x0000000000698000-0x00000000006F5000-memory.dmp

Download

memory/1764-61-0x0000000000698000-0x00000000006F5000-memory.dmp

Download

memory/1764-102-0x0000000000400000-0x00000000005DF000-memory.dmp

Download

memory/1780-86-0x0000000073790000-0x0000000073D3B000-memory.dmp

Download

memory/1780-81-0x0000000073790000-0x0000000073D3B000-memory.dmp

Download

memory/1832-108-0x0000000000030000-0x00000000000FC000-memory.dmp

Download