neshta | 09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
Size 2.4MB
Sample221018-pptpssfge9
SHA256 09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700
MD5 96043be47e7675254c087b7066a4794c
SHA1 6469980d6a93b331076ebc682356db3d728dbb27
SHA512 8920aff5c83ca2433fa1b3a8633986408dca33948d1b307c296587795b6f902a0bdf06ca2053a238d4914b1ab39c4ac56d618f95bf0e986a2c9c98622d92c712
SSDEEP 49152:S+65x7a/n6DbGITGf5MTGa2xEdjxucTMYSH+hHftIom+i89sYpV:QUCbGIstaQEdhotH8HftIX+i891V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta evasion persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 2 IoCs

pid	Process
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
4248	SQLService.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Loads dropped DLL 13 IoCs

pid	Process
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13165~1.21\MICROS~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MI9C33~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File created	C:\Windows\SQLService.exe	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File opened for modification	C:\Windows\parameters.ini	SQLService.exe
File created	C:\Windows\gpu_name.txt	cmd.exe
File opened for modification	C:\Windows\	SQLService.exe
File opened for modification	C:\Windows\SQLService.exe	SQLService.exe
File opened for modification	C:\Windows\libeay32.dll	SQLService.exe
File created	C:\Windows\parameters.ini	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
File created	C:\Windows\7zip.exe	SQLService.exe
File created	C:\Windows\WARNING.txt	SQLService.exe
File opened for modification	C:\Windows\ssleay32.dll	SQLService.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
424	sc.exe
908	sc.exe
3844	sc.exe
1604	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000022e2d-136.dat	nsis_installer_1
behavioral2/files/0x0008000000022e2d-136.dat	nsis_installer_2
behavioral2/files/0x0008000000022e2d-137.dat	nsis_installer_1
behavioral2/files/0x0008000000022e2d-137.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe
4248	SQLService.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	SQLService.exe
Token: SeAssignPrimaryTokenPrivilege	4376	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4376	WMIC.exe
Token: SeSecurityPrivilege	4376	WMIC.exe
Token: SeTakeOwnershipPrivilege	4376	WMIC.exe
Token: SeLoadDriverPrivilege	4376	WMIC.exe
Token: SeSystemtimePrivilege	4376	WMIC.exe
Token: SeBackupPrivilege	4376	WMIC.exe
Token: SeRestorePrivilege	4376	WMIC.exe
Token: SeShutdownPrivilege	4376	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4376	WMIC.exe
Token: SeUndockPrivilege	4376	WMIC.exe
Token: SeManageVolumePrivilege	4376	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4376	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4376	WMIC.exe
Token: SeSecurityPrivilege	4376	WMIC.exe
Token: SeTakeOwnershipPrivilege	4376	WMIC.exe
Token: SeLoadDriverPrivilege	4376	WMIC.exe
Token: SeSystemtimePrivilege	4376	WMIC.exe
Token: SeBackupPrivilege	4376	WMIC.exe
Token: SeRestorePrivilege	4376	WMIC.exe
Token: SeShutdownPrivilege	4376	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4376	WMIC.exe
Token: SeUndockPrivilege	4376	WMIC.exe
Token: SeManageVolumePrivilege	4376	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	SQLService.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 372	2080	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	81
PID 2080 wrote to memory of 372	2080	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	81
PID 2080 wrote to memory of 372	2080	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	81
PID 372 wrote to memory of 2552	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	82
PID 372 wrote to memory of 2552	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	82
PID 372 wrote to memory of 2552	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	82
PID 2552 wrote to memory of 5076	2552	cmd.exe	84
PID 2552 wrote to memory of 5076	2552	cmd.exe	84
PID 2552 wrote to memory of 5076	2552	cmd.exe	84
PID 5076 wrote to memory of 4984	5076	net.exe	85
PID 5076 wrote to memory of 4984	5076	net.exe	85
PID 5076 wrote to memory of 4984	5076	net.exe	85
PID 372 wrote to memory of 5036	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	86
PID 372 wrote to memory of 5036	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	86
PID 372 wrote to memory of 5036	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	86
PID 5036 wrote to memory of 424	5036	cmd.exe	88
PID 5036 wrote to memory of 424	5036	cmd.exe	88
PID 5036 wrote to memory of 424	5036	cmd.exe	88
PID 372 wrote to memory of 4228	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	89
PID 372 wrote to memory of 4228	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	89
PID 372 wrote to memory of 4228	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	89
PID 4228 wrote to memory of 908	4228	cmd.exe	91
PID 4228 wrote to memory of 908	4228	cmd.exe	91
PID 4228 wrote to memory of 908	4228	cmd.exe	91
PID 372 wrote to memory of 4208	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	92
PID 372 wrote to memory of 4208	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	92
PID 372 wrote to memory of 4208	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	92
PID 4208 wrote to memory of 3844	4208	cmd.exe	94
PID 4208 wrote to memory of 3844	4208	cmd.exe	94
PID 4208 wrote to memory of 3844	4208	cmd.exe	94
PID 372 wrote to memory of 3548	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	95
PID 372 wrote to memory of 3548	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	95
PID 372 wrote to memory of 3548	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	95
PID 3548 wrote to memory of 1604	3548	cmd.exe	97
PID 3548 wrote to memory of 1604	3548	cmd.exe	97
PID 3548 wrote to memory of 1604	3548	cmd.exe	97
PID 372 wrote to memory of 112	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	98
PID 372 wrote to memory of 112	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	98
PID 372 wrote to memory of 112	372	09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe	98
PID 112 wrote to memory of 1988	112	cmd.exe	100
PID 112 wrote to memory of 1988	112	cmd.exe	100
PID 112 wrote to memory of 1988	112	cmd.exe	100
PID 1988 wrote to memory of 2732	1988	net.exe	101
PID 1988 wrote to memory of 2732	1988	net.exe	101
PID 1988 wrote to memory of 2732	1988	net.exe	101
PID 4248 wrote to memory of 4580	4248	SQLService.exe	103
PID 4248 wrote to memory of 4580	4248	SQLService.exe	103
PID 4248 wrote to memory of 4580	4248	SQLService.exe	103
PID 4580 wrote to memory of 4376	4580	cmd.exe	105
PID 4580 wrote to memory of 4376	4580	cmd.exe	105
PID 4580 wrote to memory of 4376	4580	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
"C:\Users\Admin\AppData\Local\Temp\09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\3582-490\09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C net stop SQLService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLService
        5⤵
        
        PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C Sc delete SQLService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\sc.exe
      Sc delete SQLService
      4⤵
      Launches sc.exe
      PID:424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C Sc create SQLService binpath= C:\Windows\SQLService.exe start= auto DisplayName= SQLService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\SysWOW64\sc.exe
      Sc create SQLService binpath= C:\Windows\SQLService.exe start= auto DisplayName= SQLService
      4⤵
      Launches sc.exe
      PID:908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C sc description SQLService SQLService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\sc.exe
      sc description SQLService SQLService
      4⤵
      Launches sc.exe
      PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C sc failure SQLService reset= 3600 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\SysWOW64\sc.exe
      sc failure SQLService reset= 3600 actions= restart/60000/restart/60000/restart/60000
      4⤵
      Launches sc.exe
      PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C net start SQLService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:112
  - - C:\Windows\SysWOW64\net.exe
      net start SQLService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start SQLService
        5⤵
        
        PID:2732

C:\Windows\SQLService.exe
C:\Windows\SQLService.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic path win32_VideoController get name > C:\Windows\gpu_name.txt
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
Size 2.4MB
SHA256 a68a7e8835186d1ebfb96a0f04f283a524d497ded23313544e2fbd0cd649c55c
MD5 8ca9e451cfdb7df6a54ec226605837c6
SHA1 b15e3ef8cb91adabf236f8072179d092c89f7fa4
SHA512 a3837f751a6893d233ea2b95bb0664ac193c41f2974d39c820af5c41c49a9770944f0adf236d552eaebc805673c3dc7424bc3b02ebc69a1aa4399602ffebcba8
SSDEEP 49152:e+65x7a/n6DbGITGf5MTGa2xEdjxucTMYSH+hHftIom+i89sYpVr:8UCbGIstaQEdhotH8HftIX+i891Vr
MD5 SHA1 SHA512 SSDEEP

Submit Download

09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\09a7dfd655e32fcfe867482d22f8d32a3c1ad3d8e9af1a8d65b33e7ea963b700.exe
Size 2.4MB
SHA256 a68a7e8835186d1ebfb96a0f04f283a524d497ded23313544e2fbd0cd649c55c
MD5 8ca9e451cfdb7df6a54ec226605837c6
SHA1 b15e3ef8cb91adabf236f8072179d092c89f7fa4
SHA512 a3837f751a6893d233ea2b95bb0664ac193c41f2974d39c820af5c41c49a9770944f0adf236d552eaebc805673c3dc7424bc3b02ebc69a1aa4399602ffebcba8
SSDEEP 49152:e+65x7a/n6DbGITGf5MTGa2xEdjxucTMYSH+hHftIom+i89sYpVr:8UCbGIstaQEdhotH8HftIX+i891Vr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg97D1.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

Submit Download

SQLService.exe

Path C:\Windows\SQLService.exe
Size 5.6MB
SHA256 7751189d9629fbf984331aa5892340bddb8f2b7bb3f58312b6843d728b0d4d7c
MD5 170aeed0baed99231fa812fba1ac9aac
SHA1 21dce8f87e37406519b0785b68c61286c04c2291
SHA512 8815e6392d2104ee7f2dcc5eb13edcce93f1112e2d7305bcfbf8df91676b21d9ce9a6f1b37f09fbbe576bd476b03c793435244a24961344062e702fa780ce613
SSDEEP 49152:gnjpNyLJZ9nrAoPpSg7BjnrpBQb+2xIWAO3y9VAp6nTl7TyEtCpYfshHS2WUda9X:gjXcj95ly62eG8VQQ7TRtOYfn2WOa9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQLService.exe

Path C:\Windows\SQLService.exe
Size 5.6MB
SHA256 7751189d9629fbf984331aa5892340bddb8f2b7bb3f58312b6843d728b0d4d7c
MD5 170aeed0baed99231fa812fba1ac9aac
SHA1 21dce8f87e37406519b0785b68c61286c04c2291
SHA512 8815e6392d2104ee7f2dcc5eb13edcce93f1112e2d7305bcfbf8df91676b21d9ce9a6f1b37f09fbbe576bd476b03c793435244a24961344062e702fa780ce613
SSDEEP 49152:gnjpNyLJZ9nrAoPpSg7BjnrpBQb+2xIWAO3y9VAp6nTl7TyEtCpYfshHS2WUda9X:gjXcj95ly62eG8VQQ7TRtOYfn2WOa9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

parameters.ini

Path C:\Windows\parameters.ini
Size 216B
SHA256 90a11499db5c567bf8ef45bf56c5f4c4fec9e62284898be507e08982c71eca01
MD5 0a274d232e2e754ef034400afb81d90f
SHA1 f940721b21966e2257b1930bc055d43728cea570
SHA512 26353c3d3cda833151d8df6c6f9cc839d9516a946b7ff268ae113848046b9a4eac3acd63269c8b98c06e3940cbb5fcb67a8064a216699096ca537398b9c2d810
MD5 SHA1 SHA512

Submit Download