27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3

General

Target

27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Size

684KB
MD5

41bbf329d25a4664ed18bb8f079980d0
SHA1

be503850c64fca1bb91c8975084fb569e59be529
SHA256

27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3
SHA512

8942136dcbf4d4176d07c99c60472252a8d6377bdcab32dfe36f6f15313b623bab57e1685296d900e55b2f447eda276100f46a528ee6767d4f76c24ee6db5c01
SSDEEP

6144:+h3rzMYXh+02d1r5ZTYnQbc0w6LlANv4hituxp38u0:UrgQmd195KQ40wWlANv4h8u/8

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

taltegr.exetaltegr.exe27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

taltegr.exetaltegr.exe27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taltegr.exe

Adds policy Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

taltegr.exetaltegr.exe27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gaytrgerohsedcftewcw.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "sictnysbujqytonx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "iawplyufarakhefraq.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sictnysbujqytonx.exe"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqldykfpjzhqmiitb.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqldykfpjzhqmiitb.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iawplyufarakhefraq.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "iawplyufarakhefraq.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gaytrgerohsedcftewcw.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sictnysbujqytonx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "zqldykfpjzhqmiitb.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "gaytrgerohsedcftewcw.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "sictnysbujqytonx.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gmwdno = "gaytrgerohsedcftewcw.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fip = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe"	taltegr.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

taltegr.exetaltegr.exe27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	taltegr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	taltegr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

Executes dropped EXE 2 IoCs

Processes:

taltegr.exetaltegr.exe

pid process

4988 taltegr.exe
4912 taltegr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

taltegr.exetaltegr.exe27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mqyd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "tmjdaolxtlvgecerbsx.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sictnysbujqytonx.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "iawplyufarakhefraq.exe ."	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zivfswjlx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gaytrgerohsedcftewcw.exe ."	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "vqplkaznlfreeeixjcjed.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gaytrgerohsedcftewcw.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zivfswjlx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sictnysbujqytonx.exe ."	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mqyd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sictnysbujqytonx.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iawplyufarakhefraq.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "iawplyufarakhefraq.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "zqldykfpjzhqmiitb.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "gaytrgerohsedcftewcw.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "zqldykfpjzhqmiitb.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taltegr = "vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "vqplkaznlfreeeixjcjed.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iawplyufarakhefraq.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "sictnysbujqytonx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "vqplkaznlfreeeixjcjed.exe ."	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mqyd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sictnysbujqytonx.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "gaytrgerohsedcftewcw.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "sictnysbujqytonx.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taltegr = "zqldykfpjzhqmiitb.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "iawplyufarakhefraq.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "zqldykfpjzhqmiitb.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "iawplyufarakhefraq.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mqyd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "zqldykfpjzhqmiitb.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "iawplyufarakhefraq.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gaytrgerohsedcftewcw.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "zqldykfpjzhqmiitb.exe"	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zivfswjlx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqldykfpjzhqmiitb.exe ."	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mqyd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iawplyufarakhefraq.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "iawplyufarakhefraq.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqldykfpjzhqmiitb.exe"	taltegr.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taltegr = "zqldykfpjzhqmiitb.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqldykfpjzhqmiitb.exe ."	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "sictnysbujqytonx.exe"	taltegr.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "iawplyufarakhefraq.exe ."	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taltegr = "vqplkaznlfreeeixjcjed.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "sictnysbujqytonx.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "gaytrgerohsedcftewcw.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "sictnysbujqytonx.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scqbpuilyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmjdaolxtlvgecerbsx.exe"	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqldykfpjzhqmiitb.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqyd = "zqldykfpjzhqmiitb.exe"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqplkaznlfreeeixjcjed.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zivfswjlx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmjdaolxtlvgecerbsx.exe ."	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zivfswjlx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iawplyufarakhefraq.exe ."	taltegr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iqclxamn = "gaytrgerohsedcftewcw.exe ."	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	taltegr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vajpy = "vqplkaznlfreeeixjcjed.exe ."	taltegr.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

taltegr.exe27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exetaltegr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taltegr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taltegr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taltegr.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
35	whatismyip.everdot.org
53	whatismyip.everdot.org
10	whatismyip.everdot.org
14	www.showmyipaddress.com
19	whatismyip.everdot.org
26	whatismyipaddress.com

Drops file in System32 directory 4 IoCs

Processes:

taltegr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\fiptayfbhjdygoaxrshkrvcah.jlf	taltegr.exe
File opened for modification	C:\Windows\SysWOW64\kyqfxgyfwjoungdlqccqixpyqxobgmfyvdiu.iap	taltegr.exe
File created	C:\Windows\SysWOW64\kyqfxgyfwjoungdlqccqixpyqxobgmfyvdiu.iap	taltegr.exe
File opened for modification	C:\Windows\SysWOW64\fiptayfbhjdygoaxrshkrvcah.jlf	taltegr.exe

Drops file in Program Files directory 4 IoCs

Processes:

taltegr.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\fiptayfbhjdygoaxrshkrvcah.jlf	taltegr.exe
File created	C:\Program Files (x86)\fiptayfbhjdygoaxrshkrvcah.jlf	taltegr.exe
File opened for modification	C:\Program Files (x86)\kyqfxgyfwjoungdlqccqixpyqxobgmfyvdiu.iap	taltegr.exe
File created	C:\Program Files (x86)\kyqfxgyfwjoungdlqccqixpyqxobgmfyvdiu.iap	taltegr.exe

Drops file in Windows directory 4 IoCs

Processes:

taltegr.exe

description	ioc	process
File opened for modification	C:\Windows\fiptayfbhjdygoaxrshkrvcah.jlf	taltegr.exe
File created	C:\Windows\fiptayfbhjdygoaxrshkrvcah.jlf	taltegr.exe
File opened for modification	C:\Windows\kyqfxgyfwjoungdlqccqixpyqxobgmfyvdiu.iap	taltegr.exe
File created	C:\Windows\kyqfxgyfwjoungdlqccqixpyqxobgmfyvdiu.iap	taltegr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

taltegr.exe

pid	process
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe
4988	taltegr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taltegr.exe

description pid process

Token: SeDebugPrivilege 4988 taltegr.exe

description	pid	process
Token: SeDebugPrivilege	4988	taltegr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

description	pid	process	target process
PID 4664 wrote to memory of 4988	4664	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe	taltegr.exe
PID 4664 wrote to memory of 4988	4664	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe	taltegr.exe
PID 4664 wrote to memory of 4988	4664	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe	taltegr.exe
PID 4664 wrote to memory of 4912	4664	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe	taltegr.exe
PID 4664 wrote to memory of 4912	4664	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe	taltegr.exe
PID 4664 wrote to memory of 4912	4664	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe	taltegr.exe

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

Processes:

27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exetaltegr.exetaltegr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	taltegr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	taltegr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe

C:\Users\Admin\AppData\Local\Temp\27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe
"C:\Users\Admin\AppData\Local\Temp\27ad3ad8da4f3ef37c637b58e1a537778bb2965630c773ce9ddcda972a19e8a3.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4664

C:\Users\Admin\AppData\Local\Temp\taltegr.exe
"C:\Users\Admin\AppData\Local\Temp\taltegr.exe" "-"
2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4988

C:\Users\Admin\AppData\Local\Temp\taltegr.exe
"C:\Users\Admin\AppData\Local\Temp\taltegr.exe" "-"
2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\taltegr.exe

Filesize
1.2MB

MD5
ab6ecaac0444c9c6610edfeefeb59fe0

SHA1
508482528ab978438f5312b7a37c7ab6e7d72437

SHA256
05e1c6da9b7e4a33e586a1d88718fc95ea2b76d05826a2ed7a7dfc8cbc4bb8ac

SHA512
44bee51d4012d7da0b29f69ab2e4f2e5aed1d733e5fe17e56f4ef0e974227022b65b339389d15bfbe1641a9d8dc6d09d756cf2903220523d79d3e075af799ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\taltegr.exe

Filesize
1.2MB

MD5
ab6ecaac0444c9c6610edfeefeb59fe0

SHA1
508482528ab978438f5312b7a37c7ab6e7d72437

SHA256
05e1c6da9b7e4a33e586a1d88718fc95ea2b76d05826a2ed7a7dfc8cbc4bb8ac

SHA512
44bee51d4012d7da0b29f69ab2e4f2e5aed1d733e5fe17e56f4ef0e974227022b65b339389d15bfbe1641a9d8dc6d09d756cf2903220523d79d3e075af799ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\taltegr.exe

Filesize
1.2MB

MD5
ab6ecaac0444c9c6610edfeefeb59fe0

SHA1
508482528ab978438f5312b7a37c7ab6e7d72437

SHA256
05e1c6da9b7e4a33e586a1d88718fc95ea2b76d05826a2ed7a7dfc8cbc4bb8ac

SHA512
44bee51d4012d7da0b29f69ab2e4f2e5aed1d733e5fe17e56f4ef0e974227022b65b339389d15bfbe1641a9d8dc6d09d756cf2903220523d79d3e075af799ceb

Download Submit
memory/4912-135-0x0000000000000000-mapping.dmp

Download
memory/4988-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads