66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb

Analysis

max time kernel
156s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Size

139KB
MD5

18cc754172c745277e88fdc13e96072f
SHA1

2c3b1419a4459e73a578bb2d4b4e975defa61537
SHA256

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb
SHA512

055e8df7c01a7cde696d335efa3af9fd3662a2055e11ff538b5ed0a9ac670249490de351b85907b13539aa77d645ca203fd0dc308ca9579647fe680bbf5c0508
SSDEEP

3072:XH+Mcv5JXXieDEtKeAU1y1W7rkD+bnAIhR7aN2:XHl0ndEttogkCAaRe0

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

Loads dropped DLL 24 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid	process
740	svchost.exe
740	svchost.exe
680	svchost.exe
680	svchost.exe
1472	svchost.exe
1472	svchost.exe
1728	svchost.exe
1728	svchost.exe
1356	svchost.exe
1356	svchost.exe
1544	svchost.exe
1544	svchost.exe
1328	svchost.exe
1328	svchost.exe
1144	svchost.exe
1144	svchost.exe
828	svchost.exe
828	svchost.exe
844	svchost.exe
844	svchost.exe
1216	svchost.exe
1216	svchost.exe
1884	svchost.exe
1884	svchost.exe

Drops file in System32 directory 14 IoCs

Processes:

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

pid process

1776 66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

pid	process
1776	66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe

C:\Users\Admin\AppData\Local\Temp\66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe
"C:\Users\Admin\AppData\Local\Temp\66e96f4bc4e91bb83a17f90bb109eae08fc0c3f381a980cb85c7ac85b1e32bfb.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1776

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1356

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
PID:1600

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1144

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:844

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1216

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
PID:1884

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\logonhours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\pcaudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\srservice.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\??\c:\windows\SysWOW64\wmdmpmsp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Irmon.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\LogonHours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\LogonHours.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Nla.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Ntmssvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\Nwsapagent.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\PCAudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\PCAudit.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\SRService.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\SRService.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\WmdmPmSp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\WmdmPmSp.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\helpsvc.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
\Windows\SysWOW64\uploadmgr.dll
Filesize
139KB

MD5
01b22039d925ce3ac4aeb07f74606796

SHA1
99b739cad3c023e7364d108b288a108e10a20982

SHA256
8c1b475735468cb2ef0d562438c2147203e4e70b40282c11f1cd083c48320217

SHA512
565f3bbc97f6171e07fba6a20ea90da24d9fd3e2d2d17cd29e841054947b63fdf67b57496fe329a164c94a5cb8c8afa7971a54bbe7b3a8faf6485f3ab199da5f

Download Submit
memory/680-67-0x00000000004F0000-0x0000000000513000-memory.dmp

Filesize
140KB

Download
memory/1776-63-0x0000000002140000-0x0000000006140000-memory.dmp

Filesize
64.0MB

Download
memory/1776-56-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1776-54-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1776-57-0x0000000000230000-0x0000000000253000-memory.dmp

Filesize
140KB

Download
memory/1776-58-0x0000000002140000-0x0000000006140000-memory.dmp

Filesize
64.0MB

Download
memory/1776-62-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1776-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1776-100-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads