9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d

General

Target

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
Size

540KB
MD5

7e1fe97ad2bbe4694db516da79c34791
SHA1

faeb9e85135b7bc13d994f00f94b9285e962b39a
SHA256

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d
SHA512

3c1267dab94c1159d7339c65ecdb63c1792079fbe65527ed934b7ed11d39233bd8cd711aa1d93a30c118fbf15dba18f60cca54cfdc08ed95045b55d70debeeaf
SSDEEP

6144:lhLpD3Ave4QRZQBdU9rGhYCMxpLoZhVj3aUd5nrbHK7x+rZbMkN2PaWIZqbixxn5:lTcvhzU9ihYXxpUHVjfrjBrZok/V

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Cloud.exe

pid process

1536 Cloud.exe

pid	process
1536	Cloud.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2024-56-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2024-59-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2024-60-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2024-65-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe

pid	process
840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cloud = "C:\\Users\\Admin\\AppData\\Roaming\\Cloud\\Cloud.exe"	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe

description	pid	process	target process
PID 840 set thread context of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

344 DllHost.exe

pid	process
344	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exeCloud.exe

pid	process
840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
2024	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
1536	Cloud.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exeCloud.exe

description	pid	process	target process
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 2024	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
PID 840 wrote to memory of 1536	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	Cloud.exe
PID 840 wrote to memory of 1536	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	Cloud.exe
PID 840 wrote to memory of 1536	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	Cloud.exe
PID 840 wrote to memory of 1536	840	9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe	Cloud.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 848	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 912	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 776	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1540	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 1844	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 672	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 672	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 672	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 672	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 672	1536	Cloud.exe	iexplore.exe
PID 1536 wrote to memory of 672	1536	Cloud.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
"C:\Users\Admin\AppData\Local\Temp\9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe
"C:\Users\Admin\AppData\Local\Temp\9152f3ed68a535b62204bad2c7a88dc1028264bac3a4c3b28b33a3b89bb6418d.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:848

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:912

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1540

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1844

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1568

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1952

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1668

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1160

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1912

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1388

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1072

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:456

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1956

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1644

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1296

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1984

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1720

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1572

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1516

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:920

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1660

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1576

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1832

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1476

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1312

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1728

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:836

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1096

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:2044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1756

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1744

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:916

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1584

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1716

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1616

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1012

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:320

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:1468

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:564

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe"
3⤵
PID:688

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:344

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LFPLG46.jpg
Filesize
161KB

MD5
60370188ece426a5c6728cdd2016be9c

SHA1
c6fc16ba9e05e9f8f05b6ec33ac0b1f42bdfe88a

SHA256
06955da091df60466c7f92abd77ae8a40233147746fe82e37bd8c15b66cdfa3e

SHA512
d16b7617369631de09cb0fca486345e2884581bf0683d4390b1ab44ed17049ef54e4f31fa1cddd567ca9bc6726b5ca761ee9471a4e80a5f6ec2cd9e6cec71845

Download Submit
C:\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
\Users\Admin\AppData\Roaming\Cloud\Cloud.exe
Filesize
540KB

MD5
0b8a87bd741cd5e7a92294ff3aff1e0d

SHA1
717100cdd331da09032f3c9184d9df5c1b5805a1

SHA256
e4a9c66209dcb118c985c8b0b78d9eb030145c9cd84e73dca47f4986d6ae7c52

SHA512
8fd9f5afdabb21689f44fe3d9dac4b6280fe5dbecc01c94302ac384b02c2be707607479518dc6d8067ead9b06fbd623bf0b4751f0d3a4d260b83aaff1185b258

Download Submit
memory/1536-69-0x0000000000000000-mapping.dmp

Download
memory/2024-57-0x000000000042F670-mapping.dmp

Download
memory/2024-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2024-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2024-60-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2024-63-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/2024-65-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads