isrstealer | 9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
Size

1.0MB
MD5

749a7b99749d220936b95fb6e4132bd8
SHA1

8e518cc998d1fdf6978a9d283cc3f443fe87c8f0
SHA256

9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a
SHA512

75c63302c82e827272266049ac34da50f74e971ad7c48cbe53e580317c8af099c03ebe5911ee4255366823e29365d4db433d8ca458244330c14588c0073cfdc2
SSDEEP

24576:wfna/BVJI9Z+9zlmSzFpIS+1ASkw1okKIY2AyWuBAhE9QdB1d:wfuduKzlmSzFWS+10w1I3yWY3QL/

Score

10^/10

isrstealer collection evasion stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 14 IoCs

resource	yara_rule
behavioral2/memory/3808-147-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/3808-148-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3808-150-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3808-159-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4576-160-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/4576-172-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1932-173-0x0000000000000000-mapping.dmp	family_isrstealer
behavioral2/memory/1932-185-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3808-190-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4576-191-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1932-192-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/3808-213-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/4576-214-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1932-215-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	svchost.exe

NirSoft MailPassView 6 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4508-197-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4508-198-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4508-199-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4432-205-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/4432-206-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView
behavioral2/memory/1220-212-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/4508-197-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4508-198-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4508-199-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4432-205-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/4432-206-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft
behavioral2/memory/1220-212-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

Executes dropped EXE 1 IoCs

pid	Process
3368	EPmfcM.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2720-154-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2720-156-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2720-157-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2720-158-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3984-169-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3984-170-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3984-171-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/3804-184-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4508-194-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4508-196-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4508-197-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4508-198-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4508-199-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4432-205-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4432-206-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1220-212-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 3368 set thread context of 788	3368	EPmfcM.exe	83
PID 788 set thread context of 3808	788	svchost.exe	88
PID 3808 set thread context of 2720	3808	svchost.exe	89
PID 788 set thread context of 4576	788	svchost.exe	90
PID 4576 set thread context of 3984	4576	svchost.exe	91
PID 788 set thread context of 1932	788	svchost.exe	92
PID 1932 set thread context of 3804	1932	svchost.exe	93
PID 3808 set thread context of 4508	3808	svchost.exe	101
PID 4576 set thread context of 4432	4576	svchost.exe	102
PID 1932 set thread context of 1220	1932	svchost.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	EPmfcM.exe
3368	EPmfcM.exe
3368	EPmfcM.exe
3368	EPmfcM.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe
788	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe
Token: SeBackupPrivilege	788	svchost.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
788	svchost.exe
3808	svchost.exe
4576	svchost.exe
1932	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1448	3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe	80
PID 3564 wrote to memory of 1448	3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe	80
PID 3564 wrote to memory of 1448	3564	9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe	80
PID 1448 wrote to memory of 3368	1448	cmd.exe	82
PID 1448 wrote to memory of 3368	1448	cmd.exe	82
PID 1448 wrote to memory of 3368	1448	cmd.exe	82
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 3368 wrote to memory of 788	3368	EPmfcM.exe	83
PID 788 wrote to memory of 2692	788	svchost.exe	84
PID 788 wrote to memory of 2692	788	svchost.exe	84
PID 788 wrote to memory of 2692	788	svchost.exe	84
PID 788 wrote to memory of 2240	788	svchost.exe	85
PID 788 wrote to memory of 2240	788	svchost.exe	85
PID 788 wrote to memory of 2240	788	svchost.exe	85
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 788 wrote to memory of 3808	788	svchost.exe	88
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 3808 wrote to memory of 2720	3808	svchost.exe	89
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 788 wrote to memory of 4576	788	svchost.exe	90
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 4576 wrote to memory of 3984	4576	svchost.exe	91
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 788 wrote to memory of 1932	788	svchost.exe	92
PID 1932 wrote to memory of 3804	1932	svchost.exe	93
PID 1932 wrote to memory of 3804	1932	svchost.exe	93
PID 1932 wrote to memory of 3804	1932	svchost.exe	93
PID 1932 wrote to memory of 3804	1932	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe
"C:\Users\Admin\AppData\Local\Temp\9306afa147c0363389a99576425ab3ac0fcd73b32f60183f97104c104b896a9a.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\EPmfcM.exe GthbXZ
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\EPmfcM.exe
    C:\Users\Admin\AppData\Local\Temp\EPmfcM.exe GthbXZ
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\System32\svchost.exe"
      4⤵
      UAC bypass
      Windows security bypass
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:788
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn WindowsUpdategthbxz0x8429524
        5⤵
        
        PID:2692
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn WindowsUpdategthbxz0x8429525 /tr "C:\ProgramData\gthbxz\Project1.exe" /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:2240
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\SysWOW64\svchost.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3808
      - C:\Windows\SysWOW64\svchost.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\KVgSwxiMPF.ini"
        6⤵
        
        PID:2720
      - C:\Windows\SysWOW64\svchost.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\sANVyPI3jI.ini"
        6⤵
        Accesses Microsoft Outlook accounts
        
        PID:4508
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\SysWOW64\svchost.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4576
      - C:\Windows\SysWOW64\svchost.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\7mtiSXWN9h.ini"
        6⤵
        
        PID:3984
      - C:\Windows\SysWOW64\svchost.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\hHLfKw1wrR.ini"
        6⤵
        Accesses Microsoft Outlook accounts
        
        PID:4432
    - - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\SysWOW64\svchost.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1932
      - C:\Windows\SysWOW64\svchost.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\6w9odaaVk0.ini"
        6⤵
        
        PID:3804
      - C:\Windows\SysWOW64\svchost.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\gOhRS8dRL5.ini"
        6⤵
        Accesses Microsoft Outlook accounts
        
        PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6w9odaaVk0.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7mtiSXWN9h.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\EPmfcM.exe

Filesize
510KB

MD5
01d151ccd2a75bd713b8ce81d6509eb8

SHA1
c751680d504bece45dc84e363e9e976fe77a8eac

SHA256
a4d4dbf9e9124dbd055115706f2a2bfc8816b66cc5f52a148602f9fb0203b801

SHA512
8d49a4d97ef38fe5c6bb875d3bc387fade75f9a5d06a494b6a8c9d87840aa3d7cd87343e6aad268a27a9a33390bef7cd8e10d8ebe1df9f7d1ba6a68fe844107d

Download Submit
C:\Users\Admin\AppData\Local\Temp\EPmfcM.exe

Filesize
510KB

MD5
01d151ccd2a75bd713b8ce81d6509eb8

SHA1
c751680d504bece45dc84e363e9e976fe77a8eac

SHA256
a4d4dbf9e9124dbd055115706f2a2bfc8816b66cc5f52a148602f9fb0203b801

SHA512
8d49a4d97ef38fe5c6bb875d3bc387fade75f9a5d06a494b6a8c9d87840aa3d7cd87343e6aad268a27a9a33390bef7cd8e10d8ebe1df9f7d1ba6a68fe844107d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GthbXZ

Filesize
10KB

MD5
85dbd40256d09f3a5fd5fd7cbdf8db19

SHA1
3d5d0f17184725fde2d71ded94d4803b1aa89820

SHA256
0c0107fc5e33e565e7f809cbd8594fa32f3af60a9d653dea8dc0e5683b29bcc2

SHA512
0d525c604b52204ddb863106108fba43086b6a37c822a4683f71d7eaedff277af589aeb84cfc3fe1f05f54ef715d9758ce8ed52b6fa1b10e26074f8904e5657a

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVgSwxiMPF.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbZHJv.txt

Filesize
1.3MB

MD5
c97f91a4e75191206ba81d08b3ff2e26

SHA1
19c8a3a61a2577145d48f27caed911903bfe8704

SHA256
9564205a71241b9bd94c4d94d48f211fd09d85e82defeafc19f4b56824e50040

SHA512
01d761bd1c4a8430b86b029ea52cd42eab67cfbd0511c0da251bc8291c7c567360cab45c4188d3012a3fd897b9fb4a19d09a6aad01c42b422f0589594266738d

Download Submit
memory/788-139-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/788-141-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/788-144-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/788-188-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1220-212-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1932-215-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1932-185-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1932-192-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-157-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2720-156-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2720-158-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2720-154-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3804-184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3808-213-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3808-148-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3808-190-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3808-150-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3808-159-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3984-171-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3984-170-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3984-169-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4432-205-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4432-206-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4508-196-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4508-197-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4508-198-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4508-199-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4508-194-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4576-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4576-172-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4576-214-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download