metasploit | fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

General

Target

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Size

227KB
MD5

1926d5d9eb5e4354f18083916de108f0
SHA1

f54ca406b5d189b19bdd2124c71660b921945cdb
SHA256

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020
SHA512

32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5
SSDEEP

3072:mq6zDsoY9iUeCRvRpR5RhD/HzkfVtLrNFSDg6w3x5VdO3huCFOnYit8aQ:mqKC9X/L/cVtLxthdGhvOf

Score

10^/10

metasploit backdoor evasion persistence trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\sysdiag64.exe = "C:\\Windows\\sysdiag64.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MicrosoftCorp = "C:\\Windows\\sysdiag64.exe"	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

Executes dropped EXE 2 IoCs

Processes:

sysdiag64.exesysdiag64.exe

pid process

692 sysdiag64.exe
804 sysdiag64.exe

pid	process
692	sysdiag64.exe
804	sysdiag64.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysdiag64.exe = "C:\\Windows\\sysdiag64.exe"	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftNAPC = "C:\\Windows\\sysdiag64.exe"	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

description	pid	process	target process
PID 1976 set thread context of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 692 set thread context of 804	692	sysdiag64.exe	sysdiag64.exe

Drops file in Windows directory 4 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

description	ioc	process
File created	C:\Windows\sysdiag64.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
File opened for modification	C:\Windows\sysdiag64.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
File opened for modification	C:\Windows\sysdiag64.exe	sysdiag64.exe
File created	C:\Windows\sysdiag64.exe	sysdiag64.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

268 reg.exe
1740 reg.exe
1964 reg.exe
1464 reg.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

pid process

1976 fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
692 sysdiag64.exe

pid	process
268	reg.exe
1740	reg.exe
1964	reg.exe
1464	reg.exe

pid	process
1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
692	sysdiag64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.execmd.execmd.exefdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exesysdiag64.exe

description	pid	process	target process
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1316	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1856	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	cmd.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1976 wrote to memory of 1116	1976	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1856 wrote to memory of 1740	1856	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1316 wrote to memory of 1964	1316	cmd.exe	reg.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 1116 wrote to memory of 692	1116	fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe	sysdiag64.exe
PID 692 wrote to memory of 1700	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1700	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1700	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1700	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1504	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1504	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1504	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 1504	692	sysdiag64.exe	cmd.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe
PID 692 wrote to memory of 804	692	sysdiag64.exe	sysdiag64.exe

C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
"C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe:*:Enabled:Windows Messanger" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe:*:Enabled:Windows Messanger" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1740

C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe
"C:\Users\Admin\AppData\Local\Temp\fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\sysdiag64.exe
"C:\Windows\sysdiag64.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
PID:1700

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\sysdiag64.exe" /t REG_SZ /d "C:\Windows\sysdiag64.exe:*:Enabled:Windows Messanger" /f
4⤵
PID:1504

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\sysdiag64.exe" /t REG_SZ /d "C:\Windows\sysdiag64.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:268

C:\Windows\sysdiag64.exe
"C:\Windows\sysdiag64.exe"
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\sysdiag64.exe
Filesize
227KB

MD5
1926d5d9eb5e4354f18083916de108f0

SHA1
f54ca406b5d189b19bdd2124c71660b921945cdb

SHA256
fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

SHA512
32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5

Download Submit
C:\Windows\sysdiag64.exe
Filesize
227KB

MD5
1926d5d9eb5e4354f18083916de108f0

SHA1
f54ca406b5d189b19bdd2124c71660b921945cdb

SHA256
fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

SHA512
32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5

Download Submit
C:\Windows\sysdiag64.exe
Filesize
227KB

MD5
1926d5d9eb5e4354f18083916de108f0

SHA1
f54ca406b5d189b19bdd2124c71660b921945cdb

SHA256
fdcf081b885009ff6ae21587989410a0c861f9f2e7acd2e11a544ccc2d899020

SHA512
32a58a5d68ac70f719f4fb86ed198171ae70c0f34e3d5b623722de7e407ed66caf2d19d37deb3d1590063f5bb1ae2911e4226739f0a33f9e5714479c8e7e3ae5

Download Submit
memory/268-110-0x0000000000000000-mapping.dmp

Download
memory/692-107-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/692-85-0x0000000000000000-mapping.dmp

Download
memory/804-116-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download
memory/804-115-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/804-114-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/804-113-0x0000000000230000-0x000000000026D000-memory.dmp

Filesize
244KB

Download
memory/804-102-0x000000000040AD48-mapping.dmp

Download
memory/1116-65-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-63-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-72-0x000000000040AD48-mapping.dmp

Download
memory/1116-75-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-112-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-111-0x00000000001C0000-0x00000000001FD000-memory.dmp

Filesize
244KB

Download
memory/1116-62-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-69-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-68-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-71-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1116-66-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1316-60-0x0000000000000000-mapping.dmp

Download
memory/1464-108-0x0000000000000000-mapping.dmp

Download
memory/1504-90-0x0000000000000000-mapping.dmp

Download
memory/1700-89-0x0000000000000000-mapping.dmp

Download
memory/1740-81-0x0000000000000000-mapping.dmp

Download
memory/1856-61-0x0000000000000000-mapping.dmp

Download
memory/1964-82-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1976-77-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1976-80-0x00000000001C0000-0x00000000001CD000-memory.dmp

Filesize
52KB

Download
memory/1976-59-0x00000000001C0000-0x00000000001FD000-memory.dmp

Filesize
244KB

Download
memory/1976-58-0x00000000001C0000-0x00000000001FD000-memory.dmp

Filesize
244KB

Download
memory/1976-55-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads