cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58

General

Target

cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe
Size

436KB
MD5

9307c1d933f242e2b483e8c37cd6d49c
SHA1

61c96dfc060ea8aac688b9b69b40a47858661b99
SHA256

cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58
SHA512

93e6042867acc73e4b94917b74c7394c5209609ff9143e3b185dcd0865f35153dc4e574237180e28aa20746519401536479c82eca1811dbfaff72e030788ebc6
SSDEEP

12288:zFlXFVLHOHw9MD3CloTg/Qhdfo2WSsD/f8:z37X9MdcIheD/

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{7DEEA5F6-A6CD6665-F7F5ECB9-1E18D785}	cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{7DEEA5F6-A6CD6665-F7F5ECB9-1E18D785}\ = d7e6fe6fdf828198683486aa9fc036b994148bc4e6b5d5abb85956b085a5f4d8e7cb7abe685282b150dc0f8d3d3fefedc25f274d15a047bf9ad2370fa59dd4f37961efc34216c0740d24a394d9ba77a8d55a7b48e97e7b6cae40033f91edf81c6970031351c9b81c6f705d564f351d1733c5d918cb4ac119d7cff542f775b4b3a7b295de374cd5014ba761bab8a9550407ca05611bbb89d107bc252d57df757230a6c80a61b87faeedc280d0c27a076ef583e896c30bbe996cf09d65f017d1458cb480175ab576a8a5ff74d264b756953a7710aac4c73bca2961bb6f2edd62b0f0d05905cfe702fa90d700fa56d70b8a9966b4bbeb96260b94c13a482e62229e80726e193d0b53e1b9006b6a261974b39a567034566a85f8589308f64425d89bb509d8633116e3cac93fff6d924381d994f3392eabfce6af7b9d118fbf3d6dd3df41cda463273e9592f449a9ff7fd2ed07c3051e8732655e084c1ec2cc8f3d3d2fef5d5d4f8c22233e892cc4be45533bf169e8985b4f713d976f85dddbb0c9d5633416e68ac459dacbcefedc138f31426f98a2884f203dc26f78a2ab71e62fab1d2133ffa9927fff125200fe246df6bfdb2d36bf2aed469c6a0f211d0f0fddddccf01d21f33baea9e3430e36dc24f2e419270f655d6b733ee1d28c01de0f0d5d834fd6dd45b0071755c5f774aa9639c4d7a57a18900cfa00d0807c256c5bbfc952a400e60a35deebf2dee6cdb580a89c85b0646ea43b2a53ae243728906737b43dde6dfb9a4b615295c29aadbbff4aead48df1646f8cfcdbfe2ec3fc2c87c306ac51b49e594d773f952d87dfd5cdf7209a2271b89b2ff13ddb2fb6bd9b44760a9a38f012afb0626aa83fd86df49f950db87f551247b045535bf149d45b7709551fcbcda61c0a0ec6bc4a51a103e45997cb4586a835a12bc80101b7eb2ae118eb0cc1a0ac077f55edfb20ae74c25a56c8cab97eecec632101674f35fda790653f34ed1840c86a1ff84d95200788256337d99530079835f61764f51be789c57cfbeeaeddbd0c6c20426078a76c4a1c78f29211707f1b2d09c3c32e0642245e8a0c5efecc5223b171d82b89d943348664a574c82ad9d87409561bfa49d7bf7a2d10bf8ead42c3c816defa33efe1c2f0d7e7caba9f684de4a037a565c877dde5b0b8a4d4887a5cd08d01e09f8d323f582df63fa5ed1bffc9ed7fe392b6f76beaf97fe86d39c32bfeb96d6f5ffd8d10bfbe2dede34051e4775baa8979c7138a31472f95dd87cfc522eb0641a40c179e754debc39ef6f21560f73daa93878e9add7730659677f415583b332969a3a301490b00397c9792753e186c341de88fc7821ad1f608abbae6102540dbfc8e6e9da3703eac9280f91c948c04e0e45c8b0f9e7d4dd35fb64d1a23c8f98328e6600576cb24d9e43405142b7a6190a37449157f4b92d9717423d8017713e5f174e3d8064bd481bb17d1b54b9b26894443a461548c0b83012e1ba2f18f2882261f9acd76bcea9221b64b1a6188fbbed6923540db788e6add270c3580ebc8069d6a0c463e0b6c0180e7480a7a5e500d05e3074e35a2d7083a7c502f42fd09103b7c112fc7ddca703964efd6fdbb1029f8039531c7db3ac9eee7839aa171bf9f2d8de3c369267bfa96af4b9d418f8f3d9dd3cf7902a8f6c1a5d4d7b5459b2849628090c14ca83d1c6ff2fd56508b84fed6d3c4b6569a354e5762c58778ba9629c4e3ab665e74f2961744b556e7b5759428c586045bb6f11a180876002bf6e11b44494a5ffecd93bc01eecb0379e15394c1c6882b3dc113e801c393ee06c3748e2a9ca68c4a7ce6af35a2a7ef1ae24e49023be0513bb46955473b0529f7e32ac15eeb0cbefe93527648aab9de548d761caacea6bdfaafd0bdbd2facfd416f437db1d3a3f90157a745d58447871adab637aba5c637cb65a638ba9296bf0ad2e60f9bbdb62f557d47ef95a2b72f25fde76c75a09410f94c902100cf0e025c1e8d723c6e901dc3f34e26fc2a2d587f74122980e78d1adc36336aa9871f6a4d401cb6f29a590877b8e5eae45e45333791554884d86b35195b333621eacf2722251e87726558280a7ce6ae6a1ca78c1ae0768b141ecacc46bf95ad3843568e049d94cc48e1fc54ee363d9a1376b91b687124976a05e6bbb5e9d8470fd5bd04ef8a7ddfd37206d66435769b24c9e647250a3b86918b4886002b3c8112d888b718557684eabba12ed8827791e5f474e7a48a36809458b876a85a58708962dc788d2d6323c931e797457a38e86ee3a20656ea44f84a297edf6cf21f21cd0b3c796e571d0a8f2082da89373865d6284b9a418fffa29251c8bb3be9d184b079ae93bcb912d3b80eaedcfcf1ec1062345ea48d7a80d635cadb218ef7dcda700fe6dd3bf3a9d938f72ed57cb852a9c8bce7111ac3f09ea3f28e2fbdbd6cec5c418c237ea92d7f5fedcd20bc94d0f74a9a1f484de4bf2b2d819fdc8d73c319064bd4c18b94d9f7731a26c874c6982b08c1a298b0f69c1b4eb1a3e0fe9f930d3923d3398eafc35d4e0c1c1cb2f05e1d0d331f590d739f1e32325e1e0cf2a0ef92e2c6c91bb8c954a08bb4e6a8cb5a4689549ccaf1a720d58a08d8c6b78b2a8106af0a5de08cf7c32af6fe65ec2b2199dfb7b2e5982448c464b997af7a5d508c86ddb4f0e49f378d9543f879a96b5b418e53fd0eac1c3eccd2fd40ec97e10a9c9e4ccddc603104576645ca37b9d51408f6049b74b1985374be2993033e19acf781eaf0c125f0d7ab8a99e7b70a65a698dab3b1166884e2851994b707e5c547643ab6a8d46187e36a3ebe6c925cc6ced483b926503afa28d79c7a731011704fab821e5fb24dd7637a31e8d34106e3642e3abc962c7a5ed6330591677c35ee9b034949243c74aed6638bd1f9fc2c6fbe3dd3af4ebd02d3ae0ea2bcee11dc774cd5238491ca782128c3469eb58c144276482abbfe562d7a1f968db45ce8f0dcd14c3460289d9a70701e174c05e2d7893a3850123b00d1ae3c1d124f781d6af32726e50a445e664caa3eb8d2d63f352d975ffa4d69c31fc64d15df07b2452998fb739621f42b27f9d5d3b406da047088193f772dd55fb84d2ac3fefe931386c9bbe72ef5dc98718f6fa2bd616f4f229d0073cc1e3f322de8a3c511e447dbd58e4ba2a6b6c564c8769f6a8d27a305690b47b9456c77c01a33c859070c75a05753c5c1c72475a828da60b7865a1af088e9bc40ae0e3c82d07ebd13ac09a1e32c3ebe12d34e8ea3220e389c528d4ebc3d512f7f1dadf3a3de31f3e7eebaa3a979a09431c5eba87e786cecdc1d8fb33dde134d41df637216e0f42f27bd15d377499a38495427ba2510274c95c04baf1ee20c6f3c1dd08fcb9d06b30a6980a010cd0ca05e388de87c6412ab06c61af5c868de7accaee09caf0ea2e259bf8fd2bd7f132df1436fa67d15ac47a3d5c644dbba8eee7cfcec9321b65b9b710eeba28697f4fa6ae9f87c6e6c838206788450bb89ae641d74cf9a428e6e229ce04e6e039d11cccfa1e217c905a43b96d184ff2612e408a75cca707fe6eda53c3b90d108bc1cd3704ea5fc241376b924efea7d58d38d41fcb8ad2f635de9333cd16e7f229290cf88a2fe6e2dfca32dc67f456d2b23b9d99734b51857	cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{7DEEA5F6-A6CD6665-F7F5ECB9-1E18D785}\ = e93d9fc6df828198683486aa9fc036b994148bc4e6b5d5abb85956b085a5f4d8e7cb7abe685282b150dc0f8d3d3fefedc25f274d15a047bf9ad2370fa59dd4f37961efc34216c0740d24a394d9ba77a8d55a7b48e97e7b6cae40033f91edf81c6970031351c9b81c6f705d564f351d1733c5d918cb4ac119d7cff542f775b4b3a7b295de374cd5014ba761bab8a9550407ca05611bbb89d107bc252d57df757230a6c80a61b87faeedc280d0c27a076ef583e896c30bbe996cf09d65f017d1458cb480175ab576a8a5ff74d264b756953a7710aac4c73bca2961bb6f2edd62b0f0d05905cfe702fa90d700fa56d70b8a9966b4bbeb96260b94c13a482e62229e80726e193d0b53e1b9006b6a261974b39a567034566a85f8589308f64425d89bb509d8633116e3cac93fff6d924381d994f3392eabfce6af7b9d118fbf3d6dd3df41cda463273e9592f449a9ff7fd2ed07c3051e8732655e084c1ec2cc8f3d3d2fef5d5d4f8c22233e892cc4be45533bf169e8985b4f713d976f85dddbb0c9d5633416e68ac459dacbcefedc138f31426f98a2884f203dc26f78a2ab71e62fab1d2133ffa9927fff125200fe246df6bfdb2d36bf2aed469c6a0f211d0f0fddddccf01d21f33baea9e3430e36dc24f2e419270f655d6b733ee1d28c01de0f0d5d834fd6dd45b0071755c5f774aa9639c4d7a57a18900cfa00d0807c256c5bbfc952a400e60a35deebf2dee6cdb580a89c85b0646ea4774b55ae243728906737b43dde6dfb9a4b615295c29aadbbff4aead48df1646f8cfcdbfe2ec3fc2c87c306ac51b49e594d773f952d87dfd5cdf7209a2271b89b2ff13ddb2fb6bd9b44760a9a38f012afb0626aa83fd86df49f950db87f551247b045535bf149d45b7709551fcbcda61c0a0ec6bc4a51a103e45997cb4586a835a12bc80101b7eb2ae118eb0cc1a0ac077f55edfb20ae74c25a56c8cab97eecec632101674f35fda790653f34ed1840c86a1ff84d95200788256337d99530079835f61764f51be789c57cfbeeaeddbd0c6c20426078a76c4a1c78f29211707f1b2d09c3c32e0642245e8a0c5efecc5223b171d82b89d943348664a574c82ad9d87409561bfa49d7bf7a2d10bf8ead42c3c816defa33efe1c2f0d7e7caba9f684de4a037a565c877dde5b0b8a4d4887a5cd08d01e09f8d323f582df63fa5ed1bffc9ed7fe392b6f76beaf97fe86d39c32bfeb96d6f5ffd8d10bfbe2dede34051e4775baa8979c7138a31472f95dd87cfc522eb0641a40c179e754debc39ef6f21560f73daa93878e9add7730659677f415583b332969a3a301490b00397c9792753e186c341de88fc7821ad1f608abbae6102540dbfc8e6e9da3703eac9280f91c948c04e0e45c8b0f9e7d4dd35fb64d1a23c8f98328e6600576cb24d9e43405142b7a6190a37449157f4b92d9717423d8017713e5f174e3d8064bd481bb17d1b54b9b26894443a461548c0b83012e1ba2f18f2882261f9acd76bcea9221b64b1a6188fbbed6923540db788e6add270c3580ebc8069d6a0c463e0b6c0180e7480a7a5e500d05e3074e35a2d7083a7c502f42fd09103b7c112fc7ddca703964efd6fdbb1029f8039531c7db3ac9eee7839aa171bf9f2d8de3c369267bfa96af4b9d418f8f3d9dd3cf7902a8f6c1a5d4d7b5459b2849628090c14ca83d1c6ff2fd56508b84fed6d3c4b6569a354e5762c58778ba9629c4e3ab665e74f2961744b556e7b5759428c586045bb6f11a180876002bf6e11b44494a5ffecd93bc01eecb0379e15394c1c6882b3dc113e801c393ee06c3748e2a9ca68c4a7ce6af35a2a7ef1ae24e49023be0513bb46955473b0529f7e32ac15eeb0cbefe93527648aab9de548d761caacea6bdfaafd0bdbd2facfd416f437db1d3a3f90157a745d58447871adab637aba5c637cb65a638ba9296bf0ad2e60f9bbdb62f557d47ef95a2b72f25fde76c75a09410f94c902100cf0e025c1e8d723c6e901dc3f34e26fc2a2d587f74122980e78d1adc36336aa9871f6a4d401cb6f29a590877b8e5eae45e45333791554884d86b35195b333621eacf2722251e87726558280a7ce6ae6a1ca78c1ae0768b141ecacc46bf95ad3843568e049d94cc48e1fc54ee363d9a1376b91b687124976a05e6bbb5e9d8470fd5bd04ef8a7ddfd37206d66435769b24c9e647250a3b86918b4886002b3c8112d888b718557684eabba12ed8827791e5f474e7a48a36809458b876a85a58708962dc788d2d6323c931e797457a38e86ee3a20656ea44f84a297edf6cf21f21cd0b3c796e571d0a8f2082da89373865d6284b9a418fffa29251c8bb3be9d184b079ae93bcb912d3b80eaedcfcf1ec1062345ea48d7a80d635cadb218ef7dcda700fe6dd3bf3a9d938f72ed57cb852a9c8bce7111ac3f09ea3f28e2fbdbd6cec5c418c237ea92d7f5fedcd20bc94d0f74a9a1f484de4bf2b2d819fdc8d73c319064bd4c18b94d9f7731a26c874c6982b08c1a298b0f69c1b4eb1a3e0fe9f930d3923d3398eafc35d4e0c1c1cb2f05e1d0d331f590d739f1e32325e1e0cf2a0ef92e2c6c91bb8c954a08bb4e6a8cb5a4689549ccaf1a720d58a08d8c6b78b2a8106af0a5de08cf7c32af6fe65ec2b2199dfb7b2e5982448c464b997af7a5d508c86ddb4f0e49f378d9543f879a96b5b418e53fd0eac1c3eccd2fd40ec97e10a9c9e4ccddc603104576645ca37b9d51408f6049b74b1985374be2993033e19acf781eaf0c125f0d7ab8a99e7b70a65a698dab3b1166884e2851994b707e5c547643ab6a8d46187e36a3ebe6c925cc6ced483b926503afa28d79c7a731011704fab821e5fb24dd7637a31e8d34106e3642e3abc962c7a5ed6330591677c35ee9b034949243c74aed6638bd1f9fc2c6fbe3dd3af4ebd02d3ae0ea2bcee11dc774cd5238491ca782128c3469eb58c144276482abbfe562d7a1f968db45ce8f0dcd14c3460289d9a70701e174c05e2d7893a3850123b00d1ae3c1d124f781d6af32726e50a445e664caa3eb8d2d63f352d975ffa4d69c31fc64d15df07b2452998fb739621f42b27f9d5d3b406da047088193f772dd55fb84d2ac3fefe931386c9bbe72ef5dc98718f6fa2bd616f4f229d0073cc1e3f322de8a3c511e447dbd58e4ba2a6b6c564c8769f6a8d27a305690b47b9456c77c01a33c859070c75a05753c5c1c72475a828da60b7865a1af088e9bc40ae0e3c82d07ebd13ac09a1e32c3ebe12d34e8ea3220e389c528d4ebc3d512f7f1dadf3a3de31f3e7eebaa3a979a09431c5eba87e786cecdc1d8fb33dde134d41df637216e0f42f27bd15d377499a38495427ba2510274c95c04baf1ee20c6f3c1dd08fcb9d06b30a6980a010cd0ca05e388de87c6412ab06c61af5c868de7accaee09caf0ea2e259bf8fd2bd7f132df1436fa67d15ac47a3d5c644dbba8eee7cfcec9321b65b9b710eeba28697f4fa6ae9f87c6e6c838206788450bb89ae641d74cf9a428e6e229ce04e6e039d11cccfa1e217c905a43b96d184ff2612e408a75cca707fe6eda53c3b90d108bc1cd3704ea5fc241376b924efea7d58d38d41fcb8ad2f635de9333cd16e7f229290cf88a2fe6e2dfca32dc67f456d2b23b9d99734b51857	cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{7DEEA5F6-A6CD6665-F7F5ECB9-1E18D785}\ = 9a3112bedf828198683486aa9fc036b994148bc4e6b5d5abb85956b085a5f4d8e7cb7abe685282b150dc0f8d3d3fefedc25f274d15a047bf9ad2370fa59dd4f37961efc34216c0740d24a394d9ba77a8d55a7b48e97e7b6cae40033f91edf81c6970031351c9b81c6f705d564f351d1733c5d918cb4ac119d7cff542f775b4b3a7b295de374cd5014ba761bab8a9550407ca05611bbb89d107bc252d57df757237a6c80a61b87faeedc280d0c27a076ef583e896c30bbe996cf09d65f017d1458cb480175ab576a8a5ff74d264b756953a7710aac4c73bca2961bb6f2edd62b0f0d05905cfe702fa90d700fa56d70b8a9966b4bbeb96260b94c13a482e62229e80726e193d0b53e1b9006b6a261974b39a567034566a85f8589308f64425d89bb509d8633116e3cac93fff6d924381d994f3392eabfce6af7b9d118fbf3d6dd3df41cda463273e9592f449a9ff7fd2ed07c3051e8732655e084c1ec2cc8f3d3d2fef5d5d4f8c22233e892cc4be45533bf169e8985b4f713d976f85dddbb0c9d5633416e68ac459dacbcefedc138f31426f98a2884f203dc26f78a2ab71e62fab1d2133ffa9927fff125200fe246df6bfdb2d36bf2aed469c6a0f211d0f0fddddccf01d21f33baea9e3430e36dc24f2e419270f655d6b733ee1d28c01de0f0d5d834fd6dd45b0071755c5f774aa9639c4d7a57a18900cfa00d0807c256c5bbfc952a400e60a35deebf2dee6cdb580a89c85b0646ea4774b55ae243728906737b43dde6dfb9a4b615295c29aadbbff4aead48df1646f8cfcdbfe2ec3fc2c87c306ac51b49e594d773f952d87dfd5cdf7209a2271b89b2ff13ddb2fb6bd9b44760a9a38f012afb0626aa83fd86df49f950db87f551247b045535bf149d45b7709551fcbcda61c0a0ec6bc4a51a103e45997cb4586a835a12bc80101b7eb2ae118eb0cc1a0ac077f55edfb20ae74c25a56c8cab97eecec632101674f35fda790653f34ed1840c86a1ff84d95200788256337d99530079835f61764f51be789c57cfbeeaeddbd0c6c20426078a76c4a1c78f29211707f1b2d09c3c32e0642245e8a0c5efecc5223b171d82b89d943348664a574c82ad9d87409561bfa49d7bf7a2d10bf8ead42c3c816defa33efe1c2f0d7e7caba9f684de4a037a565c877dde5b0b8a4d4887a5cd08d01e09f8d323f582df63fa5ed1bffc9ed7fe392b6f76beaf97fe86d39c32bfeb96d6f5ffd8d10bfbe2dede34051e4775baa8979c7138a31472f95dd87cfc522eb0641a40c179e754debc39ef6f21560f73daa93878e9add7730659677f415583b332969a3a301490b00397c9792753e186c341de88fc7821ad1f608abbae6102540dbfc8e6e9da3703eac9280f91c948c04e0e45c8b0f9e7d4dd35fb64d1a23c8f98328e6600576cb24d9e43405142b7a6190a37449157f4b92d9717423d8017713e5f174e3d8064bd481bb17d1b54b9b26894443a461548c0b83012e1ba2f18f2882261f9acd76bcea9221b64b1a6188fbbed6923540db788e6add270c3580ebc8069d6a0c463e0b6c0180e7480a7a5e500d05e3074e35a2d7083a7c502f42fd09103b7c112fc7ddca703964efd6fdbb1029f8039531c7db3ac9eee7839aa171bf9f2d8de3c369267bfa96af4b9d418f8f3d9dd3cf7902a8f6c1a5d4d7b5459b2849628090c14ca83d1c6ff2fd56508b84fed6d3c4b6569a354e5762c58778ba9629c4e3ab665e74f2961744b556e7b5759428c586045bb6f11a180876002bf6e11b44494a5ffecd93bc01eecb0379e15394c1c6882b3dc113e801c393ee06c3748e2a9ca68c4a7ce6af35a2a7ef1ae24e49023be0513bb46955473b0529f7e32ac15eeb0cbefe93527648aab9de548d761caacea6bdfaafd0bdbd2facfd416f437db1d3a3f90157a745d58447871adab637aba5c637cb65a638ba9296bf0ad2e60f9bbdb62f557d47ef95a2b72f25fde76c75a09410f94c902100cf0e025c1e8d723c6e901dc3f34e26fc2a2d587f74122980e78d1adc36336aa9871f6a4d401cb6f29a590877b8e5eae45e45333791554884d86b35195b333621eacf2722251e87726558280a7ce6ae6a1ca78c1ae0768b141ecacc46bf95ad3843568e049d94cc48e1fc54ee363d9a1376b91b687124976a05e6bbb5e9d8470fd5bd04ef8a7ddfd37206d66435769b24c9e647250a3b86918b4886002b3c8112d888b718557684eabba12ed8827791e5f474e7a48a36809458b876a85a58708962dc788d2d6323c931e797457a38e86ee3a20656ea44f84a297edf6cf21f21cd0b3c796e571d0a8f2082da89373865d6284b9a418fffa29251c8bb3be9d184b079ae93bcb912d3b80eaedcfcf1ec1062345ea48d7a80d635cadb218ef7dcda700fe6dd3bf3a9d938f72ed57cb852a9c8bce7111ac3f09ea3f28e2fbdbd6cec5c418c237ea92d7f5fedcd20bc94d0f74a9a1f484de4bf2b2d819fdc8d73c319064bd4c18b94d9f7731a26c874c6982b08c1a298b0f69c1b4eb1a3e0fe9f930d3923d3398eafc35d4e0c1c1cb2f05e1d0d331f590d739f1e32325e1e0cf2a0ef92e2c6c91bb8c954a08bb4e6a8cb5a4689549ccaf1a720d58a08d8c6b78b2a8106af0a5de08cf7c32af6fe65ec2b2199dfb7b2e5982448c464b997af7a5d508c86ddb4f0e49f378d9543f879a96b5b418e53fd0eac1c3eccd2fd40ec97e10a9c9e4ccddc603104576645ca37b9d51408f6049b74b1985374be2993033e19acf781eaf0c125f0d7ab8a99e7b70a65a698dab3b1166884e2851994b707e5c547643ab6a8d46187e36a3ebe6c925cc6ced483b926503afa28d79c7a731011704fab821e5fb24dd7637a31e8d34106e3642e3abc962c7a5ed6330591677c35ee9b034949243c74aed6638bd1f9fc2c6fbe3dd3af4ebd02d3ae0ea2bcee11dc774cd5238491ca782128c3469eb58c144276482abbfe562d7a1f968db45ce8f0dcd14c3460289d9a70701e174c05e2d7893a3850123b00d1ae3c1d124f781d6af32726e50a445e664caa3eb8d2d63f352d975ffa4d69c31fc64d15df07b2452998fb739621f42b27f9d5d3b406da047088193f772dd55fb84d2ac3fefe931386c9bbe72ef5dc98718f6fa2bd616f4f229d0073cc1e3f322de8a3c511e447dbd58e4ba2a6b6c564c8769f6a8d27a305690b47b9456c77c01a33c859070c75a05753c5c1c72475a828da60b7865a1af088e9bc40ae0e3c82d07ebd13ac09a1e32c3ebe12d34e8ea3220e389c528d4ebc3d512f7f1dadf3a3de31f3e7eebaa3a979a09431c5eba87e786cecdc1d8fb33dde134d41df637216e0f42f27bd15d377499a38495427ba2510274c95c04baf1ee20c6f3c1dd08fcb9d06b30a6980a010cd0ca05e388de87c6412ab06c61af5c868de7accaee09caf0ea2e259bf8fd2bd7f132df1436fa67d15ac47a3d5c644dbba8eee7cfcec9321b65b9b710eeba28697f4fa6ae9f87c6e6c838206788450bb89ae641d74cf9a428e6e229ce04e6e039d11cccfa1e217c905a43b96d184ff2612e408a75cca707fe6eda53c3b90d108bc1cd3704ea5fc241376b924efea7d58d38d41fcb8ad2f635de9333cd16e7f229290cf88a2fe6e2dfca32dc67f456d2b23b9d99734b51857	cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe

C:\Users\Admin\AppData\Local\Temp\cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe
"C:\Users\Admin\AppData\Local\Temp\cb83dfd77b8b7cc18031615947d783a0fb1294acb3a17cd48f67acb7fee6bf58.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3444-132-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing