amadey | 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c

Analysis

max time kernel
206s
max time network
211s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08/12/2022, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 322KB
Sample221208-lnrx2ahe82
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline socelars wosh collection infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.50

62.204.41.6/p9cWxH/index.php

Extracted

Family

socelars

https://hdbywe.s3.us-west-2.amazonaws.com/sauydga27/

Extracted

Family

redline

Botnet

wosh

31.41.244.14:4683

Attributes

auth_value
f0ec85e2aaa9e62929e2fb9e09d843f4

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 5 IoCs

resource	yara_rule
behavioral1/files/0x0006000000014145-73.dat	amadey_cred_module
behavioral1/files/0x0006000000014145-74.dat	amadey_cred_module
behavioral1/files/0x0006000000014145-75.dat	amadey_cred_module
behavioral1/files/0x0006000000014145-76.dat	amadey_cred_module
behavioral1/files/0x0006000000014145-77.dat	amadey_cred_module

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000013a17-78.dat	family_socelars
behavioral1/files/0x0007000000013a17-80.dat	family_socelars

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	836	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
856	gntuud.exe
804	mp3studios_97.exe
1624	gntuud.exe
1972	linda5.exe
568	gntuud.exe
1296	wish.exe

Loads dropped DLL 17 IoCs

pid	Process
2036	file.exe
2036	file.exe
836	rundll32.exe
836	rundll32.exe
836	rundll32.exe
836	rundll32.exe
856	gntuud.exe
856	gntuud.exe
1884	rundll32.exe
1884	rundll32.exe
1884	rundll32.exe
1884	rundll32.exe
1476	rundll32.exe
1476	rundll32.exe
1476	rundll32.exe
1476	rundll32.exe
856	gntuud.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\wish.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000067001\\wish.exe"	gntuud.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	mp3studios_97.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	mp3studios_97.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	mp3studios_97.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
560	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1256	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	mp3studios_97.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mp3studios_97.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mp3studios_97.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
836	rundll32.exe
836	rundll32.exe
836	rundll32.exe
836	rundll32.exe
568	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	804	mp3studios_97.exe
Token: SeAssignPrimaryTokenPrivilege	804	mp3studios_97.exe
Token: SeLockMemoryPrivilege	804	mp3studios_97.exe
Token: SeIncreaseQuotaPrivilege	804	mp3studios_97.exe
Token: SeMachineAccountPrivilege	804	mp3studios_97.exe
Token: SeTcbPrivilege	804	mp3studios_97.exe
Token: SeSecurityPrivilege	804	mp3studios_97.exe
Token: SeTakeOwnershipPrivilege	804	mp3studios_97.exe
Token: SeLoadDriverPrivilege	804	mp3studios_97.exe
Token: SeSystemProfilePrivilege	804	mp3studios_97.exe
Token: SeSystemtimePrivilege	804	mp3studios_97.exe
Token: SeProfSingleProcessPrivilege	804	mp3studios_97.exe
Token: SeIncBasePriorityPrivilege	804	mp3studios_97.exe
Token: SeCreatePagefilePrivilege	804	mp3studios_97.exe
Token: SeCreatePermanentPrivilege	804	mp3studios_97.exe
Token: SeBackupPrivilege	804	mp3studios_97.exe
Token: SeRestorePrivilege	804	mp3studios_97.exe
Token: SeShutdownPrivilege	804	mp3studios_97.exe
Token: SeDebugPrivilege	804	mp3studios_97.exe
Token: SeAuditPrivilege	804	mp3studios_97.exe
Token: SeSystemEnvironmentPrivilege	804	mp3studios_97.exe
Token: SeChangeNotifyPrivilege	804	mp3studios_97.exe
Token: SeRemoteShutdownPrivilege	804	mp3studios_97.exe
Token: SeUndockPrivilege	804	mp3studios_97.exe
Token: SeSyncAgentPrivilege	804	mp3studios_97.exe
Token: SeEnableDelegationPrivilege	804	mp3studios_97.exe
Token: SeManageVolumePrivilege	804	mp3studios_97.exe
Token: SeImpersonatePrivilege	804	mp3studios_97.exe
Token: SeCreateGlobalPrivilege	804	mp3studios_97.exe
Token: 31	804	mp3studios_97.exe
Token: 32	804	mp3studios_97.exe
Token: 33	804	mp3studios_97.exe
Token: 34	804	mp3studios_97.exe
Token: 35	804	mp3studios_97.exe
Token: SeDebugPrivilege	1256	taskkill.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe
1376	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 856	2036	file.exe	28
PID 2036 wrote to memory of 856	2036	file.exe	28
PID 2036 wrote to memory of 856	2036	file.exe	28
PID 2036 wrote to memory of 856	2036	file.exe	28
PID 856 wrote to memory of 560	856	gntuud.exe	29
PID 856 wrote to memory of 560	856	gntuud.exe	29
PID 856 wrote to memory of 560	856	gntuud.exe	29
PID 856 wrote to memory of 560	856	gntuud.exe	29
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 836	856	gntuud.exe	33
PID 856 wrote to memory of 804	856	gntuud.exe	35
PID 856 wrote to memory of 804	856	gntuud.exe	35
PID 856 wrote to memory of 804	856	gntuud.exe	35
PID 856 wrote to memory of 804	856	gntuud.exe	35
PID 1980 wrote to memory of 1624	1980	taskeng.exe	36
PID 1980 wrote to memory of 1624	1980	taskeng.exe	36
PID 1980 wrote to memory of 1624	1980	taskeng.exe	36
PID 1980 wrote to memory of 1624	1980	taskeng.exe	36
PID 856 wrote to memory of 1972	856	gntuud.exe	37
PID 856 wrote to memory of 1972	856	gntuud.exe	37
PID 856 wrote to memory of 1972	856	gntuud.exe	37
PID 856 wrote to memory of 1972	856	gntuud.exe	37
PID 1972 wrote to memory of 868	1972	linda5.exe	38
PID 1972 wrote to memory of 868	1972	linda5.exe	38
PID 1972 wrote to memory of 868	1972	linda5.exe	38
PID 1972 wrote to memory of 868	1972	linda5.exe	38
PID 868 wrote to memory of 1884	868	control.exe	39
PID 868 wrote to memory of 1884	868	control.exe	39
PID 868 wrote to memory of 1884	868	control.exe	39
PID 868 wrote to memory of 1884	868	control.exe	39
PID 868 wrote to memory of 1884	868	control.exe	39
PID 868 wrote to memory of 1884	868	control.exe	39
PID 868 wrote to memory of 1884	868	control.exe	39
PID 804 wrote to memory of 904	804	mp3studios_97.exe	40
PID 804 wrote to memory of 904	804	mp3studios_97.exe	40
PID 804 wrote to memory of 904	804	mp3studios_97.exe	40
PID 804 wrote to memory of 904	804	mp3studios_97.exe	40
PID 904 wrote to memory of 1256	904	cmd.exe	42
PID 904 wrote to memory of 1256	904	cmd.exe	42
PID 904 wrote to memory of 1256	904	cmd.exe	42
PID 904 wrote to memory of 1256	904	cmd.exe	42
PID 804 wrote to memory of 1376	804	mp3studios_97.exe	45
PID 804 wrote to memory of 1376	804	mp3studios_97.exe	45
PID 804 wrote to memory of 1376	804	mp3studios_97.exe	45
PID 804 wrote to memory of 1376	804	mp3studios_97.exe	45
PID 1884 wrote to memory of 1612	1884	rundll32.exe	46
PID 1884 wrote to memory of 1612	1884	rundll32.exe	46
PID 1884 wrote to memory of 1612	1884	rundll32.exe	46
PID 1884 wrote to memory of 1612	1884	rundll32.exe	46
PID 1376 wrote to memory of 1192	1376	chrome.exe	48
PID 1376 wrote to memory of 1192	1376	chrome.exe	48
PID 1376 wrote to memory of 1192	1376	chrome.exe	48
PID 1980 wrote to memory of 568	1980	taskeng.exe	47
PID 1980 wrote to memory of 568	1980	taskeng.exe	47
PID 1980 wrote to memory of 568	1980	taskeng.exe	47
PID 1980 wrote to memory of 568	1980	taskeng.exe	47
PID 1612 wrote to memory of 1476	1612	RunDll32.exe	49
PID 1612 wrote to memory of 1476	1612	RunDll32.exe	49
PID 1612 wrote to memory of 1476	1612	RunDll32.exe	49

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
  "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:560
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - outlook_win_path
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\1000058001\mp3studios_97.exe
    "C:\Users\Admin\AppData\Local\Temp\1000058001\mp3studios_97.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef61b4f50,0x7fef61b4f60,0x7fef61b4f70
        5⤵
        
        PID:1192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:2
        5⤵
        
        PID:668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1344 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1692 /prefetch:8
        5⤵
        
        PID:1056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
        5⤵
        
        PID:468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
        5⤵
        
        PID:2008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1
        5⤵
        
        PID:2144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,2281051039478266666,7916935619116677181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:8
        5⤵
        
        PID:2256
- - C:\Users\Admin\AppData\Local\Temp\1000061001\linda5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000061001\linda5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe" .\RPOVeHwN.i
      4⤵
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\RPOVeHwN.i
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1884
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\RPOVeHwN.i
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\RPOVeHwN.i
        7⤵
        Loads dropped DLL
        
        PID:1476
- - C:\Users\Admin\AppData\Local\Temp\1000067001\wish.exe
    "C:\Users\Admin\AppData\Local\Temp\1000067001\wish.exe"
    3⤵
    - Executes dropped EXE
    PID:1296

C:\Windows\system32\taskeng.exe
taskeng.exe {8C101457-1736-477A-99C2-117A6CB398CB} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
  C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
  C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
  2⤵
  - Executes dropped EXE
  PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.html

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png
Size 6KB
SHA256 9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5
MD5 c8d8c174df68910527edabe6b5278f06
SHA1 8ac53b3605fea693b59027b9b471202d150f266f
SHA512 d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c
SSDEEP 192:arFa6ynwcj6POoDbxN9EUQYZRia+ce/lkygkkl0:apa6mhjshD9QYZR3qkr/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js
Size 20KB
SHA256 b603288af8c0c473aea0f545e9276b92cdd9d551cf674ec83f3370f7bb3702c8
MD5 c89eb8da3f962abcdc4c2d830cfa151a
SHA1 3adf2c7855b1b8ac2316b7dfbae571caaade98e2
SHA512 1134104957d617a7945c50a218dfcc0e6fcd95cd520b73766b82e9b96ef063e405801b932dd18af2956064a686014567b063ae21a7eb70b1919ee682ac5fea1d
SSDEEP 384:TSE/+xHMJkLBQs44FPpv2459S5D9jJQCIb4j30EoqkTyReBd3FYGjowbN1Ta:Tl/+d6kLBQs44FPpv2459S5D9jJQCDrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js
Size 3KB
SHA256 f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c
MD5 f79618c53614380c5fdc545699afe890
SHA1 7804a4621cd9405b6def471f3ebedb07fb17e90a
SHA512 c4e0c4df6ac92351591859a7c4358b3dcd342e00051bf561e68e3fcc2c94fdd8d14bd0a042d88dca33f6c7e952938786378d804f56e84b4eab99e2a5fee96a4c
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json
Size 1KB
SHA256 66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333
MD5 6da6b303170ccfdca9d9e75abbfb59f3
SHA1 1a8070080f50a303f73eba253ba49c1e6d400df6
SHA512 872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 61KB
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
SSDEEP 1536:pvl2gmukMiArbge/oKIxf+Q9yNJLaRCfIElhUuDz:pvl2gmZhpehIxfJsJLawfIElhUu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 342B
SHA256 0efbfc2a0e480567be2d4e03797ea25894d5f13cb255bb1e595435f29a05e417
MD5 5663bc9845bc220b79df86eeb394a85b
SHA1 5f0a276dd2a0bc7590cd9fe748503317d5f174e2
SHA512 36d63ec5cdd742e5a3f6a4271997b532aab3c745275194255be26ede693ddcedd811697a8bf83d357fe5f12c356cf894a4ff0334c10cad5f565e0cd020d56d2d
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 10d0d3e33ba4b02a07c26b2a515f28614b730ea97190942dac1e95ea03144337
MD5 598f9d0965c6becf38715f71e5cb9c5b
SHA1 cd7c63ba482fac40508f13786fa91119c6dbd6c7
SHA512 140aab9d63febd67d4f7cadbef7b617d13470629289216d5e3beff6a126a3f9df792934bb0f1cb641c5ecde9d74768068e47a9f48e2d87849c42f3e350075ce9
SSDEEP 384:s6b8ZrtoLlIX21kXqKf/pUZNCgVLH2HfnmrUR9PT1TKSI:p88Lly21kXqKf/pUZNCgVLH2HfmrUbPM
MD5 SHA1 SHA512 SSDEEP

Submit Download

mp3studios_97.exe

Path C:\Users\Admin\AppData\Local\Temp\1000058001\mp3studios_97.exe
Size 1.4MB
SHA256 701d6ee60651a3a2a114d5de5ea924b0332b2db5f8f1c724a2867d5b3ab26df6
MD5 802ed5a1b8a19b73932b0906b5bf40d2
SHA1 1a76462888c0cd6bc7ee2cfb405ed93e1ff01dc3
SHA512 3e3c764d4cc3a839e7cfc1bd9d3c212b8dbd00c2dbdd3114c664ba44fb7106f0450e9a1f450936bfe809401986c7d341422eae449c33f706eda38c37d6765c77
SSDEEP 24576:yQpyBPGxrdclka3bP2WwgTKbgtD8rs1gPPKeFKqB8B:/pcEiKdaTmPPKecqWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

linda5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000061001\linda5.exe
Size 1.7MB
SHA256 d71c3d24232fb117ad57e3ab6ec1057ef8f74e7ab04691dfe9ec7b03a9a90f21
MD5 d878b43c10c4355a96a5d1a9a2288833
SHA1 8e9c6144dd972de55dfad174aeec9f53671396c8
SHA512 0324f6326cbdc4e0c43fd7434325f80b4dfb3061b7bab95d73329fd4de45346b4062e656d594bbcc7162fe8deaa567bc606e12df8672a4f79f6dd3ca1d500f92
SSDEEP 49152:908/RYiHm6C3ux+Vmk2A4C/o8Q3BuEaCZPCs9KrexAQHkf9O:e8/RTG/j0k2ADa8Ea+TjxAQHkfc
MD5 SHA1 SHA512 SSDEEP

Submit Download

linda5.exe

Path C:\Users\Admin\AppData\Local\Temp\1000061001\linda5.exe
Size 1.7MB
SHA256 d71c3d24232fb117ad57e3ab6ec1057ef8f74e7ab04691dfe9ec7b03a9a90f21
MD5 d878b43c10c4355a96a5d1a9a2288833
SHA1 8e9c6144dd972de55dfad174aeec9f53671396c8
SHA512 0324f6326cbdc4e0c43fd7434325f80b4dfb3061b7bab95d73329fd4de45346b4062e656d594bbcc7162fe8deaa567bc606e12df8672a4f79f6dd3ca1d500f92
SSDEEP 49152:908/RYiHm6C3ux+Vmk2A4C/o8Q3BuEaCZPCs9KrexAQHkf9O:e8/RTG/j0k2ADa8Ea+TjxAQHkfc
MD5 SHA1 SHA512 SSDEEP

Submit Download

wish.exe

Path C:\Users\Admin\AppData\Local\Temp\1000067001\wish.exe
Size 175KB
SHA256 4743bad8f6939aa7645a043208010c2a9e75fbbcbbc8ca597a0c2a74ce7b6cc0
MD5 3b6246132b7fb972ed877b79d700e32e
SHA1 af68ac119ccce9c7be5aeefa1e86102ee4019ebb
SHA512 03573c63e3d03d89d2a2971d761d33e8d89895680ae8b7e5ceb3a78c8582666f8a300aad4c6c4a7c1cd118ac774ffce03053c96a57df9e66a02773111dbcfcca
SSDEEP 3072:hxqZWBJaHEDgX1Ifef5FchQTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cj:TqZV1Iech
MD5 SHA1 SHA512 SSDEEP

Submit Download

wish.exe

Path C:\Users\Admin\AppData\Local\Temp\1000067001\wish.exe
Size 175KB
SHA256 4743bad8f6939aa7645a043208010c2a9e75fbbcbbc8ca597a0c2a74ce7b6cc0
MD5 3b6246132b7fb972ed877b79d700e32e
SHA1 af68ac119ccce9c7be5aeefa1e86102ee4019ebb
SHA512 03573c63e3d03d89d2a2971d761d33e8d89895680ae8b7e5ceb3a78c8582666f8a300aad4c6c4a7c1cd118ac774ffce03053c96a57df9e66a02773111dbcfcca
SSDEEP 3072:hxqZWBJaHEDgX1Ifef5FchQTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cj:TqZV1Iech
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Size 322KB
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Size 322KB
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Size 322KB
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Size 322KB
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

RPOVeHwN.i

Path C:\Users\Admin\AppData\Local\Temp\RPOVeHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 126KB
SHA256 62d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
MD5 98cc0f811ad5ff43fedc262961002498
SHA1 37e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA512 d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
SSDEEP 3072:ox7pOYzBekgmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhg/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mp3studios_97.exe

Path \Users\Admin\AppData\Local\Temp\1000058001\mp3studios_97.exe
Size 1.4MB
SHA256 701d6ee60651a3a2a114d5de5ea924b0332b2db5f8f1c724a2867d5b3ab26df6
MD5 802ed5a1b8a19b73932b0906b5bf40d2
SHA1 1a76462888c0cd6bc7ee2cfb405ed93e1ff01dc3
SHA512 3e3c764d4cc3a839e7cfc1bd9d3c212b8dbd00c2dbdd3114c664ba44fb7106f0450e9a1f450936bfe809401986c7d341422eae449c33f706eda38c37d6765c77
SSDEEP 24576:yQpyBPGxrdclka3bP2WwgTKbgtD8rs1gPPKeFKqB8B:/pcEiKdaTmPPKecqWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

linda5.exe

Path \Users\Admin\AppData\Local\Temp\1000061001\linda5.exe
Size 1.7MB
SHA256 d71c3d24232fb117ad57e3ab6ec1057ef8f74e7ab04691dfe9ec7b03a9a90f21
MD5 d878b43c10c4355a96a5d1a9a2288833
SHA1 8e9c6144dd972de55dfad174aeec9f53671396c8
SHA512 0324f6326cbdc4e0c43fd7434325f80b4dfb3061b7bab95d73329fd4de45346b4062e656d594bbcc7162fe8deaa567bc606e12df8672a4f79f6dd3ca1d500f92
SSDEEP 49152:908/RYiHm6C3ux+Vmk2A4C/o8Q3BuEaCZPCs9KrexAQHkf9O:e8/RTG/j0k2ADa8Ea+TjxAQHkfc
MD5 SHA1 SHA512 SSDEEP

Submit Download

wish.exe

Path \Users\Admin\AppData\Local\Temp\1000067001\wish.exe
Size 175KB
SHA256 4743bad8f6939aa7645a043208010c2a9e75fbbcbbc8ca597a0c2a74ce7b6cc0
MD5 3b6246132b7fb972ed877b79d700e32e
SHA1 af68ac119ccce9c7be5aeefa1e86102ee4019ebb
SHA512 03573c63e3d03d89d2a2971d761d33e8d89895680ae8b7e5ceb3a78c8582666f8a300aad4c6c4a7c1cd118ac774ffce03053c96a57df9e66a02773111dbcfcca
SSDEEP 3072:hxqZWBJaHEDgX1Ifef5FchQTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cj:TqZV1Iech
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path \Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Size 322KB
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gntuud.exe

Path \Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe
Size 322KB
SHA256 30320cd54d0d27e64b83c298c0dc740cff49b13e81dbb4d4bbe829100a0f9a0c
MD5 4ef27082f4fef520e5152fd0f87b90e4
SHA1 8dc00deaa470625f74fb91ac32a7eca50e4e3e58
SHA512 5f5a28ae4c9e6288cbec81be5367b28426735f69844e9165ddae6372213acd0d99f27a43b0886e2d9ff1de1f3126956800aa79f157770c57e05e5f0745f88142
SSDEEP 6144:nDPWRv2nyTcwb6IForILbDFjKyN85CL94mmcxm:nDPCeyTcM6korIjRKgLOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RpOveHwN.i

Path \Users\Admin\AppData\Local\Temp\RpOveHwN.i
Size 2.5MB
SHA256 4244c9c75f35016ce5b6336cea03bf613ca2421575bb41c37836c124a59c635d
MD5 5bc5b68c9beb673a0e1b4fe871335931
SHA1 d03b2e3e50c9e243d898984a35dd9aa4ea8e8284
SHA512 1eb5584fa9f8224ec27ba05fa365dff31d2947e00e1268ac4432b85a87614fb026cdd59d5e0607f772709aa17aa055c3c89f23b8bba253dd6c27b1a21c14362f
SSDEEP 24576:XpJRoi+kO+WWedoAIVdq2VRz3JeN+ee+HoEloXhneFPYjgSrFerY6BCF+DbSy:3RoaO+3AIi2VVhEloXpmQgSrEteIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 126KB
SHA256 62d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
MD5 98cc0f811ad5ff43fedc262961002498
SHA1 37e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA512 d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
SSDEEP 3072:ox7pOYzBekgmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhg/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 126KB
SHA256 62d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
MD5 98cc0f811ad5ff43fedc262961002498
SHA1 37e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA512 d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
SSDEEP 3072:ox7pOYzBekgmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhg/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 126KB
SHA256 62d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
MD5 98cc0f811ad5ff43fedc262961002498
SHA1 37e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA512 d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
SSDEEP 3072:ox7pOYzBekgmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhg/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 126KB
SHA256 62d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
MD5 98cc0f811ad5ff43fedc262961002498
SHA1 37e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA512 d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
SSDEEP 3072:ox7pOYzBekgmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhg/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/568-118-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/568-117-0x0000000000508000-0x0000000000527000-memory.dmp

Download

memory/568-115-0x0000000000508000-0x0000000000527000-memory.dmp

Download

memory/856-66-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/856-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/856-69-0x0000000000268000-0x0000000000287000-memory.dmp

Download

memory/856-63-0x0000000000268000-0x0000000000287000-memory.dmp

Download

memory/856-65-0x0000000000268000-0x0000000000287000-memory.dmp

Download

memory/1296-137-0x00000000001B0000-0x00000000001E2000-memory.dmp

Download

memory/1476-138-0x0000000002D60000-0x0000000002E42000-memory.dmp

Download

memory/1476-126-0x0000000002C10000-0x0000000002D59000-memory.dmp

Download

memory/1476-145-0x0000000001EC0000-0x0000000001F8B000-memory.dmp

Download

memory/1476-149-0x0000000002C10000-0x0000000002D59000-memory.dmp

Download

memory/1624-84-0x0000000000658000-0x0000000000677000-memory.dmp

Download

memory/1624-87-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1624-86-0x0000000000658000-0x0000000000677000-memory.dmp

Download

memory/1884-108-0x0000000002010000-0x0000000002C5A000-memory.dmp

Download

memory/1884-104-0x0000000002010000-0x0000000002C5A000-memory.dmp

Download

memory/1884-103-0x0000000002010000-0x0000000002C5A000-memory.dmp

Download

memory/1884-107-0x0000000002CD0000-0x0000000002DB2000-memory.dmp

Download

memory/1884-110-0x0000000002DC0000-0x0000000002E8B000-memory.dmp

Download

memory/1884-109-0x0000000002DC0000-0x0000000002E8B000-memory.dmp

Download

memory/2036-54-0x00000000002A8000-0x00000000002C7000-memory.dmp

Download

memory/2036-62-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2036-61-0x0000000000470000-0x00000000004AE000-memory.dmp

Download

memory/2036-60-0x00000000002A8000-0x00000000002C7000-memory.dmp

Download

memory/2036-55-0x0000000076941000-0x0000000076943000-memory.dmp

Download