snakekeylogger | 1b4322eaa16e3d5e78993498dce2b9e3823bf553055039d328155e1b4f6df00a

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHK04567000987654567890000000009879.exe
Size 663KB
Sample221229-x9h3sshb9z
SHA256 1b4322eaa16e3d5e78993498dce2b9e3823bf553055039d328155e1b4f6df00a
MD5 807a4ab93574aee9637e3be4c181046b
SHA1 1529f1106ad9041daf04794114f80892cd65ccca
SHA512 77d2e5b7e037c4a5054e282685a2d5f68176321c36e16e697251998bceb0db7b18e003d74ba5997c218026e0b51ac73eb825a990d20a8a3e6803b7ab2ceac081
SSDEEP 12288:GENN+T5xYrllrU7QY6BYqC5fGLctSfIxx6Bqcx4WWHt:K5xolYQY6BYNGLOtxQbKt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection evasion keylogger persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/1344-185-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 8 IoCs

pid	Process
4824	shk04567000987654567890000000009879.exe
4744	cotcmgemj.exe
3220	icsys.icn.exe
3468	explorer.exe
4632	spoolsv.exe
1136	svchost.exe
3052	spoolsv.exe
1344	cotcmgemj.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cotcmgemj.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cotcmgemj.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cotcmgemj.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 1344	4744	cotcmgemj.exe	89

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3220	icsys.icn.exe
3220	icsys.icn.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
1136	svchost.exe
1136	svchost.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
1136	svchost.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
1136	svchost.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
1136	svchost.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
1136	svchost.exe
3468	explorer.exe
3468	explorer.exe
3468	explorer.exe
1136	svchost.exe
3468	explorer.exe
1136	svchost.exe
1344	cotcmgemj.exe
3468	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3468	explorer.exe
1136	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4744	cotcmgemj.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	cotcmgemj.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4872	SHK04567000987654567890000000009879.exe
4872	SHK04567000987654567890000000009879.exe
3220	icsys.icn.exe
3220	icsys.icn.exe
3468	explorer.exe
3468	explorer.exe
4632	spoolsv.exe
4632	spoolsv.exe
1136	svchost.exe
1136	svchost.exe
3052	spoolsv.exe
3052	spoolsv.exe
3468	explorer.exe
3468	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4824	4872	SHK04567000987654567890000000009879.exe	79
PID 4872 wrote to memory of 4824	4872	SHK04567000987654567890000000009879.exe	79
PID 4872 wrote to memory of 4824	4872	SHK04567000987654567890000000009879.exe	79
PID 4824 wrote to memory of 4744	4824	shk04567000987654567890000000009879.exe	80
PID 4824 wrote to memory of 4744	4824	shk04567000987654567890000000009879.exe	80
PID 4824 wrote to memory of 4744	4824	shk04567000987654567890000000009879.exe	80
PID 4872 wrote to memory of 3220	4872	SHK04567000987654567890000000009879.exe	82
PID 4872 wrote to memory of 3220	4872	SHK04567000987654567890000000009879.exe	82
PID 4872 wrote to memory of 3220	4872	SHK04567000987654567890000000009879.exe	82
PID 3220 wrote to memory of 3468	3220	icsys.icn.exe	83
PID 3220 wrote to memory of 3468	3220	icsys.icn.exe	83
PID 3220 wrote to memory of 3468	3220	icsys.icn.exe	83
PID 3468 wrote to memory of 4632	3468	explorer.exe	84
PID 3468 wrote to memory of 4632	3468	explorer.exe	84
PID 3468 wrote to memory of 4632	3468	explorer.exe	84
PID 4632 wrote to memory of 1136	4632	spoolsv.exe	85
PID 4632 wrote to memory of 1136	4632	spoolsv.exe	85
PID 4632 wrote to memory of 1136	4632	spoolsv.exe	85
PID 1136 wrote to memory of 3052	1136	svchost.exe	86
PID 1136 wrote to memory of 3052	1136	svchost.exe	86
PID 1136 wrote to memory of 3052	1136	svchost.exe	86
PID 1136 wrote to memory of 2128	1136	svchost.exe	87
PID 1136 wrote to memory of 2128	1136	svchost.exe	87
PID 1136 wrote to memory of 2128	1136	svchost.exe	87
PID 4744 wrote to memory of 1344	4744	cotcmgemj.exe	89
PID 4744 wrote to memory of 1344	4744	cotcmgemj.exe	89
PID 4744 wrote to memory of 1344	4744	cotcmgemj.exe	89
PID 4744 wrote to memory of 1344	4744	cotcmgemj.exe	89
PID 1136 wrote to memory of 2896	1136	svchost.exe	97
PID 1136 wrote to memory of 2896	1136	svchost.exe	97
PID 1136 wrote to memory of 2896	1136	svchost.exe	97
PID 1136 wrote to memory of 2180	1136	svchost.exe	99
PID 1136 wrote to memory of 2180	1136	svchost.exe	99
PID 1136 wrote to memory of 2180	1136	svchost.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cotcmgemj.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cotcmgemj.exe

C:\Users\Admin\AppData\Local\Temp\SHK04567000987654567890000000009879.exe
"C:\Users\Admin\AppData\Local\Temp\SHK04567000987654567890000000009879.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- \??\c:\users\admin\appdata\local\temp\shk04567000987654567890000000009879.exe
  c:\users\admin\appdata\local\temp\shk04567000987654567890000000009879.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe
    "C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe" C:\Users\Admin\AppData\Local\Temp\gofbpa.mha
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe
      "C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1344
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3220
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4632
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1136
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Windows\SysWOW64\at.exe
        
        at 20:35 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:2128
      - C:\Windows\SysWOW64\at.exe
        
        at 20:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:2896
      - C:\Windows\SysWOW64\at.exe
        
        at 20:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        
        PID:2180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cotcmgemj.exe

Path C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe
Size 63KB
SHA256 0cb7515d41e9e1d0676c9bd8a452b3d052d1c229557e653940173a970e1ecf8d
MD5 f14b88e3705c468a06430f4a45cfb48d
SHA1 7904e10118a74ae6e2b3e7990689e1b7359ac83e
SHA512 8bacc57f2b1fc22843aa8dbf09075a7646702b3a25215eac8decc2eca77ebaaee8ac6478ac52ee5058ad1f9ac1f5eb831e8e35cd747050b1ce8cae4343b6d8f5
SSDEEP 768:vg8G6w/ulHBxJ3vdt1yMVLlUqX8WgB2bm85K64abksLpU02lbIVlJp5e:vLQ/MHBzFTygLlUqXFgWmT6Xbn2SpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cotcmgemj.exe

Path C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe
Size 63KB
SHA256 0cb7515d41e9e1d0676c9bd8a452b3d052d1c229557e653940173a970e1ecf8d
MD5 f14b88e3705c468a06430f4a45cfb48d
SHA1 7904e10118a74ae6e2b3e7990689e1b7359ac83e
SHA512 8bacc57f2b1fc22843aa8dbf09075a7646702b3a25215eac8decc2eca77ebaaee8ac6478ac52ee5058ad1f9ac1f5eb831e8e35cd747050b1ce8cae4343b6d8f5
SSDEEP 768:vg8G6w/ulHBxJ3vdt1yMVLlUqX8WgB2bm85K64abksLpU02lbIVlJp5e:vLQ/MHBzFTygLlUqXFgWmT6Xbn2SpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cotcmgemj.exe

Path C:\Users\Admin\AppData\Local\Temp\cotcmgemj.exe
Size 63KB
SHA256 0cb7515d41e9e1d0676c9bd8a452b3d052d1c229557e653940173a970e1ecf8d
MD5 f14b88e3705c468a06430f4a45cfb48d
SHA1 7904e10118a74ae6e2b3e7990689e1b7359ac83e
SHA512 8bacc57f2b1fc22843aa8dbf09075a7646702b3a25215eac8decc2eca77ebaaee8ac6478ac52ee5058ad1f9ac1f5eb831e8e35cd747050b1ce8cae4343b6d8f5
SSDEEP 768:vg8G6w/ulHBxJ3vdt1yMVLlUqX8WgB2bm85K64abksLpU02lbIVlJp5e:vLQ/MHBzFTygLlUqXFgWmT6Xbn2SpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

flkvuqfnj.pqv

Path C:\Users\Admin\AppData\Local\Temp\flkvuqfnj.pqv
Size 223KB
SHA256 4c64fd5fdd8ed865753e7fc354e095ef06715d283016471ffd16a4238e1ff713
MD5 925de11c38b0d91fd9c063d05356438b
SHA1 8a3b4cd091e049a235c8c8f88ca7c786b0872aef
SHA512 4fd94aa9619f0fb3ec9ec66bcdff3ff3c5e3bc9b51f55c389d83d5488f3f60bb82452fbafe0f68f1f883180fda456435b7370d442096a27e52245a4bd2bc2009
SSDEEP 6144:Obr5CVW2vMAnowAkbW/CCoXCtFmy7izqUqbvQ/rSfVbPDyYLB4:OwW2vzowADCzCtFH+zUbJVTD4
MD5 SHA1 SHA512 SSDEEP

Submit Download

gofbpa.mha

Path C:\Users\Admin\AppData\Local\Temp\gofbpa.mha
Size 5KB
SHA256 6179af368144934614800d1ae17fa7c6fb736106f392601b1e4eb9c3827f6b90
MD5 2c7d94365600738363d38bc4186aca79
SHA1 ae1fb696ad6bb46942a143bf04195e33c649f26b
SHA512 d86a844342b21b58c515e1ebbfd8961de288310c270bcc733cc5acacdb6e1c81817155e33065c7662ee61e1c71f2b3ddf481cf1b54373adb339aaf3a10138b69
SSDEEP 96:Farc6oY0log/DrYu2k2XO5oSwsa9cW4/LeQd/UpoOhCV76AdoT1lzDsCRnToKtCg:FarcRTlv+hX1Sha+7/LeI/Up9YVWpnsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

shk04567000987654567890000000009879.exe

Path C:\Users\Admin\AppData\Local\Temp\shk04567000987654567890000000009879.exe
Size 389KB
SHA256 d7e048cf438287b85e45f1b46af59a315372066079942af7111a45b91d15745e
MD5 9e2218de5036202212a271884c434783
SHA1 72242d2dc23fba9b79f2e1f1528ea6510af1ce8d
SHA512 22a80c2c4b5021363a8f75d6c24361850c8bb50a8acb27594aeb8537351ca2d9222758a0546b5d63eb7b312448bc370f372d4d6ba5d0b011f5a531e36fd6b7c9
SSDEEP 6144:DYa66Rsa9hOwy5fcLHq6JuREqSaa31TXyxxXqBqKBx4FMWJbxf:DYqC5fGLctSfIxx6Bqcx4WWHf
MD5 SHA1 SHA512 SSDEEP

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 274KB
SHA256 8f8c693446d6b115b8f68ca9fc79bb762fae0f74bd4c5ff26168da100a859aed
MD5 f549d7cf9f2ee518bcdea5303a521c1a
SHA1 ff2d6257e952178dadd800e9d37af16bf13c91a3
SHA512 2a6c3791b2fbeb42daa0e021d87cb83e7f3ea6e169416501f4c674bc85de86c118f89cdcf26d2b2013785cb365d2c045c76ef803d5c400ee3a72a9a59750f50d
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLo:GENN+T5xYrllrU7QY6h
MD5 SHA1 SHA512 SSDEEP

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 274KB
SHA256 8f8c693446d6b115b8f68ca9fc79bb762fae0f74bd4c5ff26168da100a859aed
MD5 f549d7cf9f2ee518bcdea5303a521c1a
SHA1 ff2d6257e952178dadd800e9d37af16bf13c91a3
SHA512 2a6c3791b2fbeb42daa0e021d87cb83e7f3ea6e169416501f4c674bc85de86c118f89cdcf26d2b2013785cb365d2c045c76ef803d5c400ee3a72a9a59750f50d
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLo:GENN+T5xYrllrU7QY6h
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 274KB
SHA256 b04ff011e979c80beb931dcd8ed629ac7ecf27c5ee19ca4b65c4576ff17bea4c
MD5 9c429123f232add0a723d09b873ef71b
SHA1 0f6652870adee322bb4ee95688e081a1aca2d06b
SHA512 af6c4cee138db9d6c0963d1a24a6154369e501c693d17f924b319f02361bb57e7b318c756928919d94fbf02183838b07761472bf007ad80f66b6aa03b1fd834d
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLa:GENN+T5xYrllrU7QY6R
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 274KB
SHA256 21713f217806862c340732c2a8b9c559acbbf3e4c1f8685e3fdce3875c55be41
MD5 ccab49d29daa8d0ef31692f95df21a27
SHA1 e91ac801f518997bb8be2a994e4f6e34b6044e8f
SHA512 c0784e5d7c60e282ffdbcfbc46c95b9c943d187ffe84d2ee8ecaf2cd30ad2cda1e7fb1ed586142ac55cbc320f4e14c360b3d8ac5b876b88b7140d0bab0dc5550
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLD:GENN+T5xYrllrU7QY6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 274KB
SHA256 7ea3999bf46149588a4674344617acaacd0449bafb2bd2237b7ac8a0e1fb754c
MD5 c2c8e82039c23cea53dfe8eff7765052
SHA1 f4db4f0861f218b272a960449412d929400b5ef5
SHA512 bc81a5b7c572a9dbb72c9db370bdd7d2922961d784e85da845f2dbc3d25ceb92b1e00dc07d93f351f643fef019078f8b26201bfd278b96793bbb23582ab7701a
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLe:GENN+T5xYrllrU7QY6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 274KB
SHA256 7ea3999bf46149588a4674344617acaacd0449bafb2bd2237b7ac8a0e1fb754c
MD5 c2c8e82039c23cea53dfe8eff7765052
SHA1 f4db4f0861f218b272a960449412d929400b5ef5
SHA512 bc81a5b7c572a9dbb72c9db370bdd7d2922961d784e85da845f2dbc3d25ceb92b1e00dc07d93f351f643fef019078f8b26201bfd278b96793bbb23582ab7701a
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLe:GENN+T5xYrllrU7QY6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 274KB
SHA256 234dec3dbdeedfc0182f9eb7324aa40757ec63fcd4cacaa3fee134c3875ee407
MD5 01a3b1ae096a72dba331f6b904b9e879
SHA1 e453979023ef835fce62afe9323055098b26e11b
SHA512 0cc706a81f03a84897882547455e63d8ba4c1742f4478dea713a5961a04e272722551abe8251f33cd2f261c1281d948719da2e38b1d268e30b260de24ae6172d
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLK:GENN+T5xYrllrU7QY6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

shk04567000987654567890000000009879.exe

Path \??\c:\users\admin\appdata\local\temp\shk04567000987654567890000000009879.exe
Size 389KB
SHA256 d7e048cf438287b85e45f1b46af59a315372066079942af7111a45b91d15745e
MD5 9e2218de5036202212a271884c434783
SHA1 72242d2dc23fba9b79f2e1f1528ea6510af1ce8d
SHA512 22a80c2c4b5021363a8f75d6c24361850c8bb50a8acb27594aeb8537351ca2d9222758a0546b5d63eb7b312448bc370f372d4d6ba5d0b011f5a531e36fd6b7c9
SSDEEP 6144:DYa66Rsa9hOwy5fcLHq6JuREqSaa31TXyxxXqBqKBx4FMWJbxf:DYqC5fGLctSfIxx6Bqcx4WWHf
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 274KB
SHA256 21713f217806862c340732c2a8b9c559acbbf3e4c1f8685e3fdce3875c55be41
MD5 ccab49d29daa8d0ef31692f95df21a27
SHA1 e91ac801f518997bb8be2a994e4f6e34b6044e8f
SHA512 c0784e5d7c60e282ffdbcfbc46c95b9c943d187ffe84d2ee8ecaf2cd30ad2cda1e7fb1ed586142ac55cbc320f4e14c360b3d8ac5b876b88b7140d0bab0dc5550
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLD:GENN+T5xYrllrU7QY6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \??\c:\windows\system\spoolsv.exe
Size 274KB
SHA256 7ea3999bf46149588a4674344617acaacd0449bafb2bd2237b7ac8a0e1fb754c
MD5 c2c8e82039c23cea53dfe8eff7765052
SHA1 f4db4f0861f218b272a960449412d929400b5ef5
SHA512 bc81a5b7c572a9dbb72c9db370bdd7d2922961d784e85da845f2dbc3d25ceb92b1e00dc07d93f351f643fef019078f8b26201bfd278b96793bbb23582ab7701a
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLe:GENN+T5xYrllrU7QY6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 274KB
SHA256 234dec3dbdeedfc0182f9eb7324aa40757ec63fcd4cacaa3fee134c3875ee407
MD5 01a3b1ae096a72dba331f6b904b9e879
SHA1 e453979023ef835fce62afe9323055098b26e11b
SHA512 0cc706a81f03a84897882547455e63d8ba4c1742f4478dea713a5961a04e272722551abe8251f33cd2f261c1281d948719da2e38b1d268e30b260de24ae6172d
SSDEEP 6144:UvEN2U+T6i5LirrllHy4HUcMQY6M1pdFL1pdFLK:GENN+T5xYrllrU7QY6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1136-172-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1136-193-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1344-190-0x0000000006750000-0x000000000675A000-memory.dmp

Download

memory/1344-187-0x0000000005630000-0x00000000056CC000-memory.dmp

Download

memory/1344-186-0x0000000005BE0000-0x0000000006184000-memory.dmp

Download

memory/1344-185-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1344-188-0x00000000068C0000-0x0000000006A82000-memory.dmp

Download

memory/1344-189-0x0000000006790000-0x0000000006822000-memory.dmp

Download

memory/3052-176-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-166-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3468-169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3468-192-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-177-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4632-170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-132-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-179-0x0000000000400000-0x000000000043E000-memory.dmp

Download