nymaim | d2a94c8b3e3032ba9be61ff8aea3d7900c32726c147cdb551e066719292083d3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2023, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 380KB
Sample230102-t6jndaaa7w
SHA256 d2a94c8b3e3032ba9be61ff8aea3d7900c32726c147cdb551e066719292083d3
MD5 c0764737abbc5621cb816a48dde0d84e
SHA1 5a758df9cd6980c8349a01ab4ad01036c0b23247
SHA512 ad86bd035b416cdcd7d9cf2432cc84da7582dbe0e53c44dd95ef0c7875a33456910bfd6b81ae921b04bc68d2f7ee587fca92d8fdbe80ecd353e2322be205ff68
SSDEEP 6144:x/QiQXCRkm+ksmpk3U9j0I37OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3RP6m6UR0I37lL//plmW9bTXeVhD4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim discovery evasion persistence trojan

Malware Config

Extracted

Family

nymaim

45.139.105.171
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	2588	rundll32.exe	42

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	GOUR.exe

Executes dropped EXE 11 IoCs

pid	Process
3928	file.tmp
3976	GOUR.exe
2468	poweroff.exe
308	Muzhuruhubo.exe
3168	poweroff.tmp
4472	Muzhuruhubo.exe
176	Power Off.exe
7528	GcleanerEU.exe
7640	gcleaner.exe
2912	random.exe
3516	random.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	GOUR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Muzhuruhubo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	GcleanerEU.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	gcleaner.exe

Loads dropped DLL 2 IoCs

pid	Process
3928	file.tmp
2744	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\MSBuild\\Muzhuruhubo.exe\""	GOUR.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\powerOff\is-413DL.tmp	poweroff.tmp
File opened for modification	C:\Program Files (x86)\powerOff\unins000.dat	poweroff.tmp
File created	C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe.config	GOUR.exe
File created	C:\Program Files (x86)\MSBuild\Muzhuruhubo.exe.config	GOUR.exe
File created	C:\Program Files (x86)\powerOff\is-TFNVB.tmp	poweroff.tmp
File created	C:\Program Files (x86)\powerOff\unins000.dat	poweroff.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\56a684d5-c0a8-4e73-b400-48f96ccc98cd.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230102174036.pma	setup.exe
File created	C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe	GOUR.exe
File created	C:\Program Files (x86)\MSBuild\Muzhuruhubo.exe	GOUR.exe
File opened for modification	C:\Program Files (x86)\powerOff\Power Off.exe	poweroff.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 19 IoCs

pid	pid_target	Process	procid_target
3836	7528	WerFault.exe	101
4104	7640	WerFault.exe	104
2084	7528	WerFault.exe	101
4688	2744	WerFault.exe	126
3688	7528	WerFault.exe	101
5032	7640	WerFault.exe	104
3292	7528	WerFault.exe	101
5176	7528	WerFault.exe	101
5216	7640	WerFault.exe	104
5276	7528	WerFault.exe	101
5404	7640	WerFault.exe	104
5456	7528	WerFault.exe	101
5508	7640	WerFault.exe	104
5588	7528	WerFault.exe	101
5632	7640	WerFault.exe	104
5796	7640	WerFault.exe	104
5828	7528	WerFault.exe	101
5976	7640	WerFault.exe	104
6100	7640	WerFault.exe	104

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5884	taskkill.exe
6132	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	88	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3168	poweroff.tmp
3168	poweroff.tmp
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe
308	Muzhuruhubo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	GOUR.exe
Token: SeDebugPrivilege	308	Muzhuruhubo.exe
Token: SeDebugPrivilege	4472	Muzhuruhubo.exe
Token: SeDebugPrivilege	5884	taskkill.exe
Token: SeDebugPrivilege	6132	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3168	poweroff.tmp
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3928	4708	file.exe	81
PID 4708 wrote to memory of 3928	4708	file.exe	81
PID 4708 wrote to memory of 3928	4708	file.exe	81
PID 3928 wrote to memory of 3976	3928	file.tmp	82
PID 3928 wrote to memory of 3976	3928	file.tmp	82
PID 3976 wrote to memory of 2468	3976	GOUR.exe	86
PID 3976 wrote to memory of 2468	3976	GOUR.exe	86
PID 3976 wrote to memory of 2468	3976	GOUR.exe	86
PID 3976 wrote to memory of 308	3976	GOUR.exe	87
PID 3976 wrote to memory of 308	3976	GOUR.exe	87
PID 2468 wrote to memory of 3168	2468	poweroff.exe	88
PID 2468 wrote to memory of 3168	2468	poweroff.exe	88
PID 2468 wrote to memory of 3168	2468	poweroff.exe	88
PID 3976 wrote to memory of 4472	3976	GOUR.exe	89
PID 3976 wrote to memory of 4472	3976	GOUR.exe	89
PID 3168 wrote to memory of 176	3168	poweroff.tmp	90
PID 3168 wrote to memory of 176	3168	poweroff.tmp	90
PID 4472 wrote to memory of 3272	4472	Muzhuruhubo.exe	95
PID 4472 wrote to memory of 3272	4472	Muzhuruhubo.exe	95
PID 3272 wrote to memory of 6020	3272	msedge.exe	97
PID 3272 wrote to memory of 6020	3272	msedge.exe	97
PID 308 wrote to memory of 6192	308	Muzhuruhubo.exe	99
PID 308 wrote to memory of 6192	308	Muzhuruhubo.exe	99
PID 6192 wrote to memory of 7528	6192	cmd.exe	101
PID 6192 wrote to memory of 7528	6192	cmd.exe	101
PID 6192 wrote to memory of 7528	6192	cmd.exe	101
PID 308 wrote to memory of 7592	308	Muzhuruhubo.exe	102
PID 308 wrote to memory of 7592	308	Muzhuruhubo.exe	102
PID 7592 wrote to memory of 7640	7592	cmd.exe	104
PID 7592 wrote to memory of 7640	7592	cmd.exe	104
PID 7592 wrote to memory of 7640	7592	cmd.exe	104
PID 308 wrote to memory of 7732	308	Muzhuruhubo.exe	105
PID 308 wrote to memory of 7732	308	Muzhuruhubo.exe	105
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107
PID 3272 wrote to memory of 7816	3272	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\is-M1U3C.tmp\file.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M1U3C.tmp\file.tmp" /SL5="$60160,140559,56832,C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\is-FFMPQ.tmp\GOUR.exe
    "C:\Users\Admin\AppData\Local\Temp\is-FFMPQ.tmp\GOUR.exe" /S /UID=95
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe
      "C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\is-H7NJ3.tmp\poweroff.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H7NJ3.tmp\poweroff.tmp" /SL5="$9003A,490199,350720,C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3168
      - C:\Program Files (x86)\powerOff\Power Off.exe
        
        "C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu
        6⤵
        Executes dropped EXE
        
        PID:176
  - - C:\Users\Admin\AppData\Local\Temp\bf-256ce-d9a-9b397-49492fe0cf201\Muzhuruhubo.exe
      "C:\Users\Admin\AppData\Local\Temp\bf-256ce-d9a-9b397-49492fe0cf201\Muzhuruhubo.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:308
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\51cp2qeg.cvz\GcleanerEU.exe /eufive & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\51cp2qeg.cvz\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\51cp2qeg.cvz\GcleanerEU.exe /eufive
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:7528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 452
        7⤵
        Program crash
        
        PID:3836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 764
        7⤵
        Program crash
        
        PID:2084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 804
        7⤵
        Program crash
        
        PID:3688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 852
        7⤵
        Program crash
        
        PID:3292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 860
        7⤵
        Program crash
        
        PID:5176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 984
        7⤵
        Program crash
        
        PID:5276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 996
        7⤵
        Program crash
        
        PID:5456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 1176
        7⤵
        Program crash
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\51cp2qeg.cvz\GcleanerEU.exe" & exit
        7⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 492
        7⤵
        Program crash
        
        PID:5828
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3ifcnjae.oeg\gcleaner.exe /mixfive & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\3ifcnjae.oeg\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\3ifcnjae.oeg\gcleaner.exe /mixfive
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:7640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 460
        7⤵
        Program crash
        
        PID:4104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 776
        7⤵
        Program crash
        
        PID:5032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 784
        7⤵
        Program crash
        
        PID:5216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 652
        7⤵
        Program crash
        
        PID:5404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 856
        7⤵
        Program crash
        
        PID:5508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 984
        7⤵
        Program crash
        
        PID:5632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 1016
        7⤵
        Program crash
        
        PID:5796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 1208
        7⤵
        Program crash
        
        PID:5976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3ifcnjae.oeg\gcleaner.exe" & exit
        7⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 488
        7⤵
        Program crash
        
        PID:6100
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe & exit
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe
        
        C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe
        
        "C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe" -h
        7⤵
        Executes dropped EXE
        
        PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\21-84a6b-f85-5959f-65b2dbad1853c\Muzhuruhubo.exe
      "C:\Users\Admin\AppData\Local\Temp\21-84a6b-f85-5959f-65b2dbad1853c\Muzhuruhubo.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        5⤵
        Adds Run key to start application
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa951d46f8,0x7ffa951d4708,0x7ffa951d4718
        6⤵
        
        PID:6020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
        6⤵
        
        PID:7816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
        6⤵
        
        PID:7852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
        6⤵
        
        PID:7868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
        6⤵
        
        PID:8092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        6⤵
        
        PID:8112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5072 /prefetch:8
        6⤵
        
        PID:2864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
        6⤵
        
        PID:3392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3700 /prefetch:8
        6⤵
        
        PID:2536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
        6⤵
        
        PID:5288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
        6⤵
        
        PID:5308
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
        6⤵
        
        PID:6184
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Drops file in Program Files directory
        
        PID:6264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6ac175460,0x7ff6ac175470,0x7ff6ac175480
        7⤵
        
        PID:6316
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
        6⤵
        
        PID:6512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:8
        6⤵
        
        PID:6768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
        6⤵
        
        PID:6844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
        6⤵
        
        PID:6944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
        6⤵
        
        PID:7012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,12692429453862461860,6983130711682067869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 /prefetch:8
        6⤵
        
        PID:7132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 7528 -ip 7528
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7640 -ip 7640
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7528 -ip 7528
1⤵
PID:4996

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 600
    3⤵
    - Program crash
    PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2744 -ip 2744
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7528 -ip 7528
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7640 -ip 7640
1⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7528 -ip 7528
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7528 -ip 7528
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 7640 -ip 7640
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 7528 -ip 7528
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7640 -ip 7640
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7528 -ip 7528
1⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7640 -ip 7640
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7528 -ip 7528
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7640 -ip 7640
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7640 -ip 7640
1⤵
PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7528 -ip 7528
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7640 -ip 7640
1⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7640 -ip 7640
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Power Off.exe

Path C:\Program Files (x86)\powerOff\Power Off.exe
Size 621KB
SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
MD5 8d0b18eb87590fa654da3704092b122b
SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
SHA512 fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828
SSDEEP 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Power Off.exe

Path C:\Program Files (x86)\powerOff\Power Off.exe
Size 621KB
SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
MD5 8d0b18eb87590fa654da3704092b122b
SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
SHA512 fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828
SSDEEP 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.exe

Path C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe
Size 838KB
SHA256 c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed
MD5 c0538198613d60407c75c54c55e69d91
SHA1 a2d713a098bc7b6d245c428dcdeb5614af3b8edd
SHA512 121f882471cd14752a1f806472c89028cc56c90fbfb0b645c26937c417f107d5324250f783310032d4526018c8918cdd06c52325949f78220a9d3bab167e3529
SSDEEP 12288:+Qi3reTWxN15q3ZsRfGGduNOXPTd7yts/G6UWi9P3P5cN1IGh0nqPjU6xg7:+QiuWl55R+OeOX7UeRAP3xcNLeqPjUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.exe

Path C:\Program Files\Reference Assemblies\DEOUQUBTOF\poweroff.exe
Size 838KB
SHA256 c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed
MD5 c0538198613d60407c75c54c55e69d91
SHA1 a2d713a098bc7b6d245c428dcdeb5614af3b8edd
SHA512 121f882471cd14752a1f806472c89028cc56c90fbfb0b645c26937c417f107d5324250f783310032d4526018c8918cdd06c52325949f78220a9d3bab167e3529
SSDEEP 12288:+Qi3reTWxN15q3ZsRfGGduNOXPTd7yts/G6UWi9P3P5cN1IGh0nqPjU6xg7:+QiuWl55R+OeOX7UeRAP3xcNLeqPjUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muzhuruhubo.exe

Path C:\Users\Admin\AppData\Local\Temp\21-84a6b-f85-5959f-65b2dbad1853c\Muzhuruhubo.exe
Size 586KB
SHA256 2f1a9b94d5fce31cab6e35b22b00e4f73b80582d3635ba113a10b2caa5015431
MD5 208e4cd441cdd40a55ee0fc96316e331
SHA1 cddcd13535391b96c8ec650a22f1503f93ca092c
SHA512 bb7891ab9afbe99ce7f0235c155ebe943f8790fcd7bbe1b4420960c2b703f4c96aae84dd8005704fb79bb7edc0f1e4e3270f12bdce060cb8936b6bad0c814651
SSDEEP 6144:G8IbHzOJT7QxJkLVcu7P3tYzzN3pawX1fUYqdildEchHRYWS:Gz57kZ3JEzxFlfUYqdildEchHRYWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muzhuruhubo.exe

Path C:\Users\Admin\AppData\Local\Temp\21-84a6b-f85-5959f-65b2dbad1853c\Muzhuruhubo.exe
Size 586KB
SHA256 2f1a9b94d5fce31cab6e35b22b00e4f73b80582d3635ba113a10b2caa5015431
MD5 208e4cd441cdd40a55ee0fc96316e331
SHA1 cddcd13535391b96c8ec650a22f1503f93ca092c
SHA512 bb7891ab9afbe99ce7f0235c155ebe943f8790fcd7bbe1b4420960c2b703f4c96aae84dd8005704fb79bb7edc0f1e4e3270f12bdce060cb8936b6bad0c814651
SSDEEP 6144:G8IbHzOJT7QxJkLVcu7P3tYzzN3pawX1fUYqdildEchHRYWS:Gz57kZ3JEzxFlfUYqdildEchHRYWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muzhuruhubo.exe.config

Path C:\Users\Admin\AppData\Local\Temp\21-84a6b-f85-5959f-65b2dbad1853c\Muzhuruhubo.exe.config
Size 1KB
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
MD5 SHA1 SHA512

Submit Download

gcleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\3ifcnjae.oeg\gcleaner.exe
Size 300KB
SHA256 a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39
MD5 5d2f16ef266104387e196951e7a54383
SHA1 025c8f532bd1b3824730e2b110da6240fad56201
SHA512 ff9a1c4750bce23ab2c4560e74a184043e7734d60d9b363cf731f25dc224ee6ad534ab76473297d6a32ab0c2caa1a1f814e9b70921bc9d9de19abf39f8ae2d6a
SSDEEP 6144:hsb5LBhvt3Lms9OJI9EELu4bqA9fkPf41b:hsb59hV3LGJIRjDsPSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\3ifcnjae.oeg\gcleaner.exe
Size 300KB
SHA256 a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39
MD5 5d2f16ef266104387e196951e7a54383
SHA1 025c8f532bd1b3824730e2b110da6240fad56201
SHA512 ff9a1c4750bce23ab2c4560e74a184043e7734d60d9b363cf731f25dc224ee6ad534ab76473297d6a32ab0c2caa1a1f814e9b70921bc9d9de19abf39f8ae2d6a
SSDEEP 6144:hsb5LBhvt3Lms9OJI9EELu4bqA9fkPf41b:hsb59hV3LGJIRjDsPSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

GcleanerEU.exe

Path C:\Users\Admin\AppData\Local\Temp\51cp2qeg.cvz\GcleanerEU.exe
Size 300KB
SHA256 a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39
MD5 5d2f16ef266104387e196951e7a54383
SHA1 025c8f532bd1b3824730e2b110da6240fad56201
SHA512 ff9a1c4750bce23ab2c4560e74a184043e7734d60d9b363cf731f25dc224ee6ad534ab76473297d6a32ab0c2caa1a1f814e9b70921bc9d9de19abf39f8ae2d6a
SSDEEP 6144:hsb5LBhvt3Lms9OJI9EELu4bqA9fkPf41b:hsb59hV3LGJIRjDsPSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

GcleanerEU.exe

Path C:\Users\Admin\AppData\Local\Temp\51cp2qeg.cvz\GcleanerEU.exe
Size 300KB
SHA256 a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39
MD5 5d2f16ef266104387e196951e7a54383
SHA1 025c8f532bd1b3824730e2b110da6240fad56201
SHA512 ff9a1c4750bce23ab2c4560e74a184043e7734d60d9b363cf731f25dc224ee6ad534ab76473297d6a32ab0c2caa1a1f814e9b70921bc9d9de19abf39f8ae2d6a
SSDEEP 6144:hsb5LBhvt3Lms9OJI9EELu4bqA9fkPf41b:hsb59hV3LGJIRjDsPSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kenessey.txt

Path C:\Users\Admin\AppData\Local\Temp\bf-256ce-d9a-9b397-49492fe0cf201\Kenessey.txt
Size 9B
SHA256 9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
MD5 97384261b8bbf966df16e5ad509922db
SHA1 2fc42d37fee2c81d767e09fb298b70c748940f86
SHA512 b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21
MD5 SHA1 SHA512

Submit Download

Muzhuruhubo.exe

Path C:\Users\Admin\AppData\Local\Temp\bf-256ce-d9a-9b397-49492fe0cf201\Muzhuruhubo.exe
Size 377KB
SHA256 45570616c6bc66ad969a2b343240794096ce515103abea1eb7d4fbcf099bcebc
MD5 97627b2f5f03f91345b467a2a4b34e1a
SHA1 863ef84ed38a90a5141b381d074f417e3ff0b5fc
SHA512 7a738404b761ad637f0f106144d746d6bc97d03e8adfed4c8a7c60cab22e4b2138dcbf9d185d753b92ad9f3de56689932225fd555ff556dbc6c5269d9600d0c0
SSDEEP 6144:0RZRvtX/QGSCOqPyU69iKcWL2h628Ow5RvJnyojESRjNCa0Z8W5qwTpDbyZSle8x:afMCOqlFn0ewZnyojESRjNCa0Z8W5qwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muzhuruhubo.exe

Path C:\Users\Admin\AppData\Local\Temp\bf-256ce-d9a-9b397-49492fe0cf201\Muzhuruhubo.exe
Size 377KB
SHA256 45570616c6bc66ad969a2b343240794096ce515103abea1eb7d4fbcf099bcebc
MD5 97627b2f5f03f91345b467a2a4b34e1a
SHA1 863ef84ed38a90a5141b381d074f417e3ff0b5fc
SHA512 7a738404b761ad637f0f106144d746d6bc97d03e8adfed4c8a7c60cab22e4b2138dcbf9d185d753b92ad9f3de56689932225fd555ff556dbc6c5269d9600d0c0
SSDEEP 6144:0RZRvtX/QGSCOqPyU69iKcWL2h628Ow5RvJnyojESRjNCa0Z8W5qwTpDbyZSle8x:afMCOqlFn0ewZnyojESRjNCa0Z8W5qwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muzhuruhubo.exe.config

Path C:\Users\Admin\AppData\Local\Temp\bf-256ce-d9a-9b397-49492fe0cf201\Muzhuruhubo.exe.config
Size 1KB
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
MD5 SHA1 SHA512

Submit Download

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860
MD5 76c3dbb1e9fea62090cdf53dadcbe28e
SHA1 d44b32d04adc810c6df258be85dc6b62bd48a307
SHA512 de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b
SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLMoCXwbePLJrH8fwpj:FV1edgkV8T0Cnoxt4ePLJTMwpj
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
MD5 0b35335b70b96d31633d0caa207d71f9
SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
MD5 0b35335b70b96d31633d0caa207d71f9
SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

GOUR.exe

Path C:\Users\Admin\AppData\Local\Temp\is-FFMPQ.tmp\GOUR.exe
Size 302KB
SHA256 35f7d826be42bcddad36ab6fffab52a393aabdf445cff086861f456bfcee814d
MD5 cc41507ba8ee6cdd0909f513c977df6f
SHA1 eac08a0843d63ffd9b681d91624f1d1424a41c15
SHA512 6a9f0ccb052aa119ff65868a9592c6cee3dd0e481ecf5a3686541ddcdfd3443deb4f03b4f54bdc9a6ff6172a5a3ea2fb9e87671ce06210687935bc73230cbf6b
SSDEEP 6144:QSU1mZDYVR8/vjwCPKCgxLKAeHbcVY7XMzOO8YCAYxGIQeUqLv1KCwfk:LU1iYVROvPKpxLaHEY7XMzOO8YCAYxGg
MD5 SHA1 SHA512 SSDEEP

Submit Download

GOUR.exe

Path C:\Users\Admin\AppData\Local\Temp\is-FFMPQ.tmp\GOUR.exe
Size 302KB
SHA256 35f7d826be42bcddad36ab6fffab52a393aabdf445cff086861f456bfcee814d
MD5 cc41507ba8ee6cdd0909f513c977df6f
SHA1 eac08a0843d63ffd9b681d91624f1d1424a41c15
SHA512 6a9f0ccb052aa119ff65868a9592c6cee3dd0e481ecf5a3686541ddcdfd3443deb4f03b4f54bdc9a6ff6172a5a3ea2fb9e87671ce06210687935bc73230cbf6b
SSDEEP 6144:QSU1mZDYVR8/vjwCPKCgxLKAeHbcVY7XMzOO8YCAYxGIQeUqLv1KCwfk:LU1iYVROvPKpxLaHEY7XMzOO8YCAYxGg
MD5 SHA1 SHA512 SSDEEP

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-FFMPQ.tmp\idp.dll
Size 216KB
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA512 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
SSDEEP 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-H7NJ3.tmp\poweroff.tmp
Size 981KB
SHA256 8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0
MD5 01515376348a54ecef04f45b436cb104
SHA1 111e709b21bf56181c83057dafba7b71ed41f1b2
SHA512 8d0a31e3694cec61fb99573e58c3696224a6198060d8bfca020805541789516315867b6b83a5e105703660e03fac4906f95f617dc8a3947d6b7982dfd3baea28
SSDEEP 24576:sQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafSWVyx9eR:Q02rPD37zzH2A6SBIfNafwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-H7NJ3.tmp\poweroff.tmp
Size 981KB
SHA256 8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0
MD5 01515376348a54ecef04f45b436cb104
SHA1 111e709b21bf56181c83057dafba7b71ed41f1b2
SHA512 8d0a31e3694cec61fb99573e58c3696224a6198060d8bfca020805541789516315867b6b83a5e105703660e03fac4906f95f617dc8a3947d6b7982dfd3baea28
SSDEEP 24576:sQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafSWVyx9eR:Q02rPD37zzH2A6SBIfNafwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-M1U3C.tmp\file.tmp
Size 694KB
SHA256 1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
MD5 ffcf263a020aa7794015af0edee5df0b
SHA1 bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA512 49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
SSDEEP 12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyR:bQYh1yLmSKrPD37zzH2A6QD/IpqggE29
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe
Size 131KB
SHA256 0c0bdbcea941b4cef850609416ec4f3d3ead6f08f687d96b76dcd5e809bb22b9
MD5 a2480afb729334b3901031d9e17ab2f7
SHA1 263a69f2fafc2212fc6ebc093c1a92222d677c62
SHA512 d0ebe6f6f2e42929fea023e8d9b1793ebb5aa0d502b6de08eaab1722790bdbe164eecea2fd893989d97048cda8e0d9d2fffaf21740814d62a2638a31e12302a6
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWdPMbwbNddf7wHx7hzlP:wvdkOhbPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe
Size 131KB
SHA256 0c0bdbcea941b4cef850609416ec4f3d3ead6f08f687d96b76dcd5e809bb22b9
MD5 a2480afb729334b3901031d9e17ab2f7
SHA1 263a69f2fafc2212fc6ebc093c1a92222d677c62
SHA512 d0ebe6f6f2e42929fea023e8d9b1793ebb5aa0d502b6de08eaab1722790bdbe164eecea2fd893989d97048cda8e0d9d2fffaf21740814d62a2638a31e12302a6
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWdPMbwbNddf7wHx7hzlP:wvdkOhbPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\x0tjcsmu.v4t\random.exe
Size 131KB
SHA256 0c0bdbcea941b4cef850609416ec4f3d3ead6f08f687d96b76dcd5e809bb22b9
MD5 a2480afb729334b3901031d9e17ab2f7
SHA1 263a69f2fafc2212fc6ebc093c1a92222d677c62
SHA512 d0ebe6f6f2e42929fea023e8d9b1793ebb5aa0d502b6de08eaab1722790bdbe164eecea2fd893989d97048cda8e0d9d2fffaf21740814d62a2638a31e12302a6
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWdPMbwbNddf7wHx7hzlP:wvdkOhbPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/176-167-0x00007FFA96500000-0x00007FFA96F36000-memory.dmp

Download

memory/308-166-0x00007FFA96500000-0x00007FFA96F36000-memory.dmp

Download

memory/2468-199-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2468-152-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/2468-145-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3976-159-0x00007FFA96600000-0x00007FFA970C1000-memory.dmp

Download

memory/3976-141-0x0000000000170000-0x00000000001C2000-memory.dmp

Download

memory/3976-142-0x00007FFA96600000-0x00007FFA970C1000-memory.dmp

Download

memory/4472-165-0x00007FFA96500000-0x00007FFA96F36000-memory.dmp

Download

memory/4708-137-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4708-160-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4708-132-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/7528-194-0x00000000006F8000-0x000000000071F000-memory.dmp

Download

memory/7528-200-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/7528-217-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/7528-218-0x00000000006F8000-0x000000000071F000-memory.dmp

Download

memory/7528-195-0x0000000001F80000-0x0000000001FC0000-memory.dmp

Download

memory/7640-201-0x0000000000728000-0x000000000074F000-memory.dmp

Download

memory/7640-222-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/7640-221-0x0000000000728000-0x000000000074F000-memory.dmp

Download

memory/7640-202-0x0000000000400000-0x0000000000469000-memory.dmp

Download