cea69bdbc50beb7c92c811acd3ec8134186e629ace3317c96c548e1de1b2125d

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Size

118KB
MD5

54cfe95e8879c2634882f0727dc6fe10
SHA1

a94e97f322fa435c4ce08896491143d50720e43f
SHA256

cea69bdbc50beb7c92c811acd3ec8134186e629ace3317c96c548e1de1b2125d
SHA512

51b24609a402f045e36137d9618527fcf2384aa3ea1d64ae8ade36a87e609243d8aed1de8000ca8faec00a8ff2e40f99e08af472c4d72977e6e0c396541f0f5e
SSDEEP

3072:+OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:+Is9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000120e5-10.dat	acprotect
behavioral1/files/0x00080000000120e5-34.dat	acprotect
behavioral1/files/0x00080000000120e5-39.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2664	ctfmen.exe
2824	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
2664	ctfmen.exe
2664	ctfmen.exe
2824	smnss.exe
764	WerFault.exe
764	WerFault.exe
764	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shervans.dll	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File created	C:\Windows\SysWOW64\shervans.dll	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File created	C:\Windows\SysWOW64\grcopy.dll	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File created	C:\Windows\SysWOW64\satornas.dll	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
File created	C:\Windows\SysWOW64\smnss.exe	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	smnss.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	2824	WerFault.exe	29

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2664	2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe	28
PID 2656 wrote to memory of 2664	2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe	28
PID 2656 wrote to memory of 2664	2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe	28
PID 2656 wrote to memory of 2664	2656	NEAS.54cfe95e8879c2634882f0727dc6fe10.exe	28
PID 2664 wrote to memory of 2824	2664	ctfmen.exe	29
PID 2664 wrote to memory of 2824	2664	ctfmen.exe	29
PID 2664 wrote to memory of 2824	2664	ctfmen.exe	29
PID 2664 wrote to memory of 2824	2664	ctfmen.exe	29
PID 2824 wrote to memory of 764	2824	smnss.exe	30
PID 2824 wrote to memory of 764	2824	smnss.exe	30
PID 2824 wrote to memory of 764	2824	smnss.exe	30
PID 2824 wrote to memory of 764	2824	smnss.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.54cfe95e8879c2634882f0727dc6fe10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.54cfe95e8879c2634882f0727dc6fe10.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 804
      4⤵
      Loads dropped DLL
      Program crash
      PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
1952b0b2b21b72b31be872208ab14f81

SHA1
e426d633afb191e6e55341aa423f9cbc558b816e

SHA256
c165ba86896da506566612e1f2fe01a44564aac8c19a0857be4bb1dbc680829c

SHA512
4a167d998f47ac23d71b51aeeb84ae0c00220d6394b650d079e0e35b788c38b738dba6b407c54c38c5689d1e572d4f541f02b878de1b516d2dd89abea4a13360

Download Submit
C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
1952b0b2b21b72b31be872208ab14f81

SHA1
e426d633afb191e6e55341aa423f9cbc558b816e

SHA256
c165ba86896da506566612e1f2fe01a44564aac8c19a0857be4bb1dbc680829c

SHA512
4a167d998f47ac23d71b51aeeb84ae0c00220d6394b650d079e0e35b788c38b738dba6b407c54c38c5689d1e572d4f541f02b878de1b516d2dd89abea4a13360

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
d4826ad3530c6aa9359cb83feade7d0c

SHA1
65c25bc34440f5248c310b2fef369eb432c64f1d

SHA256
8b6864c75b6dbe730edaf8752373876d8597d614ad611de7fe76af87e75cfc73

SHA512
252ea1725c0b5ea372fe6fdd600182a75daa4e2e72d4a04c3ea4613a146eeea7c5dd7ddbf7d9741f03aa83693755125329771f93aa440f9889ca6e6e4ce0c43c

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
64baa1c453f39ddc8b54d6d22f24636b

SHA1
a7da53d83eaf4a4f0d14d06d57d7e22d49d5340f

SHA256
2e50a6b121f4c1efe364a2149d815f0ce78e94ef594163ea6b0512a5b7bbc6d6

SHA512
b5779f35bc01947ec35bc2a7c3b59c4158feca27f2608a29b4d76e23969b425848cdc5b76293ed6345a0020e7967215c0c275ce60992fd665ff51524888f58bd

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
1952b0b2b21b72b31be872208ab14f81

SHA1
e426d633afb191e6e55341aa423f9cbc558b816e

SHA256
c165ba86896da506566612e1f2fe01a44564aac8c19a0857be4bb1dbc680829c

SHA512
4a167d998f47ac23d71b51aeeb84ae0c00220d6394b650d079e0e35b788c38b738dba6b407c54c38c5689d1e572d4f541f02b878de1b516d2dd89abea4a13360

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
1952b0b2b21b72b31be872208ab14f81

SHA1
e426d633afb191e6e55341aa423f9cbc558b816e

SHA256
c165ba86896da506566612e1f2fe01a44564aac8c19a0857be4bb1dbc680829c

SHA512
4a167d998f47ac23d71b51aeeb84ae0c00220d6394b650d079e0e35b788c38b738dba6b407c54c38c5689d1e572d4f541f02b878de1b516d2dd89abea4a13360

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
64baa1c453f39ddc8b54d6d22f24636b

SHA1
a7da53d83eaf4a4f0d14d06d57d7e22d49d5340f

SHA256
2e50a6b121f4c1efe364a2149d815f0ce78e94ef594163ea6b0512a5b7bbc6d6

SHA512
b5779f35bc01947ec35bc2a7c3b59c4158feca27f2608a29b4d76e23969b425848cdc5b76293ed6345a0020e7967215c0c275ce60992fd665ff51524888f58bd

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
64baa1c453f39ddc8b54d6d22f24636b

SHA1
a7da53d83eaf4a4f0d14d06d57d7e22d49d5340f

SHA256
2e50a6b121f4c1efe364a2149d815f0ce78e94ef594163ea6b0512a5b7bbc6d6

SHA512
b5779f35bc01947ec35bc2a7c3b59c4158feca27f2608a29b4d76e23969b425848cdc5b76293ed6345a0020e7967215c0c275ce60992fd665ff51524888f58bd

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
89793206b21468095233c5e731f8ed1b

SHA1
3920744d81d77bfcc57358893726b84caa69622e

SHA256
effa1a6fe41091413d02f7eaf451809fe26155211ea1e888ca1ae6f963768c3b

SHA512
7767cb82d79237d9d4499511117fdc2a20b941d73a41d3341d308aa514aa477eb5ff1b8aba0b206bb85dc06d3c091f341e5056f036251148ebadc41ecf3a4071

Download Submit
memory/2656-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2656-23-0x0000000000340000-0x0000000000349000-memory.dmp

Filesize
36KB

Download
memory/2656-18-0x0000000000340000-0x0000000000349000-memory.dmp

Filesize
36KB

Download
memory/2656-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2656-25-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2656-28-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2664-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2824-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2824-40-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2824-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2824-46-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads