fabookie | 7307d795569537cef259606c48234c9db61ed7786eefe8151e89d369408308a1

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2024 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99cc58b450cf68801e301eaea9927a4.exe
Size

6.3MB
MD5

b99cc58b450cf68801e301eaea9927a4
SHA1

eba28bca7e8920f42717e8b0e52611fc9708fc66
SHA256

7307d795569537cef259606c48234c9db61ed7786eefe8151e89d369408308a1
SHA512

0924f89ca33cf794f8188f8232781c4f9b59be1e9e812e379b1923a9eebcae3fa1a7e7dc3e387c47dda2786eaafb3298ee72a10fa4b8d9e9f6294973cbb5af16
SSDEEP

196608:owCqdWR0aKaljq/ypGt65iRJMWSZUXnFTHxP:Sq4aHadpGs5iRJMvMnJV

Score

10^/10

fabookie glupteba stealc discovery dropper evasion loader persistence rootkit spyware stealer upx

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral2/memory/3632-197-0x00000000035C0000-0x00000000036F0000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

resource	yara_rule
behavioral2/memory/1068-103-0x0000000002E40000-0x000000000372B000-memory.dmp	family_glupteba
behavioral2/memory/1068-104-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1068-137-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1068-186-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1068-188-0x0000000002E40000-0x000000000372B000-memory.dmp	family_glupteba
behavioral2/memory/4336-201-0x0000000002E00000-0x00000000036EB000-memory.dmp	family_glupteba
behavioral2/memory/4336-202-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4336-237-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4336-308-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-339-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-417-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-432-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-436-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-440-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-444-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-448-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-452-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4284-456-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4208	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	b99cc58b450cf68801e301eaea9927a4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	nsa5536.tmp

Executes dropped EXE 10 IoCs

pid	Process
2144	InstallSetup7.exe
1068	31839b57a4f11171d6abc8bbc4451ee4.exe
3632	rty25.exe
4536	BroomSetup.exe
3124	nsa5536.tmp
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4284	csrss.exe
2020	injector.exe
2028	windefender.exe
4396	windefender.exe

Loads dropped DLL 4 IoCs

pid	Process
2144	InstallSetup7.exe
2144	InstallSetup7.exe
3124	nsa5536.tmp
3124	nsa5536.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e000000023229-421.dat	upx
behavioral2/files/0x000e000000023229-422.dat	upx
behavioral2/files/0x000e000000023229-424.dat	upx
behavioral2/memory/2028-425-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4396-433-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/4396-441-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	cmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	3124	WerFault.exe	98

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsa5536.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsa5536.tmp

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1468	schtasks.exe
3216	schtasks.exe
448	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4464	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	cmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3124	nsa5536.tmp
3124	nsa5536.tmp
3780	powershell.exe
3780	powershell.exe
3780	powershell.exe
1068	31839b57a4f11171d6abc8bbc4451ee4.exe
1068	31839b57a4f11171d6abc8bbc4451ee4.exe
1228	powershell.exe
1228	powershell.exe
1228	powershell.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
4336	31839b57a4f11171d6abc8bbc4451ee4.exe
2156	powershell.exe
2156	powershell.exe
2156	powershell.exe
4732	powershell.exe
4732	powershell.exe
4732	powershell.exe
3128	cmd.exe
3128	cmd.exe
3128	cmd.exe
4380	powershell.exe
4380	powershell.exe
4380	powershell.exe
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
4284	csrss.exe
4284	csrss.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
4284	csrss.exe
4284	csrss.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
4284	csrss.exe
4284	csrss.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe
2020	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	1068	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	1068	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	3128	cmd.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeSystemEnvironmentPrivilege	4284	csrss.exe
Token: SeSecurityPrivilege	2304	sc.exe
Token: SeSecurityPrivilege	2304	sc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2144	4824	b99cc58b450cf68801e301eaea9927a4.exe	90
PID 4824 wrote to memory of 2144	4824	b99cc58b450cf68801e301eaea9927a4.exe	90
PID 4824 wrote to memory of 2144	4824	b99cc58b450cf68801e301eaea9927a4.exe	90
PID 4824 wrote to memory of 1068	4824	b99cc58b450cf68801e301eaea9927a4.exe	91
PID 4824 wrote to memory of 1068	4824	b99cc58b450cf68801e301eaea9927a4.exe	91
PID 4824 wrote to memory of 1068	4824	b99cc58b450cf68801e301eaea9927a4.exe	91
PID 4824 wrote to memory of 3632	4824	b99cc58b450cf68801e301eaea9927a4.exe	92
PID 4824 wrote to memory of 3632	4824	b99cc58b450cf68801e301eaea9927a4.exe	92
PID 2144 wrote to memory of 4536	2144	InstallSetup7.exe	93
PID 2144 wrote to memory of 4536	2144	InstallSetup7.exe	93
PID 2144 wrote to memory of 4536	2144	InstallSetup7.exe	93
PID 4536 wrote to memory of 3312	4536	BroomSetup.exe	94
PID 4536 wrote to memory of 3312	4536	BroomSetup.exe	94
PID 4536 wrote to memory of 3312	4536	BroomSetup.exe	94
PID 3312 wrote to memory of 540	3312	cmd.exe	96
PID 3312 wrote to memory of 540	3312	cmd.exe	96
PID 3312 wrote to memory of 540	3312	cmd.exe	96
PID 3312 wrote to memory of 1468	3312	cmd.exe	97
PID 3312 wrote to memory of 1468	3312	cmd.exe	97
PID 3312 wrote to memory of 1468	3312	cmd.exe	97
PID 2144 wrote to memory of 3124	2144	InstallSetup7.exe	98
PID 2144 wrote to memory of 3124	2144	InstallSetup7.exe	98
PID 2144 wrote to memory of 3124	2144	InstallSetup7.exe	98
PID 1068 wrote to memory of 3780	1068	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 1068 wrote to memory of 3780	1068	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 1068 wrote to memory of 3780	1068	31839b57a4f11171d6abc8bbc4451ee4.exe	105
PID 4336 wrote to memory of 1228	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	110
PID 4336 wrote to memory of 1228	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	110
PID 4336 wrote to memory of 1228	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	110
PID 4336 wrote to memory of 4944	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	113
PID 4336 wrote to memory of 4944	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	113
PID 4944 wrote to memory of 4208	4944	cmd.exe	114
PID 4944 wrote to memory of 4208	4944	cmd.exe	114
PID 4336 wrote to memory of 2156	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	116
PID 4336 wrote to memory of 2156	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	116
PID 4336 wrote to memory of 2156	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	116
PID 4336 wrote to memory of 4732	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	118
PID 4336 wrote to memory of 4732	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	118
PID 4336 wrote to memory of 4732	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	118
PID 4336 wrote to memory of 4284	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	119
PID 4336 wrote to memory of 4284	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	119
PID 4336 wrote to memory of 4284	4336	31839b57a4f11171d6abc8bbc4451ee4.exe	119
PID 4284 wrote to memory of 3128	4284	csrss.exe	137
PID 4284 wrote to memory of 3128	4284	csrss.exe	137
PID 4284 wrote to memory of 3128	4284	csrss.exe	137
PID 4284 wrote to memory of 4380	4284	csrss.exe	124
PID 4284 wrote to memory of 4380	4284	csrss.exe	124
PID 4284 wrote to memory of 4380	4284	csrss.exe	124
PID 4284 wrote to memory of 4072	4284	csrss.exe	130
PID 4284 wrote to memory of 4072	4284	csrss.exe	130
PID 4284 wrote to memory of 4072	4284	csrss.exe	130
PID 4284 wrote to memory of 2020	4284	csrss.exe	132
PID 4284 wrote to memory of 2020	4284	csrss.exe	132
PID 2028 wrote to memory of 3128	2028	windefender.exe	137
PID 2028 wrote to memory of 3128	2028	windefender.exe	137
PID 2028 wrote to memory of 3128	2028	windefender.exe	137
PID 3128 wrote to memory of 2304	3128	cmd.exe	136
PID 3128 wrote to memory of 2304	3128	cmd.exe	136
PID 3128 wrote to memory of 2304	3128	cmd.exe	136
PID 3124 wrote to memory of 3452	3124	nsa5536.tmp	145
PID 3124 wrote to memory of 3452	3124	nsa5536.tmp	145
PID 3124 wrote to memory of 3452	3124	nsa5536.tmp	145
PID 3452 wrote to memory of 4464	3452	cmd.exe	141
PID 3452 wrote to memory of 4464	3452	cmd.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b99cc58b450cf68801e301eaea9927a4.exe
"C:\Users\Admin\AppData\Local\Temp\b99cc58b450cf68801e301eaea9927a4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3312
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:540
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:1468
- - C:\Users\Admin\AppData\Local\Temp\nsa5536.tmp
    C:\Users\Admin\AppData\Local\Temp\nsa5536.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 2396
      4⤵
      Program crash
      PID:4148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsa5536.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3452
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4208
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4732
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:3128
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:5096
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:3216
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2020
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:448
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2028
- C:\Users\Admin\AppData\Local\Temp\rty25.exe
  "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
  2⤵
  - Executes dropped EXE
  PID:3632

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4396

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3124 -ip 3124
1⤵
PID:4384

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
1⤵
- Delays execution with timeout.exe
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
277KB

MD5
c078816a0905a1e9f43b08c24c704471

SHA1
f040894c94215be2482e2a274999868d1b7539c6

SHA256
4b40b3ff4f4e4f32cab4ba8c9e74e09aff8c6d113f438c21cfd402b5a2ac8a3a

SHA512
04def648038774cebc69c5eb49671681a8869f2655cb908120ed02749b744d762934bee9639a87b7226e98881fd2ef8bed39a24cf6f5aeb36201419353c67264

Download Submit
C:\ProgramData\mozglue.dll

Filesize
128KB

MD5
a47c9a22d04f7a89ffb338ec0d9163f2

SHA1
c779b4e0bd380889d053a5a2e64fac7e5c9f0d85

SHA256
c67b8f01d1b007cf0abea4f89d1272a146116b398d97c0873889e4f3bc1aa2a5

SHA512
64ebbee2f2f0884096e5b0996b30adae289549ba24f19fb3858f638148f358cd9a6f2fb370c0b2a44e821cb00b5a49468f849c97e9aa8ee413bbae11b57d72f4

Download Submit
C:\ProgramData\nss3.dll

Filesize
390KB

MD5
2f89fc21fb93406bbb4f52d6e5239d0d

SHA1
4a0de47077257d7bd05e4a363592fd4c55618878

SHA256
e935aefb4bdb8f23dad6f03f813fe06e5f00b55f44056f63cb21bbe76fd60bcf

SHA512
0753ada04c14e2b7cb34b4c80cdbe9de2b5b5c5f7d5620642f8acfbdbba07eecb7a7fd016cedfaf1a7bb25b8c229a46bf529ee93dc1fa6e0a8a6c46e8082c82f

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
4d95c5aeb3401c376a5de24d3eae1347

SHA1
ff86551573ad69893abc45b73acd30d9f128d57d

SHA256
f3343fee8ef3fe59954b41f929c3fd5a4419af541e592271eb4c627ca3618286

SHA512
008b6d3f4e9bdf604638588c5f1cf485d88af029dd2503874167749446de53f26851af86c908b1ea319101adff1c3ae6048ea7748c932d3ae091fd4eb6dca041

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
329KB

MD5
d9b4c858f97e48d5315342d10a0d86e2

SHA1
2eca51c883a0d724ed8900305e410ee7e37b69ef

SHA256
d6de50db33ceaaae48677f0be72376c03bbc55bd2f388267c84e9b271f83b643

SHA512
03b7e3f6b347d65b3097c76ecff9561a075a93dde15904b38bb45aba0025ec3c412060365746b66f650be05e68f87788dbd0aabde5bf783b993ae6890c4f28a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
4.7MB

MD5
5e94f0f6265f9e8b2f706f1d46bbd39e

SHA1
d0189cba430f5eea07efe1ab4f89adf5ae2453db

SHA256
50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503

SHA512
473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe

Filesize
1.7MB

MD5
622c78526fb5a04ea3bc3b8576ff70d9

SHA1
f5379c153328f11583195c9dee50a34166c565a0

SHA256
ff403c56a19826bac772f0d8db374ec749b36075284670be22c21c7c96c62946

SHA512
d8901a01023f984c6dc1db20faac353da8d682b194830c66c493a1da12995aa9bebb507615c97cefb9430269d2440b29349e6562ea6a8395a1e5c9db50d9ec95

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nt31bp1r.rag.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa5536.tmp

Filesize
232KB

MD5
46f4253b03bb4662c8765ba4e708ed63

SHA1
23813b421eccbc0ff3aa10084b45f265f8aa138e

SHA256
a3848150ae9ee3d63fec9c296e76e5294fb84c276a7f775134dc74952937b639

SHA512
48645f175942a71e5840e76447b6e4ab4ef5e54d723dd22b557b621bb04711402f778903265d79bcc9aa5e65cc8a1ad7cc32581204f9021ab917755a99649580

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd5024.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rty25.exe

Filesize
369KB

MD5
766f223bfc10876ac9d479a69ae2146f

SHA1
89dac02805d1527e18b1e7a4b11cec3749086528

SHA256
149e5c04e1aa481ff8438ba6f2734195a01853ecbd109063b3a1101bf5102002

SHA512
cb8cf96263116ba840a1eec81811274b00b3ad5de9f46062b991538dc8ebadac0a7cfbc804deecaab4ef38a0cd30c99ce83e4e025078a7f581c05eb5f181b4df

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f15b4573927229e5b58652848ad772a2

SHA1
40dd17bba524df406bf949aa3e0c5aedc634541b

SHA256
461b34e0c646db63c3fa964452b635fbef26ec51c237f2aec68deeb87e0a7799

SHA512
86274dd4cd0b0d676bb07517e832566c24f2713f4c7822533e8a54e30deedc167d6ae7d29b676632ef493b5aa5ae12f32eaa719890cfc29fffc742544ff0d59d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
0ec1c85b0291cabc7e39c5e33ce119b7

SHA1
58d155fc5f303a84140b8e03b0e71804ee2f2631

SHA256
690ac96fb2a3e6ce3c0cf7f8ea18dd74e6a2b36bb2ce9a0cf5b82ae2fa5e3c61

SHA512
85893e83edcadd75dc303969958a68ac6fc42d819093209869c5b7de4c4eb74fd0ca45bbfbc51ea4d2244cfe5d1c07476b77acc7f45671b9ff3a2b1ecdba22b8

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
432e5dfba69b3cdb7dd95cecaf47f4c6

SHA1
ad966d4e07a9ce4b59a7aec51c0c61995c5a9588

SHA256
fad40274abe63bfee432df6d490f354192964cc25c80d98f0de32d0161990273

SHA512
74dc76044868c4bf5e1bc90489147376a3c82d69ac4a16ae8b09a750490d45f1b4ea17085ae614c9b1df4b663e9037612f60558aa4a8f9c9034d63923de532dc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f8e9eccfbd80965b11727ce418787b03

SHA1
a670fc960cc4bb1870d8d0ef26aa4beaa592caa1

SHA256
9392da9ba9d2aac92b9f6f7db36d60f93f3ed4c95d2d337e3d38195f620d549b

SHA512
5e12bf89afa72c71257e151dbf5a530bdbcb1396446d2a526626110db95312783181b95f44ae3dc72a031e040874d009c68d7d2e4fc588944d14987aea22a4ef

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
13bc34ecf0120353ea3d41c36b520811

SHA1
b60900454e5c27aea196014a7830be905b4639ea

SHA256
13f7b966a2e414826236f3ef495c3648e1d8b1d7727182bfc6e1a14b57876abb

SHA512
db6630fb0cd4f815b2fe1108f82c2f6abb4e445f84d8588350e3858ab8c3c7889c6b131000ce62a18ab2da6a87be0ee3242c035b19d52a073b97108ae392c2a5

Download Submit
C:\Windows\rss\csrss.exe

Filesize
389KB

MD5
9ff4e30e610b9179e7754e0cf4f1a178

SHA1
cb6fd0d72b7b93b83502154e7a6d99b263a7a9a9

SHA256
b3de850eebd986313a5819b8c816da72f7ec71a28a51609546296c3d06ab995d

SHA512
7f04b0204485e70e6cf0589be49e8db722f3d72d44f932f7a5e139c6a9b4b8dcf714c907f0d3b6c053549c4105a2cb631835ea843bcb46d65441fa03a3503c63

Download Submit
C:\Windows\rss\csrss.exe

Filesize
201KB

MD5
39e00c6e869f2f68ed0d26dce155207d

SHA1
ca2ad7b7057f9593f17f110705bf4567dd16b4e3

SHA256
3d365f9de2a5fbce1b3712c07a51725678bdc4a3a7b151966b76b6b98fe00094

SHA512
2deef165e6bf325748b28e0d22993e145722e94fc1961d570e057b24a53122c514640dce60a044648280fb8e85e32cf3867821b6417f5c55fd66509d2145402d

Download Submit
C:\Windows\windefender.exe

Filesize
206KB

MD5
c3f578c7f7ce0c3f86ca1569309a7b96

SHA1
5767b8c197dc88e75311abdba264476179c1346e

SHA256
8a5d8ba76c12a83f40b14f70819c58576e15029a452a3e95f2269412b0079341

SHA512
9788c848f9b87ea86eb6af86551f042a63a10a6d982fbbe62157377c508307a6657bb3e4a19698e8a73f4fdf819df25c6841971659be546af5330671ba04734a

Download Submit
C:\Windows\windefender.exe

Filesize
332KB

MD5
3cf64503becdb60cb99e9fcee86b5a48

SHA1
27829b363cb27c4c6060502e5536d9c070389a90

SHA256
783f0cc41b4e7476e8226520ad6e47730a306fba622a29b26b7a30a7f68de947

SHA512
3afcc5a9c8367666a591221a292fbd169b7ae441ca8c31960c71206ef14db1a67f405e3e507f1e17753dfaccf3b424482626dd1574099c9834852d30425c8118

Download Submit
C:\Windows\windefender.exe

Filesize
354KB

MD5
f7f4a989796c2417ed0c29eb1e9a4047

SHA1
0d1417d025d366f73e1ab3b8fcb37a5ca31e5759

SHA256
bf7d2f37e50a866c1ba4e2f7efd2c5c775c558d50480130d3ff36b215ae5b700

SHA512
669dc0f494e1adfdb78f37f62ed4ed128e5422c215e6a178ef454e4603519ce35df0b24635ec7cfa324454a942520e3d79a9f600cb21ded40fb33b1b84660f2d

Download Submit
memory/1068-104-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1068-103-0x0000000002E40000-0x000000000372B000-memory.dmp

Filesize
8.9MB

Download
memory/1068-102-0x0000000002A30000-0x0000000002E34000-memory.dmp

Filesize
4.0MB

Download
memory/1068-186-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1068-188-0x0000000002E40000-0x000000000372B000-memory.dmp

Filesize
8.9MB

Download
memory/1068-137-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1228-228-0x0000000003430000-0x0000000003440000-memory.dmp

Filesize
64KB

Download
memory/1228-229-0x0000000007B90000-0x0000000007C33000-memory.dmp

Filesize
652KB

Download
memory/1228-218-0x00000000714D0000-0x0000000071824000-memory.dmp

Filesize
3.3MB

Download
memory/1228-214-0x0000000006ED0000-0x0000000006F1C000-memory.dmp

Filesize
304KB

Download
memory/1228-204-0x0000000003430000-0x0000000003440000-memory.dmp

Filesize
64KB

Download
memory/1228-203-0x0000000072E90000-0x0000000073640000-memory.dmp

Filesize
7.7MB

Download
memory/1228-217-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

Filesize
64KB

Download
memory/1228-216-0x0000000072030000-0x000000007207C000-memory.dmp

Filesize
304KB

Download
memory/1228-230-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

Filesize
68KB

Download
memory/1228-231-0x0000000007EF0000-0x0000000007F04000-memory.dmp

Filesize
80KB

Download
memory/1228-234-0x0000000072E90000-0x0000000073640000-memory.dmp

Filesize
7.7MB

Download
memory/2028-425-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2156-238-0x0000000072E90000-0x0000000073640000-memory.dmp

Filesize
7.7MB

Download
memory/2156-239-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/2156-249-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/3124-59-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/3124-57-0x0000000000940000-0x0000000000A40000-memory.dmp

Filesize
1024KB

Download
memory/3124-58-0x00000000008B0000-0x00000000008CC000-memory.dmp

Filesize
112KB

Download
memory/3124-195-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/3124-60-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3124-307-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/3124-153-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/3124-113-0x0000000000940000-0x0000000000A40000-memory.dmp

Filesize
1024KB

Download
memory/3124-427-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/3632-30-0x00007FF637D10000-0x00007FF637D74000-memory.dmp

Filesize
400KB

Download
memory/3632-196-0x0000000003380000-0x000000000348C000-memory.dmp

Filesize
1.0MB

Download
memory/3632-197-0x00000000035C0000-0x00000000036F0000-memory.dmp

Filesize
1.2MB

Download
memory/3780-138-0x00000000071B0000-0x00000000071E2000-memory.dmp

Filesize
200KB

Download
memory/3780-168-0x00000000073B0000-0x00000000073B8000-memory.dmp

Filesize
32KB

Download
memory/3780-159-0x0000000007300000-0x000000000730A000-memory.dmp

Filesize
40KB

Download
memory/3780-139-0x0000000071FF0000-0x000000007203C000-memory.dmp

Filesize
304KB

Download
memory/3780-184-0x0000000072E90000-0x0000000073640000-memory.dmp

Filesize
7.7MB

Download
memory/3780-152-0x00000000071F0000-0x000000000720E000-memory.dmp

Filesize
120KB

Download
memory/3780-154-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/3780-141-0x00000000714D0000-0x0000000071824000-memory.dmp

Filesize
3.3MB

Download
memory/3780-160-0x00000000073C0000-0x0000000007456000-memory.dmp

Filesize
600KB

Download
memory/3780-136-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Filesize
104KB

Download
memory/3780-135-0x00000000076D0000-0x0000000007D4A000-memory.dmp

Filesize
6.5MB

Download
memory/3780-134-0x0000000006FD0000-0x0000000007046000-memory.dmp

Filesize
472KB

Download
memory/3780-133-0x0000000006040000-0x0000000006084000-memory.dmp

Filesize
272KB

Download
memory/3780-132-0x0000000005C70000-0x0000000005CBC000-memory.dmp

Filesize
304KB

Download
memory/3780-131-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Filesize
120KB

Download
memory/3780-116-0x0000000005570000-0x00000000055D6000-memory.dmp

Filesize
408KB

Download
memory/3780-127-0x0000000005750000-0x0000000005AA4000-memory.dmp

Filesize
3.3MB

Download
memory/3780-117-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/3780-115-0x0000000004D60000-0x0000000004D82000-memory.dmp

Filesize
136KB

Download
memory/3780-111-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/3780-114-0x0000000004DA0000-0x00000000053C8000-memory.dmp

Filesize
6.2MB

Download
memory/3780-161-0x0000000007320000-0x0000000007331000-memory.dmp

Filesize
68KB

Download
memory/3780-165-0x0000000007360000-0x000000000736E000-memory.dmp

Filesize
56KB

Download
memory/3780-142-0x000000007F020000-0x000000007F030000-memory.dmp

Filesize
64KB

Download
memory/3780-158-0x0000000007210000-0x00000000072B3000-memory.dmp

Filesize
652KB

Download
memory/3780-166-0x0000000007370000-0x0000000007384000-memory.dmp

Filesize
80KB

Download
memory/3780-110-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/3780-108-0x0000000000E80000-0x0000000000EB6000-memory.dmp

Filesize
216KB

Download
memory/3780-109-0x0000000072E90000-0x0000000073640000-memory.dmp

Filesize
7.7MB

Download
memory/3780-167-0x0000000007460000-0x000000000747A000-memory.dmp

Filesize
104KB

Download
memory/4284-432-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-456-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-339-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-452-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-448-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-444-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-440-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-417-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4284-436-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4336-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4336-201-0x0000000002E00000-0x00000000036EB000-memory.dmp

Filesize
8.9MB

Download
memory/4336-200-0x0000000002900000-0x0000000002CFE000-memory.dmp

Filesize
4.0MB

Download
memory/4336-202-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4336-308-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4396-433-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4396-441-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4536-37-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/4536-140-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/4536-112-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/4824-1-0x00000000003C0000-0x0000000000A1A000-memory.dmp

Filesize
6.4MB

Download
memory/4824-29-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download
memory/4824-0-0x00000000747D0000-0x0000000074F80000-memory.dmp

Filesize
7.7MB

Download