amadey | 75bcc7144c36d2931b31364db4d3b3fc44b1ad803790ea1077f228efc715bb6d

Analysis

max time kernel
126s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toolspub1.exe
Size 215KB
Sample240122-e4mjxsgcep
SHA256 75bcc7144c36d2931b31364db4d3b3fc44b1ad803790ea1077f228efc715bb6d
MD5 f73e509c71abc1b5c789834510e117c7
SHA1 de658fac7257ed1c10b11c1b96cee672ddb41277
SHA512 a176bfe67b62c770cb4c306c35d7e2c19de00adea9f6eb980d3eb6ee56ef4c29cb3b97bc8f73e6be59f30db408ad5c3d43dc5eb088016f7faf791ad4304c164d
SSDEEP 3072:/VAVkKKz6bqDShp/wnMBy7twMMZ5IQbt6POZ5GhdAhgMXEfpF:/V123pj6yNt6UGH4gMXI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey djvu redline smokeloader zgrat logsdiller cloud (tg: @logsdillabot)pub1 st12 backdoor discovery infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdpo
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

45.15.156.60:12050

Extracted

Family

amadey

Version

4.17

http://185.196.10.34

Attributes

install_dir
eff1401c19
install_file
Dctooux.exe
strings_key
6e23b5eadc27bb0b2eaebdd4fed1beb2
url_paths
/b8sdjsdkS/index.php

rc4.plain

Extracted

Family

redline

Botnet

ST12

185.172.128.33:38294

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 21 IoCs

resource	yara_rule
behavioral2/memory/1272-114-0x0000000004E80000-0x0000000004F4A000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-115-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-116-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-118-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-138-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-148-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-146-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-144-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-142-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-140-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-136-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-134-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-132-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-130-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-128-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-126-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-124-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-122-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-120-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-150-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1
behavioral2/memory/1272-152-0x0000000004E80000-0x0000000004F43000-memory.dmp	family_zgrat_v1

Detected Djvu ransomware 9 IoCs

resource	yara_rule
behavioral2/memory/3736-25-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1016-24-0x0000000002270000-0x000000000238B000-memory.dmp	family_djvu
behavioral2/memory/3736-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3736-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3736-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3736-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2680-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2680-50-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2680-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/2544-76-0x0000000000400000-0x0000000000454000-memory.dmp	family_redline
behavioral2/memory/4896-1076-0x0000000000970000-0x00000000009C4000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	B8E1.exe

Deletes itself 1 IoCs

pid	Process
3568	Process not Found

Executes dropped EXE 9 IoCs

pid	Process
412	A856.exe
1016	B8E1.exe
3736	B8E1.exe
2664	B8E1.exe
2680	B8E1.exe
4412	E745.exe
4712	FD2F.exe
4296	3BCB.exe
1272	3E9B.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4672	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c86d0962-5bbd-4702-a806-8665945361f2\\B8E1.exe\" --AutoStart"	B8E1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	api.2ip.ua
28	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 3736	1016	B8E1.exe	97
PID 2664 set thread context of 2680	2664	B8E1.exe	101
PID 4712 set thread context of 2544	4712	FD2F.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2680	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A856.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A856.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2280	toolspub1.exe
2280	toolspub1.exe
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2280	toolspub1.exe
412	A856.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	2544	RegAsm.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	1272	3E9B.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3568	Process not Found

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 412	3568	Process not Found	95
PID 3568 wrote to memory of 412	3568	Process not Found	95
PID 3568 wrote to memory of 412	3568	Process not Found	95
PID 3568 wrote to memory of 1016	3568	Process not Found	96
PID 3568 wrote to memory of 1016	3568	Process not Found	96
PID 3568 wrote to memory of 1016	3568	Process not Found	96
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 1016 wrote to memory of 3736	1016	B8E1.exe	97
PID 3736 wrote to memory of 4672	3736	B8E1.exe	98
PID 3736 wrote to memory of 4672	3736	B8E1.exe	98
PID 3736 wrote to memory of 4672	3736	B8E1.exe	98
PID 3736 wrote to memory of 2664	3736	B8E1.exe	99
PID 3736 wrote to memory of 2664	3736	B8E1.exe	99
PID 3736 wrote to memory of 2664	3736	B8E1.exe	99
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 2664 wrote to memory of 2680	2664	B8E1.exe	101
PID 3568 wrote to memory of 4412	3568	Process not Found	106
PID 3568 wrote to memory of 4412	3568	Process not Found	106
PID 3568 wrote to memory of 4412	3568	Process not Found	106
PID 3568 wrote to memory of 4712	3568	Process not Found	107
PID 3568 wrote to memory of 4712	3568	Process not Found	107
PID 3568 wrote to memory of 4712	3568	Process not Found	107
PID 4712 wrote to memory of 4468	4712	FD2F.exe	108
PID 4712 wrote to memory of 4468	4712	FD2F.exe	108
PID 4712 wrote to memory of 4468	4712	FD2F.exe	108
PID 4712 wrote to memory of 4608	4712	FD2F.exe	110
PID 4712 wrote to memory of 4608	4712	FD2F.exe	110
PID 4712 wrote to memory of 4608	4712	FD2F.exe	110
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 4712 wrote to memory of 2544	4712	FD2F.exe	109
PID 3568 wrote to memory of 4296	3568	Process not Found	111
PID 3568 wrote to memory of 4296	3568	Process not Found	111
PID 3568 wrote to memory of 1272	3568	Process not Found	112
PID 3568 wrote to memory of 1272	3568	Process not Found	112
PID 3568 wrote to memory of 1272	3568	Process not Found	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2280

C:\Users\Admin\AppData\Local\Temp\A856.exe
C:\Users\Admin\AppData\Local\Temp\A856.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:412

C:\Users\Admin\AppData\Local\Temp\B8E1.exe
C:\Users\Admin\AppData\Local\Temp\B8E1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\B8E1.exe
  C:\Users\Admin\AppData\Local\Temp\B8E1.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\c86d0962-5bbd-4702-a806-8665945361f2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\B8E1.exe
    "C:\Users\Admin\AppData\Local\Temp\B8E1.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\B8E1.exe
      "C:\Users\Admin\AppData\Local\Temp\B8E1.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 568
        5⤵
        Program crash
        
        PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2680 -ip 2680
1⤵
PID:2484

C:\Users\Admin\AppData\Local\Temp\E745.exe
C:\Users\Admin\AppData\Local\Temp\E745.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Users\Admin\AppData\Local\Temp\FD2F.exe
C:\Users\Admin\AppData\Local\Temp\FD2F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4608

C:\Users\Admin\AppData\Local\Temp\3BCB.exe
C:\Users\Admin\AppData\Local\Temp\3BCB.exe
1⤵
- Executes dropped EXE
PID:4296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  PID:4896

C:\Users\Admin\AppData\Local\Temp\3E9B.exe
C:\Users\Admin\AppData\Local\Temp\3E9B.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1272
- C:\Users\Admin\AppData\Local\Temp\3E9B.exe
  C:\Users\Admin\AppData\Local\Temp\3E9B.exe
  2⤵
  PID:556
- C:\Users\Admin\AppData\Local\Temp\3E9B.exe
  C:\Users\Admin\AppData\Local\Temp\3E9B.exe
  2⤵
  PID:3808

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2624

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:244

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4256

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2528

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4364

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2440

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Size 471B
SHA256 eb402a1ef785ac1c0e8503c0a03a5159369e075807b826a1bc51307666fa0ed2
MD5 bcbef1fe6d73aec6b11786732c295e76
SHA1 6abb8bf425fe6293398b6cce3da28db618605085
SHA512 2fa1013a712cc3ca11a46e471d50def7b57e041c9ed9fadf1afeb32da667c9f77ab266ba9081188696a71215a289705df9beba974359c4feb839fc1b712038bb
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Size 412B
SHA256 00a3aebdb994326924e514a5ff4adde2df4180bc138fbe89edc5639e4f7b4685
MD5 6df4fe259fb52e864405d8002caeb29d
SHA1 11e7f86224a360eb34a5de881fc061bfce5fd5ae
SHA512 78af5a370a9631d96638bbfd35f1c4c10efb58f6e73e7a517ba929965d1fa4156204d6d4ff4988e72b6028260a6e413fe849e0e9e5ad2ca75277ca1ff3916817
MD5 SHA1 SHA512

Submit Download

3BCB.exe

Path C:\Users\Admin\AppData\Local\Temp\3BCB.exe
Size 3.0MB
SHA256 e6ae5b6acc33e5a048513f1a6b34992cd1f3e6f2e4b05d31ba713d53bee52d17
MD5 d1dded05e9a2c1d968fe762f2f019917
SHA1 a8ff48bdf61763d585598ea849f2013c1e97cf7c
SHA512 a5affc442b99d381f912613b2e13dfb63e4ef23b7ad84b785129ad80ce1374f35e661da82816346b077c580427fe750306a397d3d6017f67c4206ecb23ddc6ca
SSDEEP 24576:h3tPpZDHhceLiUcLIvOHjt7OBiMHcSAsjgJRZMa2Yoir4PsqAdJSvysQ0wct/VFE:h5XDBVLkIvwKZHcujglHoi6EJS4fan1
MD5 SHA1 SHA512 SSDEEP

Submit Download

3E9B.exe

Path C:\Users\Admin\AppData\Local\Temp\3E9B.exe
Size 133KB
SHA256 0a0f68964d88d0f76bdd69f1a9a574b886d7b1842d25b0941af163fce3b00497
MD5 1de2d74358f370d9332d26b8ddfd19bf
SHA1 d694006558f3b4a1282c50b84af06269d8542153
SHA512 f13a2c32e907e647374767eed0a17270eba9c8a3e6d9ebeae1436572a04cfb2eb3c63aa25e98d32525214984dbc8128511439824f9f6d2dcfc2caf6f78987ac0
SSDEEP 3072:/QXf3kmJRsTHs+nWihNZgSoQeVeebhnW5f62+lputx7xlVf:2kXs+WiXZg/VewxW5elputRFf
MD5 SHA1 SHA512 SSDEEP

Submit Download

3E9B.exe

Path C:\Users\Admin\AppData\Local\Temp\3E9B.exe
Size 259KB
SHA256 2b76d668a25b0869f1ba4fbb74f6d21f031afad62833db620a97530fad78e9a1
MD5 23c84b4161c53e04abffcc150b909863
SHA1 f8ae6680980df80968d4ba7a6e45c2374570deee
SHA512 75484c4cd47e8cf30e4cf776c2dd50f6e5b811ec6e7beabf23b0a9d389062bd0792192013de428a9867711ade41aacfc57cf402e0022b8a30c95a386536a6641
SSDEEP 6144:2kXs+WiXZg/VewxW5elputRFrClJxdi9eEdSDW0Pk6OWGlzXb:zc+WiaJxW5LtRFrOL6fSSGBqlzXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

3E9B.exe

Path C:\Users\Admin\AppData\Local\Temp\3E9B.exe
Size 763KB
SHA256 585892aac1dd2104c9dc5badf75efbc0d5f363456c084741af5e251402473de0
MD5 14f7c4b98e2c837e555d030bfbe740c4
SHA1 695e50ac70754d449445343764d8a0c339323a04
SHA512 c72065546378ea95362d370b6e5fe6aa75e197c2a156193057f6ffe0f4c010ad3a2d7b6d024b02f7aee91b97dd6740833911107bcdb8a7fae2316e0ef8228cc5
SSDEEP 12288:zc+WiaJxW5LtRFrOL6fSSGBqlzXoDlT4du0PXfk2IFY1Xr6id3Ah44b7PaiSBXAc:zcy/HLaT4zXoD6EIX8H7h44b7P8ARrEN
MD5 SHA1 SHA512 SSDEEP

Submit Download

A856.exe

Path C:\Users\Admin\AppData\Local\Temp\A856.exe
Size 215KB
SHA256 75bcc7144c36d2931b31364db4d3b3fc44b1ad803790ea1077f228efc715bb6d
MD5 f73e509c71abc1b5c789834510e117c7
SHA1 de658fac7257ed1c10b11c1b96cee672ddb41277
SHA512 a176bfe67b62c770cb4c306c35d7e2c19de00adea9f6eb980d3eb6ee56ef4c29cb3b97bc8f73e6be59f30db408ad5c3d43dc5eb088016f7faf791ad4304c164d
SSDEEP 3072:/VAVkKKz6bqDShp/wnMBy7twMMZ5IQbt6POZ5GhdAhgMXEfpF:/V123pj6yNt6UGH4gMXI
MD5 SHA1 SHA512 SSDEEP

Submit Download

B8E1.exe

Path C:\Users\Admin\AppData\Local\Temp\B8E1.exe
Size 769KB
SHA256 5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073
MD5 6b3c3b621f4964f232d23c7b32a2e486
SHA1 dc7a1111a7fa4380b42dfa8e6d1b22b338aa10fc
SHA512 78b0b893295e5c8c811618638bfb9fcca2daef20b209ef4f0aeb400372b9827ff8b01325427ee41091dfb9d6b3c334510a6f2b4cccf407970cf72adb0bb2b293
SSDEEP 24576:nAVmJoIjqT53ve6LT/8EMuuV1y5SYVWuQWJb:AoJ/Q5XHz+7yA5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

B8E1.exe

Path C:\Users\Admin\AppData\Local\Temp\B8E1.exe
Size 324KB
SHA256 d3448b36a8b0670d7df7eafae259454dcc2e555a1e22dacba57cbf380b952231
MD5 d87f72e6c6a1090b5da95b4b6284eb49
SHA1 e046a7a71d439fcc3dec4ce874cdb45e643815ac
SHA512 c51bbdf0f897d0f27e9eeebe8df94ca3a6061002daa0459d411184728b46e56d11139e3183c780a303b34add293e4b4758a229fa8e768438598d61f78d959e09
SSDEEP 6144:fvAVhsJoEgvwpjVwwCoY5r3mw9JkvBoQNngJLFhpwwDhsviJGG2wwvVjD:nAVhsJoApjqT5r3veuQ1gJLTqqhskGHp
MD5 SHA1 SHA512 SSDEEP

Submit Download

B8E1.exe

Path C:\Users\Admin\AppData\Local\Temp\B8E1.exe
Size 503KB
SHA256 26a68adcdd98655be99271ca738788930c8b84912685334f94938868658d12fc
MD5 7fe505279904cef476556a485617e112
SHA1 e04392eca01a2b67eebca0c21cc4c1f892a80f04
SHA512 50df9ed611e46238c0daa7299217c149b49f60c1fd44fc19faba958b6590e341b71f4b1b466057f86a5ab3b47463a676b51bc7a32825ab7c893c355292a16919
SSDEEP 12288:nAVhsJoApjqT5r3veuQ1gJLTqqhskGHdi5OEdayfSTV1y50b9:nAVmJoIjqT53ve6LT/8EMuuV1y5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

E745.exe

Path C:\Users\Admin\AppData\Local\Temp\E745.exe
Size 3.3MB
SHA256 ebfe3c1790f1afb9a4038161533417717bd6fab4908b88760d8bf545ad84e106
MD5 845513b36fce736e29e68ba567e25e16
SHA1 d398df08d09877b26c9f304cc29529233991978d
SHA512 8e564f7603c46131ea2c39a511ba1bc77d3d538466e315d185727d6906881e451c09cf73196f2d79ec33b4ca195c99cb05f2cd79f740074968751db49c3033bf
SSDEEP 98304:M4yXzpL0zkzzkDLtFonE7PrVWfNmA2iQrPJVzpI:+jKBBZbrcX8P2
MD5 SHA1 SHA512 SSDEEP

Submit Download

E745.exe

Path C:\Users\Admin\AppData\Local\Temp\E745.exe
Size 2.7MB
SHA256 a31cb1c7e2680b76c6d6bb88335190458477e0a7a8ec5f805610d61187bc1fa5
MD5 870afd427fc356ce11beb5f295c7ce55
SHA1 ef6e73d56adb3ff77dc4d109e7e9fc0a56a32087
SHA512 1cb43b5ac0a4453294122ccb56db652a625e1dc289c07befbb844d73dc064744781b0f0ff8ae027da6a4b05020292b65fd460f9f50a8457a08c64e98f92667ca
SSDEEP 49152:Bf64oqD3OHRdtKiOSztY4Mt5GXkzQ/zzkbQmyukuFslTQc9Wck7Pg+nVzYJNZRsI:M4yXzpL0zkzzkDLtFonE7PrVWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

FD2F.exe

Path C:\Users\Admin\AppData\Local\Temp\FD2F.exe
Size 380KB
SHA256 52c5799b3c93ca11e9953e8a5712a82dd08b6cb0c17ff90cb1d2cb104411e7d4
MD5 d9ec192c82b59ae4dfae55218b19530f
SHA1 d7170975baf5f27ea0591a33f45cddb63574ac94
SHA512 7ed6906f71ac045b2a4732935995abdfde68d88fe6041b19f114dfb95fb943450d5cbfbf1d185d3a2febb29c7d3493b9c1247a84925a5e7af41e1c710cc77838
SSDEEP 6144:PEoesq1winLJAQErRy1XycpVzobMFsorZ7dKfTpYrBruEfUgDPih4WoqyyQ5V0O0:PssU/JALF0XycLzobws+7d6T2rBJfUIi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\eff1401c19\Dctooux.exe
Size 75KB
SHA256 9a3151fc0bcca402822daf8c2d4d02e9e441f108d97f46f5533f3b0d92f01c64
MD5 e522360d97131c701737d62512041cdc
SHA1 be794d0eb672be3c33bd74aa2d7519b03ff09893
SHA512 af7b1273c7406fb91c4a9109e44152848f4322c2967766f8187d788eca07d26c35f5c0d8103236dab755a56ed15a870b800f5a4f761715cdfcfa96aeba093ed8
SSDEEP 1536:/QXsDysv4rmAmaQEZ7ym5XR2lTHso3nZYihNU+gSoQeVezP2:/QXf3kmJRsTHs+nWihNZgSoQeVeK
MD5 SHA1 SHA512 SSDEEP

Submit Download

B8E1.exe

Path C:\Users\Admin\AppData\Local\c86d0962-5bbd-4702-a806-8665945361f2\B8E1.exe
Size 576KB
SHA256 e5bcb1553a577932133f0a8d78740121fdb32fdab7177faa23465477951ceb07
MD5 46a8508dc04ebc1f6490bcc971d18554
SHA1 2921a1fe6476cd01283040a28a3f5168f925ea44
SHA512 08a1700f485893384e6c6ab2feffa771b2fc88ce94ab99e8260ccf06726f45865908b947233dba817b33e6c6eb65ebbb191ca061039885bdc3219fa82cd21a15
SSDEEP 12288:nAVhsJoApjqT5r3veuQ1gJLTqqhskGHdi5OEdayfSTV1y50bzRyuwq2a4N:nAVmJoIjqT53ve6LT/8EMuuV1y5SYN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-37-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/412-17-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/412-16-0x0000000000570000-0x0000000000670000-memory.dmp

Download

memory/556-1070-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/556-1085-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1016-24-0x0000000002270000-0x000000000238B000-memory.dmp

Download

memory/1016-23-0x0000000002180000-0x0000000002221000-memory.dmp

Download

memory/1272-140-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-122-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-1068-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/1272-1062-0x0000000005010000-0x000000000505C000-memory.dmp

Download

memory/1272-1061-0x0000000004FB0000-0x0000000005010000-memory.dmp

Download

memory/1272-1060-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download

memory/1272-152-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-150-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-120-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-124-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-126-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-128-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-130-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-132-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-134-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-136-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-142-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-144-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-146-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-148-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-138-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-118-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-116-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-115-0x0000000004E80000-0x0000000004F43000-memory.dmp

Download

memory/1272-113-0x0000000004D40000-0x0000000004E08000-memory.dmp

Download

memory/1272-114-0x0000000004E80000-0x0000000004F4A000-memory.dmp

Download

memory/1272-112-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/1272-110-0x0000000000450000-0x0000000000516000-memory.dmp

Download

memory/1272-111-0x00000000749C0000-0x0000000075170000-memory.dmp

Download

memory/2280-2-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2280-1-0x0000000000680000-0x0000000000780000-memory.dmp

Download

memory/2280-5-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2280-3-0x00000000004C0000-0x00000000004CB000-memory.dmp

Download

memory/2544-90-0x0000000005A50000-0x0000000005A62000-memory.dmp

Download

memory/2544-86-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/2544-94-0x0000000006460000-0x00000000064C6000-memory.dmp

Download

memory/2544-97-0x00000000087D0000-0x0000000008CFC000-memory.dmp

Download

memory/2544-76-0x0000000000400000-0x0000000000454000-memory.dmp

Download

memory/2544-92-0x0000000005B00000-0x0000000005B4C000-memory.dmp

Download

memory/2544-89-0x0000000006160000-0x000000000626A000-memory.dmp

Download

memory/2544-91-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

Download

memory/2544-95-0x0000000007EB0000-0x0000000007F00000-memory.dmp

Download

memory/2544-88-0x0000000006780000-0x0000000006D98000-memory.dmp

Download

memory/2544-87-0x0000000005690000-0x000000000569A000-memory.dmp

Download

memory/2544-99-0x00000000749D0000-0x0000000075180000-memory.dmp

Download

memory/2544-82-0x00000000056A0000-0x0000000005732000-memory.dmp

Download

memory/2544-83-0x00000000749D0000-0x0000000075180000-memory.dmp

Download

memory/2544-96-0x00000000080D0000-0x0000000008292000-memory.dmp

Download

memory/2544-80-0x0000000005BB0000-0x0000000006154000-memory.dmp

Download

memory/2664-47-0x00000000021D0000-0x0000000002272000-memory.dmp

Download

memory/2680-52-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2680-50-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2680-49-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3568-4-0x0000000002460000-0x0000000002476000-memory.dmp

Download

memory/3568-36-0x00000000024D0000-0x00000000024E6000-memory.dmp

Download

memory/3736-28-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3736-27-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3736-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3736-43-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3736-25-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4412-61-0x00000000000F0000-0x00000000009A4000-memory.dmp

Download

memory/4412-63-0x0000000001550000-0x0000000001551000-memory.dmp

Download

memory/4412-59-0x0000000001540000-0x0000000001541000-memory.dmp

Download

memory/4412-100-0x0000000001550000-0x0000000001551000-memory.dmp

Download

memory/4412-64-0x0000000001550000-0x0000000001551000-memory.dmp

Download

memory/4412-93-0x00000000000F0000-0x00000000009A4000-memory.dmp

Download

memory/4412-60-0x00000000000F0000-0x00000000009A4000-memory.dmp

Download

memory/4412-65-0x0000000001550000-0x0000000001551000-memory.dmp

Download

memory/4712-79-0x0000000003360000-0x0000000005360000-memory.dmp

Download

memory/4712-81-0x00000000749D0000-0x0000000075180000-memory.dmp

Download

memory/4712-75-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/4712-72-0x00000000749D0000-0x0000000075180000-memory.dmp

Download

memory/4712-71-0x0000000000E10000-0x0000000000E74000-memory.dmp

Download

memory/4896-1076-0x0000000000970000-0x00000000009C4000-memory.dmp

Download

memory/4896-1079-0x0000000005150000-0x0000000005160000-memory.dmp

Download

memory/4896-1077-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

memory/4896-1080-0x0000000005640000-0x000000000568C000-memory.dmp

Download