djvu | 0f4d1e6a36a2f6fc4e29b9134a49a081b305501bb6394367f2f48a0387b02c68

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toolspub1.exe
Size 237KB
Sample240125-ced55sdgg2
SHA256 0f4d1e6a36a2f6fc4e29b9134a49a081b305501bb6394367f2f48a0387b02c68
MD5 fbba6e587d5700e84b4badbd6fcb3123
SHA1 6f4c4e6b88e7cbf87dc70427513a39725ee3110d
SHA512 d76e5b8adb3c01c85b1dd297f53518a47f90668aa73759461d94cf957f6b73a132fa57eac0b0feda4d6a2187e7c1b11ec5ccd662505e3b91f0e57cfa047a732b
SSDEEP 3072:ctBS+BisPLWLi80S9pikUD0I54tP1frogEO1u5Nwinh0/b9r:4LMi80+p5UH54N18g4winh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu smokeloader vidar pub1 backdoor discovery persistence ransomware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdpo
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral1/memory/1512-130-0x0000000000400000-0x000000000063F000-memory.dmp	family_vidar_v6
behavioral1/memory/1512-131-0x0000000000400000-0x000000000063F000-memory.dmp	family_vidar_v6
behavioral1/memory/1512-127-0x0000000000400000-0x000000000063F000-memory.dmp	family_vidar_v6
behavioral1/memory/2056-126-0x0000000000230000-0x000000000025C000-memory.dmp	family_vidar_v6
behavioral1/memory/1512-280-0x0000000000400000-0x000000000063F000-memory.dmp	family_vidar_v6

Detected Djvu ransomware 14 IoCs

resource	yara_rule
behavioral1/memory/2580-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2604-32-0x0000000002B90000-0x0000000002CAB000-memory.dmp	family_djvu
behavioral1/memory/2580-41-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2580-42-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-85-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-86-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2580-71-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-102-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-101-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-106-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-108-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-109-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-132-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/632-204-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
1252	Process not Found

Executes dropped EXE 15 IoCs

pid	Process
2988	A18D.exe
2604	B7EB.exe
2580	B7EB.exe
2620	C055.exe
2416	B7EB.exe
632	B7EB.exe
2056	build2.exe
1512	build2.exe
2512	build3.exe
1752	build3.exe
2960	wguewhw
580	mstsca.exe
3068	mstsca.exe
2140	mstsca.exe
2992	mstsca.exe

Loads dropped DLL 12 IoCs

pid	Process
2604	B7EB.exe
2580	B7EB.exe
2580	B7EB.exe
2416	B7EB.exe
632	B7EB.exe
632	B7EB.exe
632	B7EB.exe
632	B7EB.exe
2644	WerFault.exe
2644	WerFault.exe
2644	WerFault.exe
2644	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
596	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\40501dd2-ad84-4f52-95ab-7b6b73edc5ab\\B7EB.exe\" --AutoStart"	B7EB.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.2ip.ua
9	api.2ip.ua
10	api.2ip.ua

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2604 set thread context of 2580	2604	B7EB.exe	30
PID 2416 set thread context of 632	2416	B7EB.exe	33
PID 2056 set thread context of 1512	2056	build2.exe	38
PID 2512 set thread context of 1752	2512	build3.exe	43
PID 580 set thread context of 3068	580	mstsca.exe	53
PID 2140 set thread context of 2992	2140	mstsca.exe	55

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	1512	WerFault.exe	38

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A18D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A18D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wguewhw
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A18D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wguewhw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wguewhw

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2176	schtasks.exe
1044	schtasks.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	toolspub1.exe
2344	toolspub1.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2344	toolspub1.exe
2988	A18D.exe
2960	wguewhw

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1252	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2988	1252	Process not Found	28
PID 1252 wrote to memory of 2988	1252	Process not Found	28
PID 1252 wrote to memory of 2988	1252	Process not Found	28
PID 1252 wrote to memory of 2988	1252	Process not Found	28
PID 1252 wrote to memory of 2604	1252	Process not Found	29
PID 1252 wrote to memory of 2604	1252	Process not Found	29
PID 1252 wrote to memory of 2604	1252	Process not Found	29
PID 1252 wrote to memory of 2604	1252	Process not Found	29
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2604 wrote to memory of 2580	2604	B7EB.exe	30
PID 2580 wrote to memory of 596	2580	B7EB.exe	32
PID 2580 wrote to memory of 596	2580	B7EB.exe	32
PID 2580 wrote to memory of 596	2580	B7EB.exe	32
PID 2580 wrote to memory of 596	2580	B7EB.exe	32
PID 2580 wrote to memory of 2416	2580	B7EB.exe	35
PID 2580 wrote to memory of 2416	2580	B7EB.exe	35
PID 2580 wrote to memory of 2416	2580	B7EB.exe	35
PID 2580 wrote to memory of 2416	2580	B7EB.exe	35
PID 1252 wrote to memory of 2620	1252	Process not Found	34
PID 1252 wrote to memory of 2620	1252	Process not Found	34
PID 1252 wrote to memory of 2620	1252	Process not Found	34
PID 1252 wrote to memory of 2620	1252	Process not Found	34
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 2416 wrote to memory of 632	2416	B7EB.exe	33
PID 632 wrote to memory of 2056	632	B7EB.exe	37
PID 632 wrote to memory of 2056	632	B7EB.exe	37
PID 632 wrote to memory of 2056	632	B7EB.exe	37
PID 632 wrote to memory of 2056	632	B7EB.exe	37
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 2056 wrote to memory of 1512	2056	build2.exe	38
PID 632 wrote to memory of 2512	632	B7EB.exe	41
PID 632 wrote to memory of 2512	632	B7EB.exe	41
PID 632 wrote to memory of 2512	632	B7EB.exe	41
PID 632 wrote to memory of 2512	632	B7EB.exe	41
PID 2512 wrote to memory of 1752	2512	build3.exe	43
PID 2512 wrote to memory of 1752	2512	build3.exe	43
PID 2512 wrote to memory of 1752	2512	build3.exe	43

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2344

C:\Users\Admin\AppData\Local\Temp\A18D.exe
C:\Users\Admin\AppData\Local\Temp\A18D.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2988

C:\Users\Admin\AppData\Local\Temp\B7EB.exe
C:\Users\Admin\AppData\Local\Temp\B7EB.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\B7EB.exe
  C:\Users\Admin\AppData\Local\Temp\B7EB.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\40501dd2-ad84-4f52-95ab-7b6b73edc5ab" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:596
- - C:\Users\Admin\AppData\Local\Temp\B7EB.exe
    "C:\Users\Admin\AppData\Local\Temp\B7EB.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2416

C:\Users\Admin\AppData\Local\Temp\B7EB.exe
"C:\Users\Admin\AppData\Local\Temp\B7EB.exe" --Admin IsNotAutoStart IsNotTask
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
  "C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
    "C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:1512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 1440
      4⤵
      Loads dropped DLL
      Program crash
      PID:2644
- C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
  "C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
    "C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe"
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:2176

C:\Users\Admin\AppData\Local\Temp\C055.exe
C:\Users\Admin\AppData\Local\Temp\C055.exe
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\system32\taskeng.exe
taskeng.exe {A9E24308-80D4-4C8F-B24E-7BC2E7518DE5} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]
1⤵
PID:2924
- C:\Users\Admin\AppData\Roaming\wguewhw
  C:\Users\Admin\AppData\Roaming\wguewhw
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2960
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:3068
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:2992

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
1⤵
- Creates scheduled task(s)
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 ac6007dd9704ec073faa7e21906ab34feee33d0418e96afae081f868d8066977
MD5 fc115b2c6fb231b1e7ec152ca261c789
SHA1 6fac5eefb97a0e0a08e98a4e078cff61e0eba5ce
SHA512 73ca74ad031ee3fe09bd04642652f9aa3dc72cb81e0bc5762de7bfe7d73b9aa35c3a0981fa4a22d231bb4d78929709133a39ac533448966280b1f39f1fde8988
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 ef404d0fd9c790ba6507719720ce1f6804b169b651e5c455afb3d408e3986360
MD5 89cb3128ff914696f4ad44893e1768b3
SHA1 e1566445a9abf161aa0e17d4d082b98fb8dacc56
SHA512 1a637ad35d236f176151bbd413eb57e37b22a3b1fdc64ee7033181bc78a9adeb6b6ca8be680b117ec020855e1ab15afccc0a40ff60bb84b612d1ace061204da5
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 ba91de3757139becbb1a3fd560efec10469772ca357ca29714511051634dd489
MD5 7aca7671b55572d66251067192bc2994
SHA1 cdb7dc862715773a5cf018200962dff4c84a9569
SHA512 2a39810670e2efc540802067701cf053b77ca1731e78654ccbd0fae677b401a9951e227dc46a8e0260bf5ccc55a090d1e8bf6989cfb92eaa1930666669061fe3
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 e45dcb248eefe31ec2618f009ac5dbea93e135a97063f1e1d6a342ba18da025c
MD5 bae80f5f92993c151b6926eb32db7c93
SHA1 8c698778d1159688c5504763f47ebd8dad708240
SHA512 ed9be90fb465da020894f3b76501f176e96cef277889c2ad0529a69f6510e7526ad15192a52341f2b7ff2ab24b53690cc47ebc5aa0aa145fa16320bca9b106c3
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 892635394b5b157a6af5a02620b54d812da4588649c3090eb2a92d2a8ee98f8a
MD5 08401f2eed70f08838fb03e9fd598972
SHA1 a67750e3f2648883c065dbe2ce02a080e6cf7dc5
SHA512 73b7d54247135164c1a01b767d72348fb3b921feacaa205e8c1059d1b5192cab95bc91df76fac5eeb36caaf29e00e5e4223dab7ca14240d567b5c9606d926427
MD5 SHA1 SHA512

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\40501dd2-ad84-4f52-95ab-7b6b73edc5ab\B7EB.exe
Size 203KB
SHA256 ebd870bfc029254b8b5e53332fc7f433d10bc4db38d270feb436541d35ee7e78
MD5 e04f00ba32bec1f92bd645450af8bee6
SHA1 0c317903eddfad3f58a9d006070c85600fadfd38
SHA512 6636cc0b9fcccff4564bf9287d2177c056473966565631b923c7a24414356d0a583c34e194c68e84d2fa6850e6d1c8119f2c216e06661f1a3e05d33772303f84
SSDEEP 3072:sQ9pL6jYQCvx7Okct9TpcoW5XC94lUi1hfS2D95Kvm9LaDvtia7JsfR:LrLIYQCvpOBlcoAXC9Zi19S2FtCvUpfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

A18D.exe

Path C:\Users\Admin\AppData\Local\Temp\A18D.exe
Size 237KB
SHA256 0f4d1e6a36a2f6fc4e29b9134a49a081b305501bb6394367f2f48a0387b02c68
MD5 fbba6e587d5700e84b4badbd6fcb3123
SHA1 6f4c4e6b88e7cbf87dc70427513a39725ee3110d
SHA512 d76e5b8adb3c01c85b1dd297f53518a47f90668aa73759461d94cf957f6b73a132fa57eac0b0feda4d6a2187e7c1b11ec5ccd662505e3b91f0e57cfa047a732b
SSDEEP 3072:ctBS+BisPLWLi80S9pikUD0I54tP1frogEO1u5Nwinh0/b9r:4LMi80+p5UH54N18g4winh
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\Temp\B7EB.exe
Size 331KB
SHA256 14339fde88dba39542fdf0394981d134aca9ff4358550cc39073419008ea349a
MD5 af25a48065a8654910ac2426df956c91
SHA1 68e221eb52a772f9d19a0c5b9fa162a70943f8ae
SHA512 a101edff8fbac499875f25ff0df93a8ec8238f8e44e7f48b1199ed3b5b6c3889cd6a0f5270cf4b3c15b070cd120fd8517f1fcaa6ecb704cff2ac302f8188fbdf
SSDEEP 6144:LrLIYQCvpOBlcoAXC9Zi19S2FtCvUpfw7eKp0k/INUiEbfGJy+kQ:nsY0BLAy9ZiikkvUp1Kp00QyfP+kQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\Temp\B7EB.exe
Size 390KB
SHA256 b7d91afbceefe6f37688e1a674e4b75090b83da66e69039dffb798cdae323764
MD5 e8a74ddb6d1daa4968c4e38d6342d1a3
SHA1 1c994f80e216159a39884172c003b7b18bf30b54
SHA512 bad40378be771566ca49d5d0d290d272514ac6836fb99c4d324f94eb6670745e6c0927cf9b21edd772e092db94c9f5b942bf0979ebf5ed1aecb77369394383ba
SSDEEP 12288:nsY0BLAy9ZiikkvUp1Kp00QyfP+kytdqcDK:R09Ayr1v81b0QC+HddK
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\Temp\B7EB.exe
Size 128KB
SHA256 851124638e80de0500cb96061f52b851ae939994eb3e361bb07ba714ad81055e
MD5 32306d56a9e1ce750ff111deb922eacb
SHA1 f75bf7276338e8580f882ce74c69e6ea7b87d01c
SHA512 6a220df8ebb0fd6f81fd6cb0fa1862a6ece8e91c5aed0150467768b718c9bda942e5fdec235314a5ca665d64b49e1add8f6310bce3664c19ec955c2ebea27b55
SSDEEP 1536:ZuKssvRR9NzL1e1Hju98aasXgB6cChhhv7KJV2RcXC420FTpcSrrOOeeC/zQSTX3:sQ9pL6jYQCvx7Okct9TpcoW5XC94lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\Temp\B7EB.exe
Size 381KB
SHA256 92f2ec62d22ef65b4bd46722f482f50d0e29c06c70f5c02510085ad782d4d18b
MD5 83562b27278d30c511e27c2f156ac672
SHA1 d5b05faebc213e4b42f6295a21acd67635e50b7a
SHA512 3983a0c8dbc8eb2bad17c6fe07013d05a972524d63ac5ddcfa5888d92076982c9b06b832ff8f487b29f05416ca907962eb879c54dd29d967e027adcf204f3f15
SSDEEP 6144:LrLIYQCvpOBlcoAXC9Zi19S2FtCvUpfw7eKp0k/INUiEbfGJy+k9gtdqc1p+e:nsY0BLAy9ZiikkvUp1Kp00QyfP+kytdd
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\Temp\B7EB.exe
Size 612KB
SHA256 dd317944d5f51e7e1079c577b8eef3240d2da4ecd11688acaad496f2b4a18b49
MD5 15cfe4d7780f7da1e9e4770184ca042f
SHA1 e72ffbf7939e552c833c4c22a8047c5b012f5713
SHA512 cd239aaab44f2776db207194c8ec553d523a9516c5a09db685ec8f67d455bd98c586f91a45e7e0263135c1362c9410538d55c839bbd4a522e70f459723eebdb7
SSDEEP 12288:nsY0BLAy9ZiikkvUp1Kp00QyfP+kytdqcD6H1ilodsKUY9JZVVEQ2djH7LjMT:R09Ayr1v81b0QC+HddAclyZUY9J1E1dG
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path C:\Users\Admin\AppData\Local\Temp\B7EB.exe
Size 92KB
SHA256 f2a3ca4befbb00f2290f11f1212d7f7b1d7ce3420b16d810c5dd61a026428883
MD5 352b2e75b4c7115aff38bc0768f4275c
SHA1 d9e30f8da8668f321d1561c951368dabbb25baf0
SHA512 b55e906c03c271c99024f88f355662b2e867d1fae49d42fe787133dae957e71d3252df1f7eb04ae2c2b5918a975e66ba6f21b96cf51f39cd3d6d77e7b9bf09ab
SSDEEP 1536:ZuKssvRR9NzL1e1Hju98aasXgB6cChhhv7KJV2RcXC420FTpcSrr1:sQ9pL6jYQCvx7Okct9TpcoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

C055.exe

Path C:\Users\Admin\AppData\Local\Temp\C055.exe
Size 464KB
SHA256 e247c657bfdf680da63df9c66bf33c67be4ae5862d651203e8b6b7f62ecb49da
MD5 c493043773da45a3989a28bc4a5b4080
SHA1 ea216794fe1283492b033de80e09d2244d37a0d9
SHA512 34720ad4972c6d93bb17b5fd8255e3b80fef570d72d08c0d089d16923873967c93ace184ddbfedc02ad7590e1f4bf6a8779aa7c9b2c1d4cf3ac26027093a1910
SSDEEP 12288:Vl0gz26YgFL/GB8n0rrLjSAvKABunv7w5:Mgz2YFLUGW2ASPnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

CabC938.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabC938.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarDAC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarDAC6.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 108KB
SHA256 4190cdf716f0ff518e5fa75853bfbdb44f3213b6865c835fd47413a03150b644
MD5 41e68d0edad7db57451a51c954cce022
SHA1 6bd84fbe93f097bbb60baae574cecc4d13052a63
SHA512 4971dcee8ecd4c40024913212e03a90e6bac4ed33e260c32cdc49fc289dc00a9b1e004ec8c6b6c9e375eba22aa304397490ba3a9a6a1d56f1ab302a0f8d0f75a
SSDEEP 1536:yiEIzYG6NiUVL+mdIP2kixhZ8hJ5tnoCwLNydR+XtSv4CTuDd2awo1lGqZYuco:y/ILdmdIPU3ZBNydRgtqihXL1cQZco
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 45KB
SHA256 aecceba46a18f1134458ef601985d5b58441917dcdda3a45950a5eae418d9a4d
MD5 f3a770fbdfface943eb2c1a561919aae
SHA1 8105a6612a65edec73e3f312ea4085049f03abf2
SHA512 9a3c5f9dca4ed2f686814dd7183a335e52e448ab1f94b2e73462fdc1048529566574786d9619f27d08bf1cf6f9969a7ecbe3c477551b911434ceee88ef2444b4
SSDEEP 768:/KWlprUxfKp45iymnhzXo4dyvtQyNi2v4UqKwU+mrhbIpFs9km:yiEIzYG6NiUVL+mdIP2km
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 46KB
SHA256 000230f7010250cd736868ab2a9e1516183a51d1cbdf50a5bc895b35f83a3959
MD5 47e351ea9b16cfa628d63d1fb67e193e
SHA1 2ee9517fec6cebb14c309741eece5abad646d663
SHA512 ba38adebd6a2631acf4842633afda25907503fb0a8ea01d7a5bb3d66df04cdfc49f30023945830b282ec1286c9db04afd51653cade62c2059587af6945107d04
SSDEEP 768:/KWlprUxfKp45iymnhzXo4dyvtQyNi2v4UqKwU+mrhbIpFs9kF:yiEIzYG6NiUVL+mdIP2kF
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 22KB
SHA256 282d88270f1a9cdd31ebed47f61f0d7e3502e488b965aa9905f80d4ac1ae0524
MD5 3aca09d6d7b6554584f0c7dd4da7f22b
SHA1 1dc5be36f798a0c7c283e4d39aa40a512dd22001
SHA512 a86a326068c84f6c6db2b9dfcbc8a964fe907e1fcbf54eea801aeb6755edc35f8e85d22e290cd19fe2e39aa3577cb758603a7bdf172c7f716be8f4d5217b3f50
SSDEEP 384:8EKWlQcxraXxf90p4Yk0NVdpZ4QPiQnh0UXZx4X4d8nS+vs4Iqq:/KWlprUxfKp45iymnhzXo4dyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
Size 17KB
SHA256 a34f7cb1fc650f5c49b2dc59b3c84de2aa30c3c4805038c627093df50c1f43a2
MD5 9af84c1617b45bc71cd17a60ef9ac9d6
SHA1 ad454a52bbadb4f47970a7c9b5c8f8668a41add6
SHA512 241284839aacb251d326787c049d3c0584816bea54f8cd033a43a2fd11aeecd7f8c87752ee1ec828f5be095ea4bd0a2d991f84ebc0a640c1c6aab67b25512f5c
SSDEEP 384:GpCrGi6idizcRO0o2uQVS6c6jgy2RYRbrjr5DJoMr8oXM4INduLbY:hrMh12NcUZrUUM4INduPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
Size 220KB
SHA256 8e83d2b0f096b9f2ce5911feb0bd184add644bc023aa5d294a18ff5fa0b57026
MD5 421fcb0edf3c53a8e361236aefc98068
SHA1 14d7c7ac18c217a385296e6185c1c269b1d25424
SHA512 eb3c0957d66e78e5a16ea645530c271db289c80f9c2179ee5d9d2dd1b4f7a460920d9773e1511b8c72934cb268c3b270e18a5591c3fd05250f49222ee346c911
SSDEEP 3072:2SNChBNpSjDp+UidGSXiFhzQZV5VaNLv9DW7dt26dtMdTk4JlUztS5:2neDcgRQv5VaNT9DW7a6dtM9Vst
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
Size 299KB
SHA256 fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
MD5 41b883a061c95e9b9cb17d4ca50de770
SHA1 1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA512 cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
SSDEEP 6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path C:\Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
Size 157KB
SHA256 4b3babc0e79f50c902f491bb868cf8aff6d256f225c0b396143a830122dbdd7f
MD5 1e84cdda521840e09b4d00210ac160ad
SHA1 950c5acfd53757341e4918bba9ec4d18dc5aaf1d
SHA512 573c3d5e32694c44eb964a2b8deba658e26649c69b4767298e919ee0e13ddb6c4ca3f0fef4e140410fbb5f2c53d6fb1cdaf30625b693268edd647edb23676b39
SSDEEP 3072:2SNChBNpSjDp+UidGSXiFhzQZV5VaNLv9DW7dt2F:2neDcgRQv5VaNT9DW7aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

mstsca.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Size 124KB
SHA256 fbb92150ec7b433fa9c54306844124e3bd00615af2dd0bcbddcfb8e2865a3ba8
MD5 eb746bdf3ae8032ccf5f862e96dd78bd
SHA1 103684140e65a1b7d7e2084c997ac626994ae1d1
SHA512 941c505030f858e7fc273df2e6a173df51b8dc0fffdff827365f046f039869f68d9f7363043762bf47e9dcd6eae2856c886c52983903dcf033cbb8d70c16139b
SSDEEP 3072:2SNChBNpSjDp+UidGSXiFhzQZV5VaNLv9DW7/:2neDcgRQv5VaNT9DW7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mstsca.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Size 26KB
SHA256 52ae65e6b84f1461d4a23274ae592d2fd18d9b6b270a664dc0ae99255802eae3
MD5 427e0b948543f9ce5cf4c7c60f772263
SHA1 915eb5f7bf49a32dd76f6780bca2290253eefafb
SHA512 3b55a973a0d4f3ee633f009086a36867535ba688204cbfe70b1d18f55492d3006f8eeb8182c1e2f092d03831d37c83c3889dcd03facf3d9fc67f801d6a15dad6
SSDEEP 768:hrMh12NcUZrUUM4INduPbOUGwg/St3V66:dMSNcUZrUUMBNpSj66
MD5 SHA1 SHA512 SSDEEP

Submit Download

mstsca.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Size 44KB
SHA256 9f06c6ded3e655c2945636947c597de7004798d6df1db094e15a0d6ca8693701
MD5 a36a75a97608a264ea6748cc0cceec44
SHA1 dfce846c652f3ab5c15169a23a2821159aba6adc
SHA512 53a841f37247c731c3139739023c24e3993b0f3ff1d368bb465e90412d42f34d309fb1fdd4bc2b06745569d5bfaf75e977f9209d6f9f44700857e20c8b42b57a
SSDEEP 768:hrMh12NcUZrUUM4INduPbOUGwg/St3V6CvFqK+6NiC:dMSNcUZrUUMBNpSj6O0K+UiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

mstsca.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Size 198KB
SHA256 ad908d57e6aa1dbff786b9f983475ceb11458f7f0bf29dd008de8d6884712c52
MD5 29cfe79559c8c701bcbd8112484dd7ee
SHA1 44676b7e39b1188e16bd455d196519b98f2f8e0a
SHA512 e41df88399d3c899306b2197eb0c390cad3c0fa18305bb6a4324933a675bb2e0d524be74c10065eea1a12f50945c62fceecfba5ebeedb7d67faa458b331db248
SSDEEP 3072:2SNChBNpSjDp+UidGSXiFhzQZV5VaNLv9DW7dt26dtMdTk4JlU2:2neDcgRQv5VaNT9DW7a6dtM9V3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wguewhw

Path C:\Users\Admin\AppData\Roaming\wguewhw
Size 38KB
SHA256 8778df6f6195f679a6f7b8d71906093b68a3bd14e0cfebe8456b788fabffb74c
MD5 35074f73113b8b4cb59d48a9f12202f3
SHA1 80d45eb673dff26357a519ee8cc694be45a0cc57
SHA512 4c7ad55b18954f5d54f7615ee96a78f2c830c359039db5615ecab5929c9a241da4b540aa37976bd76d2277785f093b535efd9ed37c997e21af314469c71fffa3
SSDEEP 768:+3/tBSC1osBiMZ7gNxEpXf5LO2YeOh3ADVq5eGH/CWgq:+3/tBSFsBis8apv5LMeO3L5eGSq
MD5 SHA1 SHA512 SSDEEP

Submit Download

wguewhw

Path C:\Users\Admin\AppData\Roaming\wguewhw
Size 49KB
SHA256 583c00becf4bfae4028a5e47d6f214355655f1047e1e5ec192ce24ccc86ca05e
MD5 3a05f084178ac09791c3f1f3a5cd5948
SHA1 f4721f414ead7261bb57653bc10a14a6945fc7c0
SHA512 ed8c336c62a89000f49ca2f93f1762e2207511e77c57344dd8db2982bf5f3979069ba584deb0dd9f51b45d72445638c71efe7cf69f36a592cf9cc9709d1163d6
SSDEEP 1536:+3/tBSFsBis8apv5LMeO3L5eGSys8Lp9lns:ctBS+BisPLWLi8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path \Users\Admin\AppData\Local\Temp\B7EB.exe
Size 286KB
SHA256 10fbd8ba674dce42cc3774de058fd8fa7fbe92fbfa99c8cd43e7bf31b4788e6d
MD5 e5065b915fb736b7ae66ec6031f409b2
SHA1 db88426dfc9b2a285355b352d3fc3d3817a6d19e
SHA512 4e231b4cce10d696e2260da71e6559751822601e6f8178e01f666d152a0bd3c20b57ee8ab71654d676339cbcafe704f082afdaa4d055adb030d317f36fb0f842
SSDEEP 6144:LrLIYQCvpOBlcoAXC9Zi19S2FtCvUpfw7eKp0k/INUG:nsY0BLAy9ZiikkvUp1Kp00Q3
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path \Users\Admin\AppData\Local\Temp\B7EB.exe
Size 64KB
SHA256 824a560b119aa1f0d9afd7e897b35989ff08d69f300d0c10424565f1c31b86ff
MD5 471653f47c0c943d9259c88f43a18b56
SHA1 c4360462648288990f7b87c8042305cf9a9ba868
SHA512 68a0467981042aa1f381da74ba413e1503a9c7ad2d8fdaf6c1b34fb212edfa62585461815d5ad37432ea5a991a5a5c93276a4563183bdba11d8d02fc50c919ff
SSDEEP 1536:ZuKssvRR9NzL1e1Hju98aasXgB6cChhhvw:sQ9pL6jYQCvxw
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path \Users\Admin\AppData\Local\Temp\B7EB.exe
Size 735KB
SHA256 64e81c23b85832ce7097661bad2d41082592db8afe699dc00a86661ea6934f7b
MD5 c8e5763bf302654eb92b972145d73834
SHA1 f240235685a39017cd8fe4b27102d4782617280b
SHA512 bae3d527d32ac4f85c13b61790e885f7ff4964927bad39a1327bfc551e4fce58ab6091da1b1e066393ca36168aa28f7913ea9f24645c47b26875417e7b503844
SSDEEP 12288:nsY0BLAy9ZiikkvUp1Kp00QyfP+kytdqcD6H1ilodsKUY9JZVVEQ2djH7LjMw:R09Ayr1v81b0QC+HddAclyZUY9J1E1dM
MD5 SHA1 SHA512 SSDEEP

Submit Download

B7EB.exe

Path \Users\Admin\AppData\Local\Temp\B7EB.exe
Size 314KB
SHA256 ca009a41dd6b9d1dc019af88630dcd3158b47f9de3ab942755e8b0db49ea65ae
MD5 813e9ead9375f6265e7fdd41fec0a8d1
SHA1 9006ba42e93d527224a151bb0ae1928211241af0
SHA512 f05646e6f0f1cb6392ebad5a29e7648ea4bb1ef6ae44404996533225f0b95530e19a478a5586110936c87827a7d72962a01611fc05d6e47d2d82ab32f586d2cc
SSDEEP 6144:LrLIYQCvpOBlcoAXC9Zi19S2FtCvUpfw7eKp0k/INUiEbfGJX:nsY0BLAy9ZiikkvUp1Kp00Qyfi
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path \Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 92KB
SHA256 8ad19c897654a06e8990246fab84d6ed3787ae8f75171666638eac5ed587e01b
MD5 a253fcbf7a19daed90fa5c7923f23f97
SHA1 cb0ec84b701411d20e6dd033c7e1ec53a1ff474b
SHA512 8b7d813763c0b762570858dcb36f58915e4e2db80f8e9b34dd7566e8f359ef221a91a71cbdbb4aaf5a295baaa96250de80233edcb50e5615cb4979cfc5c927ef
SSDEEP 1536:yiEIzYG6NiUVL+mdIP2kixhZ8hJ5tnoCwLNydR+XtSv4CTuDd2O:y/ILdmdIPU3ZBNydRgtqihV
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path \Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 62KB
SHA256 941b5f3d577b6870e1fe5e081b76dca2ca5555f56a26779a1da07f153c84309f
MD5 4b2d12385413adf7c1e9525ce823cbc2
SHA1 a627b9fd6852e05fd65da41daebcdfda23e9ee3a
SHA512 17cf3a2bf1477b93545b440d013d125540f235fa79858ff979b5017d947ec45f43998be1de3b4858d9ece543f2654f7a70a541b9ae13740b7b9100fb9a6b48ef
SSDEEP 768:/KWlprUxfKp45iymnhzXo4dyvtQyNi2v4UqKwU+mrhbIpFs9kA4Q246iiA1N8vZC:yiEIzYG6NiUVL+mdIP2kixhZ8hJ5tc
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path \Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 262KB
SHA256 1ae4509fb8949fab80d4cc0fefec087af17e7c5654f2a66ac04f7372edaec5fe
MD5 9b00df1cca53e81d90dfc2548f8d9114
SHA1 a783bde9346c8ece56aa6fec12348fea40fdf6ec
SHA512 406e14898fadc9aa63021d15c1e23cc812f472c6dd1fb59a29de2c4660b573e26ba13b892b2d3755e29d6fe5fe30a4d1c0550e0aca9d0bf5ae936e59d3141ffc
SSDEEP 6144:yQJMwU36ic/kx/vVjjnJ8BvIv3yb2n9pF:97U36X/kx/vBJ8BvIv1n9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path \Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build2.exe
Size 198KB
SHA256 dcda39e502cd6e7bf07592af20a8d5630e256a2bde760cf666f48c74d9abd3ae
MD5 1e493bdfb8bc28c869eb114fe4f6335d
SHA1 1ac3f8c2698b478cb0db01bfe7e98511bd0284a4
SHA512 61e32e72f85c35fd1fc8354aaea8cb6560c3a0e858ae2ab8f4d6469413306c0892dc313e8bfae18db5d82387dce3503ddbb4593b2ddc163418c2483a0d3abdb9
SSDEEP 3072:y/ILdmdIPU3ZBNydRgtqihXL1cQZckx/hxAqj1lnJaliUhAmHPIvU4Q:yQJMwU36ic/kx/vVjjnJ8BvIvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path \Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
Size 35KB
SHA256 3f21e7df5277e8ad59020ee747cbe278a3f3f876e46584563aa9660b5fcadcae
MD5 76a1d3c7a149121859c78576cf393ccb
SHA1 e8eb854c5dae1794908983f623e8ef78bb452818
SHA512 2f0f68aa8cde1d5aca8f0c1b20b379d502f337ddf53c99ce937d2024532613716fcd2f12356845ff45a07cef34ef7681cdbf896dbc2701ccd1d0ef79ee857b97
SSDEEP 768:hrMh12NcUZrUUM4INduPbOUGwg/St3V6CvFqKT:dMSNcUZrUUMBNpSj6O0KT
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path \Users\Admin\AppData\Local\cd95e55b-c8b0-423c-bc57-cdf1c44e1f43\build3.exe
Size 64KB
SHA256 b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c
MD5 8b6a819c6926597dfa7529b692d7a6cc
SHA1 50c535e9cca464afd3a589d2231d87ce417d4312
SHA512 dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9
SSDEEP 1536:dMSNcUZrUUMBNpSj6O0K+UizFvGSKG6tFhQq6:2SNChBNpSjDp+UidGSXiFhz6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/580-294-0x0000000000292000-0x00000000002A2000-memory.dmp

Download

memory/632-106-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-132-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-102-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-101-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-108-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-109-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-86-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-85-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/632-204-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1252-297-0x00000000042C0000-0x00000000042D6000-memory.dmp

Download

memory/1252-4-0x0000000002A20000-0x0000000002A36000-memory.dmp

Download

memory/1252-20-0x0000000003AD0000-0x0000000003AE6000-memory.dmp

Download

memory/1512-131-0x0000000000400000-0x000000000063F000-memory.dmp

Download

memory/1512-280-0x0000000000400000-0x000000000063F000-memory.dmp

Download

memory/1512-130-0x0000000000400000-0x000000000063F000-memory.dmp

Download

memory/1512-127-0x0000000000400000-0x000000000063F000-memory.dmp

Download

memory/1512-123-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1752-230-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1752-236-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1752-233-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2056-126-0x0000000000230000-0x000000000025C000-memory.dmp

Download

memory/2056-124-0x0000000000510000-0x0000000000610000-memory.dmp

Download

memory/2140-324-0x00000000002D0000-0x00000000003D0000-memory.dmp

Download

memory/2344-2-0x0000000000220000-0x000000000022B000-memory.dmp

Download

memory/2344-1-0x0000000002C90000-0x0000000002D90000-memory.dmp

Download

memory/2344-3-0x0000000000400000-0x0000000002B13000-memory.dmp

Download

memory/2344-5-0x0000000000400000-0x0000000002B13000-memory.dmp

Download

memory/2416-74-0x00000000002F0000-0x0000000000382000-memory.dmp

Download

memory/2416-84-0x00000000002F0000-0x0000000000382000-memory.dmp

Download

memory/2512-229-0x0000000000220000-0x0000000000224000-memory.dmp

Download

memory/2512-227-0x0000000000990000-0x0000000000A90000-memory.dmp

Download

memory/2580-41-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2580-37-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2580-71-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2580-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2580-42-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2604-32-0x0000000002B90000-0x0000000002CAB000-memory.dmp

Download

memory/2604-31-0x0000000000260000-0x00000000002F2000-memory.dmp

Download

memory/2604-40-0x0000000000260000-0x00000000002F2000-memory.dmp

Download

memory/2604-30-0x0000000000260000-0x00000000002F2000-memory.dmp

Download

memory/2620-77-0x0000000000230000-0x00000000002B8000-memory.dmp

Download

memory/2620-286-0x0000000000400000-0x0000000002B4C000-memory.dmp

Download

memory/2620-76-0x0000000002C60000-0x0000000002D60000-memory.dmp

Download

memory/2620-72-0x0000000000400000-0x0000000002B4C000-memory.dmp

Download

memory/2960-288-0x0000000000400000-0x0000000002B13000-memory.dmp

Download

memory/2960-298-0x0000000000400000-0x0000000002B13000-memory.dmp

Download

memory/2960-287-0x0000000002C70000-0x0000000002D70000-memory.dmp

Download

memory/2988-18-0x0000000000270000-0x0000000000370000-memory.dmp

Download

memory/2988-21-0x0000000000400000-0x0000000002B13000-memory.dmp

Download

memory/2988-19-0x0000000000400000-0x0000000002B13000-memory.dmp

Download