redline | 9e8b0260c4d5d666efd599946b2d6377a34d1e670f51408a88a7fe95c4c960c4

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e2489bf65b43f711ac1f01752872418.exe
Size 2.3MB
Sample240204-ed3hfsbcap
SHA256 9e8b0260c4d5d666efd599946b2d6377a34d1e670f51408a88a7fe95c4c960c4
MD5 8e2489bf65b43f711ac1f01752872418
SHA1 7ba722bbbf13f1eb7d3be8216d6e01f7a78d670c
SHA512 53173ee0ba6fc46dd5e2c67267a2a3ad64869e2caec24b2aaaa75b0fc37e8d0eb680d8dac281bee27654a1ab11a0bc25459ec534cc8c45bf9cad3a5d50009783
SSDEEP 49152:q5+hFGkqb3KQPiCRFpIfp/au9InDnUQtP+0n/hbxiz8lVHTIioOFZQ+A:q5aFGT6cDRPIhajnD5PppbxiqZ7A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline sectoprat @janhidf infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

@janhidf

45.14.12.90:52072

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321b-62.dat	family_redline
behavioral2/files/0x000600000002321b-64.dat	family_redline
behavioral2/memory/2144-65-0x0000000000200000-0x000000000021E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321b-62.dat	family_sectoprat
behavioral2/files/0x000600000002321b-64.dat	family_sectoprat
behavioral2/memory/2144-65-0x0000000000200000-0x000000000021E000-memory.dmp	family_sectoprat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	8e2489bf65b43f711ac1f01752872418.exe

Executes dropped EXE 9 IoCs

pid	Process
3500	7z.exe
4816	7z.exe
2068	7z.exe
1388	7z.exe
4868	7z.exe
3880	7z.exe
4388	7z.exe
3576	7z.exe
2144	janhidf.exe

Loads dropped DLL 8 IoCs

pid	Process
3500	7z.exe
4816	7z.exe
2068	7z.exe
1388	7z.exe
4868	7z.exe
3880	7z.exe
4388	7z.exe
3576	7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeRestorePrivilege	3500	7z.exe
Token: 35	3500	7z.exe
Token: SeSecurityPrivilege	3500	7z.exe
Token: SeSecurityPrivilege	3500	7z.exe
Token: SeRestorePrivilege	4816	7z.exe
Token: 35	4816	7z.exe
Token: SeSecurityPrivilege	4816	7z.exe
Token: SeSecurityPrivilege	4816	7z.exe
Token: SeRestorePrivilege	2068	7z.exe
Token: 35	2068	7z.exe
Token: SeSecurityPrivilege	2068	7z.exe
Token: SeSecurityPrivilege	2068	7z.exe
Token: SeRestorePrivilege	1388	7z.exe
Token: 35	1388	7z.exe
Token: SeSecurityPrivilege	1388	7z.exe
Token: SeSecurityPrivilege	1388	7z.exe
Token: SeRestorePrivilege	4868	7z.exe
Token: 35	4868	7z.exe
Token: SeSecurityPrivilege	4868	7z.exe
Token: SeSecurityPrivilege	4868	7z.exe
Token: SeRestorePrivilege	3880	7z.exe
Token: 35	3880	7z.exe
Token: SeSecurityPrivilege	3880	7z.exe
Token: SeSecurityPrivilege	3880	7z.exe
Token: SeRestorePrivilege	4388	7z.exe
Token: 35	4388	7z.exe
Token: SeSecurityPrivilege	4388	7z.exe
Token: SeSecurityPrivilege	4388	7z.exe
Token: SeRestorePrivilege	3576	7z.exe
Token: 35	3576	7z.exe
Token: SeSecurityPrivilege	3576	7z.exe
Token: SeSecurityPrivilege	3576	7z.exe
Token: SeDebugPrivilege	2144	janhidf.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3400	1152	8e2489bf65b43f711ac1f01752872418.exe	42
PID 1152 wrote to memory of 3400	1152	8e2489bf65b43f711ac1f01752872418.exe	42
PID 3400 wrote to memory of 1056	3400	cmd.exe	26
PID 3400 wrote to memory of 1056	3400	cmd.exe	26
PID 3400 wrote to memory of 3500	3400	cmd.exe	27
PID 3400 wrote to memory of 3500	3400	cmd.exe	27
PID 3400 wrote to memory of 4816	3400	cmd.exe	40
PID 3400 wrote to memory of 4816	3400	cmd.exe	40
PID 3400 wrote to memory of 2068	3400	cmd.exe	38
PID 3400 wrote to memory of 2068	3400	cmd.exe	38
PID 3400 wrote to memory of 1388	3400	cmd.exe	37
PID 3400 wrote to memory of 1388	3400	cmd.exe	37
PID 3400 wrote to memory of 4868	3400	cmd.exe	36
PID 3400 wrote to memory of 4868	3400	cmd.exe	36
PID 3400 wrote to memory of 3880	3400	cmd.exe	35
PID 3400 wrote to memory of 3880	3400	cmd.exe	35
PID 3400 wrote to memory of 4388	3400	cmd.exe	32
PID 3400 wrote to memory of 4388	3400	cmd.exe	32
PID 3400 wrote to memory of 3576	3400	cmd.exe	31
PID 3400 wrote to memory of 3576	3400	cmd.exe	31
PID 3400 wrote to memory of 4564	3400	cmd.exe	30
PID 3400 wrote to memory of 4564	3400	cmd.exe	30
PID 3400 wrote to memory of 2144	3400	cmd.exe	29
PID 3400 wrote to memory of 2144	3400	cmd.exe	29
PID 3400 wrote to memory of 2144	3400	cmd.exe	29

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4564	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8e2489bf65b43f711ac1f01752872418.exe
"C:\Users\Admin\AppData\Local\Temp\8e2489bf65b43f711ac1f01752872418.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400

C:\Windows\system32\mode.com
mode 65,10
1⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e file.zip -p -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Users\Admin\AppData\Local\Temp\svchost\janhidf.exe
"janhidf.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\system32\attrib.exe
attrib +H "janhidf.exe"
1⤵
- Views/modifies file attributes
PID:4564

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_1.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_2.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_3.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_4.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_5.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_6.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
7z.exe e extracted/file_7.zip -oextracted
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 87KB
SHA256 975e0e48a82428aeddf3110e9f328243c92b270094b0eaf4b1d270abea1b5788
MD5 2fa327c8610fcc12ccb460e429fc9bf7
SHA1 511905eb98c9442e1edbcc7656bb9a6283a063f7
SHA512 2f652785c4a35b49476fe359b91a6edb01f7c4d742fc1f48ac8cdfb3ff0d1e622b05aedbbd1f2b94ca9b5556a1ffe57be434bab67901c2840116d8cea958b1d8
SSDEEP 1536:SGX/VQovjt3RR1Ztp5aE5krfFfbGHSpbVzZQGnVyef0LRcx9m:SGPyovjpnLtp5axfbGHS5VSIVym09cxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 84KB
SHA256 0956878207ed05eccf67906511949f8b1db9cdb3511daba7ee31f74797fb1c5f
MD5 be109b4b4c7efbb4668c5fece1c276ad
SHA1 6123fb12fb64d037115d249e044359fe2f3311e3
SHA512 f48a5824dbd731535617f3675312a66890fc5ea8a39ea7c7550c7976d6265889e878f2cc749c0553306b39417761eedfb0ba143ef58f48951933d838e46d8787
SSDEEP 1536:SGX/VQovjt3RR1Ztp5aE5krfFfbGHSpbVzZQGnVyef0LRcxr:SGPyovjpnLtp5axfbGHS5VSIVym09cxr
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 117KB
SHA256 478b24e915566ce6e5f16ba0263c96d77c017b8bc4509dfbaceccd94401ca2e9
MD5 6854a5d5c88fa9086bd1da0b0b147ef8
SHA1 4a13598efb08bf7c3dda70213130ed81286f872b
SHA512 4cd804f278515711ece5e556f6414f8161afdddb6fa2cb0fb70745727608574d9b5ac90459e410a3434a0832c3cfa4189a66b13eab6bd68fbdf73928799cf5b6
SSDEEP 3072:SGPyovjpnLtp5axfbGHS5VSIVym09cx9ZMRXw2avJUsLtQMwKl:SGKovFnLkfJdVxU/aSsStKl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 75KB
SHA256 fd92ce444699208fb403cdc4683f9381089cb783e3da660cc74a5f02a88872f9
MD5 096cfb3a020d59b8c333583404de83df
SHA1 38d4d0aaa1cafcfc2eef26ba06e3cef159af009f
SHA512 533e09ce51756c7a0912b1f9af1ec43411d42be249d3c8c15e51c0d9bb2644824a32e6559d9b6f31c1c3e42ea506e0ac4ceeabfdd74bd72d40311f154c09906d
SSDEEP 1536:SGX/VQovjt3RR1Ztp5aE5krfFfbGHSpbVzZQGnVyN:SGPyovjpnLtp5axfbGHS5VSIVyN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 80KB
SHA256 a2efe1f1e3308dad323f78801a1f93731bec25ab62e2bc8ea74a5934701154af
MD5 c59cfba300ba5fcb4c26d2c82770030f
SHA1 e81e1a3c666bdfabe24ea9b0f92bda994a158074
SHA512 1e1ac5a78074f3ee30a0384380c22cd4709711255b4871b4a126c881cb9e21f69d87437bb2eefce5043e1c833b49573120afc751ac176a1349beefa62b972bbf
SSDEEP 1536:SGX/VQovjt3RR1Ztp5aE5krfFfbGHSpbVzZQGnVyef0LM:SGPyovjpnLtp5axfbGHS5VSIVym0o
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 59KB
SHA256 5fb21ee769d9e061aee419a395a1279978b7bf3d6b8115020b0752760100a446
MD5 00dc5198f0ffe23e18bc8a00da266c64
SHA1 a0c2b75dac790e7dc562694426664efeb54efa98
SHA512 ba2ac162830539e107a2c06ddb5893a4af073e355e09b319c332bbb5af168d08f09023db7378da5f0e2d6833b97d5251b8f905a1266bb663087da0c5fbf4016a
SSDEEP 768:INfGKjI/w6HcDVykCjVroR1+jnbVR1ZtLp57UJEQOAh3Meic52nif44GOoFKgpq2:SGX/VQovjt3RR1Ztp5aE5krfFfbGHS2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 68KB
SHA256 9a409e4f4b2e9e4129f6844123e1a67f8af1f5d80546b3472bd6744e0755419f
MD5 3ca44fdfe7ba604a5060b773d4346faf
SHA1 4b502e4e67d96ac96c856c015b04282b1ddc6fb3
SHA512 c202f31672bf371b127eac86eefa07c78c2597d008226c28fde46adf9feedb189c37e022e0e87750701a7ff8f5c9b1df6ed50f8061fa56823c40030ee6a1b0c6
SSDEEP 1536:SGX/VQovjt3RR1Ztp5aE5krfFfbGHSpbVzZQe:SGPyovjpnLtp5axfbGHS5VSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 45KB
SHA256 fd49735eacc2a79b3d4de86e007b307e7defa4edfd0efdb6f0bb32b5f4b84ac6
MD5 e3a9e67f6e45d4f54ff0cdbb88e58a5c
SHA1 53507808c051b3b52b19177a70383c546011388e
SHA512 8ab4188801d9dede5aee2eb4d1dc34f2f87d27254bb6f0217b7790fa2cd346d503ff3d64b307836077a64fe235574d02aa555758ec43376a15923de115f3e6e5
SSDEEP 768:INfGKjI/w6HcDVykCjVroR1+jnbVR1ZtLp57UJEQOAh3Meg:SGX/VQovjt3RR1Ztp5aE5krg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.dll
Size 11KB
SHA256 c01ed00de5f926961dcd7a60a1ee94402ac04c1fb34036030b587599a4cc52bf
MD5 1dd699fe65eae54e78337e86d11e3e82
SHA1 d4adcfa781f9a2ea5c0613c834eb3a25bdd1a9a9
SHA512 bf7167fd3cc097976b38d39423893e78ac2ee4dc434c37587415ecf37672c5442966f78713928c0f5bb0597541e2a6aea45742dfb3425c7c0d424ee11e58ba69
SSDEEP 192:IOSfsQOde+ZHhwfWoJahcjA9xquUPwA98RUg5WOhP7IxMoUOs2bzj5mtqRV1yvo8:INfGnN78Wxqjwe9gZ6LThj5mcRWw6L
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 168KB
SHA256 e8e30787e4650b9b54e9dd203f2eb9f7e00d59b485b62cb9cdb51434e5206f76
MD5 35b874cb6d0eff587928df76d7b1127c
SHA1 fee10cdb60594c177044053e92ce58553a527867
SHA512 7ec40cfc1f3e4b84b08dbb6c574eee837040cbc85d14b8158f60d82a512c8a0e18a5c246c799b4976132bd538335b6491682814a93f9e98d471295571e0b1fa9
SSDEEP 3072:fz1jm/RL5pCyZ+Y/OS4CxaQTM4hATJ3JWxkqRd/8GrSTeenSO:fz1gL5pRTMTTjMkId/BynSO
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 18KB
SHA256 dbf9146744f92994d645782d9776234530407cdc8e8d9fb92dac1b03885dd876
MD5 f31bf68469430380860594f747fb5555
SHA1 8d2b9387d436ef418891ee890031bc23cbfa464d
SHA512 612f86c91834b396cfa529471c787aa4a5ef19760923f1dd28429a60a0dae61b2bf085f17a996b22eb284a720b5900298ea1b1fcf5b9276ff71e6f7f0caef014
SSDEEP 384:X5e8nzBeh4QXuZCJR3bgic9sPunIIEHvD4sOV:XI8zBv8XxGusvV
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 183KB
SHA256 c453b2d52f21819e64c752f2e924738955379e9e0206326106c7b26f85410553
MD5 a5d7036ed77913b0baded18af103d835
SHA1 4d818a33bf3c8e874d29020caebfb4a611b1d70c
SHA512 50105089052c5edcb63a5ae71cd453a081bcd3c3ec8a9962e5439ff364d8a5406b3e8199a947797ccb2eeef6edb193d0b10e17a5f1821a98932ad37b21ea1e80
SSDEEP 3072:fz1jm/RL5pCyZ+Y/OS4CxaQTM4hATJ3JWxkqRd/8GrSTeenSx7dEe6t1wnzRakdg:fz1gL5pRTMTTjMkId/BynSx7dEe6Xwz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 1KB
SHA256 b6d296aafe29dfc4d2f1557e6b60b043ba6b086283609c0d51babd320ae30b02
MD5 004a039b62a7fd07d73ff3c5ae702811
SHA1 9dae66e7e0a283a9cd6eec5a6fa4d1abf4b1edbf
SHA512 5f25665ccafa15028dd45dcee5eca3ad1110faa02807a4817b856e6ffdf502394102c18a78cfe8c977b7d2ddfcd8adb853276bdac3ea818cfc18eb10066b322f
MD5 SHA1 SHA512

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 40KB
SHA256 b48c497e2725a021ebaa434518831023db8492e4b3daad8bb820e5b9ed746d7d
MD5 f82a1ba1acbb4c73e77db0fa5d082c1e
SHA1 0ead8b61a522ffa1f74740f62c09a88ac4f9494c
SHA512 7cbc816d68447744d00066c5e8cac620da4e7e51392f2b6356968f70bdaa458d00fe53812a004593730f3eab5d125bacbb41fee58bcf2e0e69a34dccd54f78e5
SSDEEP 768:XI8zBv8XxGusv+Vg91fddU/ywLT9vVa/7DfEo/1xIce:XPzBvQuJVm/ywLT9po/10
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 128KB
SHA256 3db6bf25bba565fc07809dc80a6322b328a226b8d0170b838e63a635a8204e96
MD5 9b5522e810643ea0595f12b98c4a6c39
SHA1 94b7a2b813f6e800ebb1c247e4ec06a93946b475
SHA512 4ec37fa349c02db83caf3362bdb4b89e4e9dda979d3a6407cd6374b52c9d44e821555fb5906839229653bdc2aa78f0dae7d041df0bf0ef47aaac8e4b29a57398
SSDEEP 3072:fz1jm/RL5pCyZ+Y/OS4CxaQTM4hATJ3JWxkqb:fz1gL5pRTMTTjMkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 89KB
SHA256 cd974f05f08980e78d3baf323e3d6641abe5f124d688595ca79b13f663ed2571
MD5 ef0dd08ea00cbe32701a6f804f163761
SHA1 0546b8319e035fcbb53557c9ea72ba5e37840746
SHA512 42adb7d8d425ce2dd5fc7a5287c8ecdd6a57a1546a0b29becabce35ec2ba903eb91aff11a5d75e8192dc845bf967e137d0ea32cbd3e9066d6a003a844a87a0d1
SSDEEP 1536:XPzBvQuJVm/ywLT9po/1wZ+B9g3ZjFO/QYQ4f2KQxaEDGkI8w8gRd4+:fz1jm/RL5pCyZ+Y/OS4CxaQTM4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\7z.exe
Size 92KB
SHA256 d056cabaa270cb967d7d92a48bb0de74aa47fdf9983d772636c4bb6e09788915
MD5 3bcfb801c854da1ce7e719f1418cf815
SHA1 5934217712aa609866b946d7801cf185ae4ba90c
SHA512 def8af48bd4568f5d4d5371fd69cd86f3102eff5584bd7cd28b9837ab5f1c51d0f5b81fd73001a6f0a30361ba5db7c73d5fc6c295eae3303a925827f1767f5b5
SSDEEP 1536:XPzBvQuJVm/ywLT9po/1wZ+B9g3ZjFO/QYQ4f2KQxaEDGkI8w8gRd4P5g:fz1jm/RL5pCyZ+Y/OS4CxaQTM4hg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ANTISC~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\ANTISC~1.DAT
Size 57KB
SHA256 12993d0c93143f6eb8f6dafbbf1bae1dacc4b8b1a08b5c72b752a8eb74655e0d
MD5 6d1162ed8955bf605ed1cc682f0d713c
SHA1 7cc859313ee3bfd08ac95744b4d93eec4833074e
SHA512 26516671f37b8bf75bf70aa84b3bd539c8deae6b264b0a60c0afbbeeeb2111a7e6b86a9c560d2f0eefcee46437629a710f01b39ba0daa5ae9cbb170eda2e8b15
SSDEEP 1536:3ArArTd+sCCxW5ErMJOvtS+p8DPM87LxskMEO+0Em:3AreTdW5E4kk+p8DxJ7n0Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_1.zip
Size 40KB
SHA256 3cb1b064ec777f9f5b52ddc5524af016e18a35a93ca78c97a0a02d500f537420
MD5 c4d059eb65f0ef100602977cb470724b
SHA1 f87955e35ac37114b18421395e624b05edd8f23e
SHA512 9d62ffd1a22db85e277f4b635de93314b96d8206bf0824deaee34c3cd0c1f99e70821966cbf6cabcb858d1c215b4090fae5d325d89f801388fe8c2427caeeb73
SSDEEP 768:gu5LVzlyEu6Hnr/EtHMi/OkbHRMV7eAatRZ4qauSW4ExYveFvHscv5TIC:gGJ9uenrMtsi/OwxMVSAaPZVJBfxscRh
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_2.zip
Size 1KB
SHA256 73c459d62b8cea38cf93d65eeaf5b874f97b1da608c667f217ba8603652dcc2f
MD5 80500bf51817353ed3d062a917c38a5c
SHA1 56b17a46757f94364535efb98c1731328404010d
SHA512 8a58a33ac84ba2eb3d775d1e5242a3d48c0e94f784822813c6893503bf20c858056b2514ee8f4818cc898ce0994f8da590fd8b0df2c65b892d4793aae37dd971
MD5 SHA1 SHA512

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_3.zip
Size 40KB
SHA256 0dc793cf289016368f2f9737e076e727963c86869624dcc8ca2e35ef74277b2c
MD5 0bee242000c9acb11acd866e6e4055f9
SHA1 cbc36f27883eca6e9174cc9cb9ab66b132850e11
SHA512 775d00ab4b47664f8f8d6477dd6225ae672986a6c9a0c6cadd5312ad330ad292bd157895e46c3233b90a29d96fa3f466e0db259cb521446ddf549ec73d72b598
SSDEEP 768:t4u5LVzlyEujEnH/wv3ZteFjifz9XFZvUt4NeYYDo+tr3dtfdHG:iGJ9uQH/ApKG7at4NODoGdtfdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_4.zip
Size 40KB
SHA256 b6d1fb23b9e7b62409e4d1b48c3da752d5fb4a2c6d0e45a85c5c24edf2750286
MD5 7ab7a6f81ab745eeb5d032951edfed3d
SHA1 1547bb9be9067db86fdc3544b08b0c1554b0ddfc
SHA512 39cc42ab0c8f41f51462e773055ea860b7ed08f87eb6eb56f04b8741893557fa05dab09d257456f55c57e572224ea6c6719b46f6492df94298c71866b6686896
SSDEEP 768:e4u5LVzlyEujEnH/wv3ZteFjifz9XFZvUt4NeYYDo+tr3dtfdHr:/GJ9uQH/ApKG7at4NODoGdtfdL
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_5.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_5.zip
Size 25KB
SHA256 5243ee30772215578634863f5e52d342be22861cf31e38721493740c84cb5bd2
MD5 022395f53d0e6ecc47e0c2e8e985f1e8
SHA1 ec7d5b1e1b280792ed0b1d89326d4680dbb9c7d5
SHA512 c75aaa3ac1eacdf7da46d1f521a06a70b2bff7bcbc09eb2276980571d5d91748e37f744916fad59a82e3aa0ed55f9a9e515fcbbc4f6aa66fd4584445a74a7d97
SSDEEP 768:iJ1ZFFcbQXgB9ddyEnH/wv3ZteFjifz9X9ZQ:ivzFcsgB9ddnH/ApKG7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_6.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_6.zip
Size 41KB
SHA256 1b1956314d295e1da25f93f432d2f50c753594b780e782cbb2c62f623402faa1
MD5 8baa7100f7fc66c2613b5017dba1de63
SHA1 18915ff2dea9254277f5a49c4c0c0b41c01dce2a
SHA512 7c7a338ebad33b0f33533412f2eb10c829b0c292fdbeddb3a7a85d303c4532a179e5002866aa9d74e5904a90060fda57c78d8fda309af8847ff3851d67efdceb
SSDEEP 768:jJ1ZFFcbQXgB9ddyEnH/wv3ZteFjifz9X9ZvUt4NeYYDDCrR/xzlTomhsw9Dl:jvzFcsgB9ddnH/ApKG7mt4NOD+rR5zl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_7.zip

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\file_7.zip
Size 92KB
SHA256 00a41de310aad2d8b93eb56f3bbbaa33635690d6a7e4bc8e44c62826ce48f918
MD5 63b295c1ad886ff56810e4101060d8d3
SHA1 f8a929dfcdef22c781ba521c48b8d5d2d491dd79
SHA512 384386783de3a112fe2a737a21bfb2fa58235ae5284669e95e64a69e50cb391c9a4b45a2ef7a5b8457560b51d64e6fef26970e1e7bc4622335f4718832fdc67c
SSDEEP 1536:eJFXk3mdYN9Ed/Fh0IOd2tO+K8oLGXCfzJFaaw1Q0PzHrzgrKL9bl1Ixgq6Qh1/J:6FXelaCvj8G73wWsrzgepIxVL/35
MD5 SHA1 SHA512 SSDEEP

Submit Download

janhidf.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\extracted\janhidf.exe
Size 67KB
SHA256 7b338f16361837ca8af51394f2c7eef31ac5565fe86ac094475bf0486870519d
MD5 e047aaa851b801ac09c541a7db2201a0
SHA1 1468b929911e7b6116d6962f30183f196a3dfaec
SHA512 cdb607220fd5365cdfbab3b768099c31f511f5ccf845a638363558ad5cb0947d21ea530bcfbc87a8d13297e7f565b43ba0b9914359136619b2c88be47d18b4a2
SSDEEP 1536:W3LNmocUw71F2oTNodPxLGKJFIvTsmbfexvu:WxmocPNoBxLRJgThgu
MD5 SHA1 SHA512 SSDEEP

Submit Download

janhidf.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost\janhidf.exe
Size 92KB
SHA256 d23986757216cbc77a0b8ccaf39d593f11e44cd42b8e805db59c95301416da3d
MD5 fc255aba9dc0de2f69576a1f7e12f025
SHA1 282ee6d655a358f9da9c28311ecc2f5c178aaccc
SHA512 20d36d5317f71576fabb5e7049850441a6514193de1ce84046b0062dd14b755b19dfc359f0118749c85de48efc315c2576ae7dfc43d936f85ca127f9bffa24e0
SSDEEP 1536:W3LNmocUw71F2oTNodPxLGKJFIvTsmbfexvWueUyyedgY8XqCxXsE9G6s:WxmocPNoBxLRJgThgWuFyzd9SnG
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload.data

Path C:\Users\Admin\AppData\Local\Temp\svchost\payload.data
Size 124KB
SHA256 394190f3b30c3d6fb42c453ce1f257a6a08ec8189eed6dcdb89e201c667455a3
MD5 56c0a8ba3bdf92c2591de803a9f4691e
SHA1 97f672bd566bbfcfddd52e7a0de707aaa3f80c49
SHA512 c4ca21e2378b11e03b8e41760d236823531ddec399c85fac00d22c9ab16ac6145d44ba669bbb4f0f78587024807c2c67cbdbb3d5f0db57fefb61055d38477389
SSDEEP 3072:2mPSjufOfckItKchZqYLGiXcVtmVew1No7:2Pj+CckItKDYikcuVJzw
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.cmd

Path C:\Users\Admin\AppData\Local\Temp\svchost\svchost.cmd
Size 447B
SHA256 5f18e250bd5a729ab540c788062bb073a64acc73008c54f47dd6cf2542e880fb
MD5 5ea9e42fc392826e46615a787e7228fa
SHA1 6a91734d8f9111acfce8f851b247632bb8cab472
SHA512 d6d9787a7991be8a14044e8ea6cc5737fe4ca09ca45378017987f73850c7a67fca7a9d451a6ddb5711557cb78a8c7c936060ffb1fb2af2802857266d58435227
MD5 SHA1 SHA512

Submit Download

memory/2144-71-0x0000000004FC0000-0x0000000004FFC000-memory.dmp

Download

memory/2144-70-0x0000000004D70000-0x0000000004D82000-memory.dmp

Download

memory/2144-67-0x0000000005240000-0x00000000057E4000-memory.dmp

Download

memory/2144-72-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/2144-66-0x0000000073610000-0x0000000073DC0000-memory.dmp

Download

memory/2144-65-0x0000000000200000-0x000000000021E000-memory.dmp

Download

memory/2144-73-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Download

memory/2144-69-0x0000000004DB0000-0x0000000004E42000-memory.dmp

Download

memory/2144-68-0x0000000005E10000-0x0000000006428000-memory.dmp

Download

memory/2144-74-0x0000000005CF0000-0x0000000005DFA000-memory.dmp

Download

memory/2144-75-0x0000000073610000-0x0000000073DC0000-memory.dmp

Download

memory/2144-76-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads