djvu | ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
Size 174KB
Sample240207-srwtqahf82
SHA256 ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7
MD5 20d467f075750c049e83ec92d895e531
SHA1 d1dfbb732c9b883acd7cba5b4db5690d504dc885
SHA512 10f4bb6cfa937e041edb9e523ae52bf8abc51e13012dd805907b22eb0295a79c3bebe5302cf45fa01a366a354143603577bd259934395d208ae6266448e870a6
SSDEEP 3072:OGFLyRU39oZ2XmegMW1mMj0jPWg34RxbA13:7LyRKoZ2XmJt1ijPebA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu risepro smokeloader zgrat pub1 backdoor discovery persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.ldhy
offline_id
pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0849ASdw

rsa_pubkey.plain

Extracted

Family

risepro

195.20.16.207:50500

Signatures

Detect ZGRat V1 20 IoCs

resource	yara_rule
behavioral2/memory/5064-83-0x0000000004D40000-0x0000000004DF0000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-88-0x00000000053B0000-0x000000000545E000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-90-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-89-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-92-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-94-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-96-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-98-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-100-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-102-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-104-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-106-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-108-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-110-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-112-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-114-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-117-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-119-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-125-0x00000000053B0000-0x0000000005459000-memory.dmp	family_zgrat_v1
behavioral2/memory/1012-146-0x00000000020F0000-0x000000000219B000-memory.dmp	family_zgrat_v1

Detected Djvu ransomware 9 IoCs

resource	yara_rule
behavioral2/memory/2820-28-0x0000000002170000-0x000000000228B000-memory.dmp	family_djvu
behavioral2/memory/3180-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3180-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3180-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3180-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3180-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4884-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4884-50-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4884-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

.NET Reactor proctector 20 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/5064-83-0x0000000004D40000-0x0000000004DF0000-memory.dmp	net_reactor
behavioral2/memory/5064-88-0x00000000053B0000-0x000000000545E000-memory.dmp	net_reactor
behavioral2/memory/5064-90-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-89-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-92-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-94-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-96-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-98-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-100-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-102-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-104-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-106-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-108-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-110-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-112-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-114-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-117-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-119-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/5064-125-0x00000000053B0000-0x0000000005459000-memory.dmp	net_reactor
behavioral2/memory/1012-146-0x00000000020F0000-0x000000000219B000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	BC9A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	A798.exe

Deletes itself 1 IoCs

pid	Process
3524	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	A798.exe

Executes dropped EXE 9 IoCs

pid	Process
432	A70D.exe
2820	BC9A.exe
3180	BC9A.exe
3052	BC9A.exe
4884	BC9A.exe
3784	47B4.exe
5064	A798.exe
1012	AD46.exe
1544	qemu-ga.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3724	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\22a7f6fa-0358-4e1f-8a1b-202c86884951\\BC9A.exe\" --AutoStart"	BC9A.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	api.2ip.ua
48	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 3180	2820	BC9A.exe	94
PID 3052 set thread context of 4884	3052	BC9A.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3828	4884	WerFault.exe	99
776	3784	WerFault.exe	103
3752	5064	WerFault.exe	106

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A70D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A70D.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	A70D.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
3244	ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found
3524	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3244	ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
432	A70D.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeDebugPrivilege	5064	A798.exe
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found
Token: SeShutdownPrivilege	3524	Process not Found
Token: SeCreatePagefilePrivilege	3524	Process not Found

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 432	3524	Process not Found	92
PID 3524 wrote to memory of 432	3524	Process not Found	92
PID 3524 wrote to memory of 432	3524	Process not Found	92
PID 3524 wrote to memory of 2820	3524	Process not Found	93
PID 3524 wrote to memory of 2820	3524	Process not Found	93
PID 3524 wrote to memory of 2820	3524	Process not Found	93
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 2820 wrote to memory of 3180	2820	BC9A.exe	94
PID 3180 wrote to memory of 3724	3180	BC9A.exe	96
PID 3180 wrote to memory of 3724	3180	BC9A.exe	96
PID 3180 wrote to memory of 3724	3180	BC9A.exe	96
PID 3180 wrote to memory of 3052	3180	BC9A.exe	97
PID 3180 wrote to memory of 3052	3180	BC9A.exe	97
PID 3180 wrote to memory of 3052	3180	BC9A.exe	97
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3052 wrote to memory of 4884	3052	BC9A.exe	99
PID 3524 wrote to memory of 3784	3524	Process not Found	103
PID 3524 wrote to memory of 3784	3524	Process not Found	103
PID 3524 wrote to memory of 3784	3524	Process not Found	103
PID 3524 wrote to memory of 5064	3524	Process not Found	106
PID 3524 wrote to memory of 5064	3524	Process not Found	106
PID 3524 wrote to memory of 5064	3524	Process not Found	106
PID 3524 wrote to memory of 1012	3524	Process not Found	107
PID 3524 wrote to memory of 1012	3524	Process not Found	107
PID 3524 wrote to memory of 1012	3524	Process not Found	107
PID 5064 wrote to memory of 1544	5064	A798.exe	109
PID 5064 wrote to memory of 1544	5064	A798.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe
"C:\Users\Admin\AppData\Local\Temp\ad09e6469ff6f776f4dda5c3bfd3ef3bda8d3e66a0f3656c19a003428ee43db7.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3244

C:\Users\Admin\AppData\Local\Temp\A70D.exe
C:\Users\Admin\AppData\Local\Temp\A70D.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:432

C:\Users\Admin\AppData\Local\Temp\BC9A.exe
C:\Users\Admin\AppData\Local\Temp\BC9A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\BC9A.exe
  C:\Users\Admin\AppData\Local\Temp\BC9A.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\22a7f6fa-0358-4e1f-8a1b-202c86884951" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3724
- - C:\Users\Admin\AppData\Local\Temp\BC9A.exe
    "C:\Users\Admin\AppData\Local\Temp\BC9A.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\BC9A.exe
      "C:\Users\Admin\AppData\Local\Temp\BC9A.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:4884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 568
        5⤵
        Program crash
        
        PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4884 -ip 4884
1⤵
PID:3228

C:\Users\Admin\AppData\Local\Temp\47B4.exe
C:\Users\Admin\AppData\Local\Temp\47B4.exe
1⤵
- Executes dropped EXE
PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1128
  2⤵
  - Program crash
  PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3784 -ip 3784
1⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\A798.exe
C:\Users\Admin\AppData\Local\Temp\A798.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1220
  2⤵
  - Program crash
  PID:3752

C:\Users\Admin\AppData\Local\Temp\AD46.exe
C:\Users\Admin\AppData\Local\Temp\AD46.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5064 -ip 5064
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47B4.exe

Path C:\Users\Admin\AppData\Local\Temp\47B4.exe
Size 6.0MB
SHA256 dd87f94c961b9612bbd65761bee6ed15318d63652f262e2c425bd177a2341a19
MD5 95e59305ad61119cf15ee95562bd05ba
SHA1 0f0059cda9609c46105cf022f609c407f3718e04
SHA512 5fbcfe79162460080e0c3944df747835f0b8f2cdb35b038eb69eadf2eb85a209f7d5432a328d0f0eeafba036012f48793e3c08d94531b98a12a498bcf3b00ad2
SSDEEP 98304:luEqDCBNZBMoC5QnwpByzJYdahsJSktiFB3nCh3UUcRvbL6wXKhVEHsRMYC+dR/o:lwC7MRpY1Y3JKFVCh36L6vIpYC+dl4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

A70D.exe

Path C:\Users\Admin\AppData\Local\Temp\A70D.exe
Size 170KB
SHA256 1551739422761204577406d511108a62afb653aaed9353b405fee25ad14c19eb
MD5 bbe17beb5322cc197cece72e5988f2fd
SHA1 45741111a6aba5044cc5a113f5a41a607f54b1d0
SHA512 d525b4e28f1aadad80e9fa825fce51b7964cbdbbd3f3abab2d54668021a5a2df7ae398ab0e2690279e04bfd9fc86a8b9d9ccbf5bb8294f1b1cf7e0ddb4f084ab
SSDEEP 3072:J5CUGGUZ/7N4oBW1SEW8XWAEONG30APPxpPjefS:J5CtGqBcSEhGAEnrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

A798.exe

Path C:\Users\Admin\AppData\Local\Temp\A798.exe
Size 649KB
SHA256 9217999518147c602f16ed7d80c9b95dec621f442192ce49192736a27e73847f
MD5 35ffefa212414c2538df410e5ad3afa7
SHA1 e7721fbb85e400c74c7f4de95f1c27b6318caabd
SHA512 7bf9ffe99588a1e6e01a6c84fee7bd998b337653c908e33d3c10f1aa9abc7af925ca9d86a884099824133947614aa070181c973b220163dd99dde87765152a25
SSDEEP 12288:8iKjrHyexBctDvHT5JKxdhlJdMF0GXMHnWI0XSIHEPRMzoAgxAWaxL6:a0tTHTKb3+XuWIaSIHqRpxi6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AD46.exe

Path C:\Users\Admin\AppData\Local\Temp\AD46.exe
Size 824KB
SHA256 2c842e8a9e3ab59cd6d22f252ac5ec9647585fd522c4df7d09422c80a9990777
MD5 82d7425c9f8297a3ca6dd38b2ed71920
SHA1 911bc54e20cd1f31cfa436a321862dd33df606eb
SHA512 769f0c1bca2f0a3c5ff6d9e9327f32211d66364d900b3345017abc76065988ee1ffcbfc1fc8e691c21e4af7ad11de809d3870eb6d1676181f09f3510b4eea9c0
SSDEEP 12288:K3d8MC8QCcfQPW2w5EW+YCoIqQFtB/j2fd5CymbhHfBoWtGeXasyogh+MOPxLZ:c8VLF2EbKtN2fY/BoWXRLkO9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

BC9A.exe

Path C:\Users\Admin\AppData\Local\Temp\BC9A.exe
Size 740KB
SHA256 edbb123bddbbb9a80d3d77993203ae70384dee044a746f11eebf3618218f44a0
MD5 d9758d759dc14cf62f1a5f3031b5abdd
SHA1 8ae78e4af2b52042d911496ac8c512ba4ab2ad12
SHA512 01fa4235840f5bad236d2f9757f80d96df1aac88702cff886f2249205a634d662272fcd18a69d5df75f266a195a1584b8c503a347c34b1a81c1f89a56c99357d
SSDEEP 12288:2p0P5KQSVIHlZXCx8ISMICRJXBdE0tWDDQ3wiRhYRy5F8eUxOCquOxL6:vov43Cx8I3ICRJXB7WnQ3wiTYEL8eUxP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qemu-ga.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
Size 4KB
SHA256 9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
MD5 a5ce3aba68bdb438e98b1d0c70a3d95c
SHA1 013f5aa9057bf0b3c0c24824de9d075434501354
SHA512 7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79
SSDEEP 48:68kM4rRDxNMk+wwnikZsFtRvlm4MI9BFipfbNtm:8vVDB+wwn0/MvzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-19-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/432-17-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/432-16-0x0000000000590000-0x0000000000690000-memory.dmp

Download

memory/1012-1982-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/1012-149-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/1012-147-0x00000000022F0000-0x0000000002431000-memory.dmp

Download

memory/1012-146-0x00000000020F0000-0x000000000219B000-memory.dmp

Download

memory/1012-1980-0x00000000020F0000-0x000000000219B000-memory.dmp

Download

memory/1544-1972-0x00000000002E0000-0x00000000002E8000-memory.dmp

Download

memory/1544-1984-0x00007FFA57FB0000-0x00007FFA58A71000-memory.dmp

Download

memory/1544-1976-0x00007FFA57FB0000-0x00007FFA58A71000-memory.dmp

Download

memory/2820-27-0x00000000020D0000-0x0000000002170000-memory.dmp

Download

memory/2820-28-0x0000000002170000-0x000000000228B000-memory.dmp

Download

memory/3052-48-0x0000000001FD0000-0x0000000002065000-memory.dmp

Download

memory/3180-32-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3180-33-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3180-43-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3180-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3180-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3244-2-0x0000000002B10000-0x0000000002B1B000-memory.dmp

Download

memory/3244-5-0x0000000000400000-0x0000000002B04000-memory.dmp

Download

memory/3244-3-0x0000000000400000-0x0000000002B04000-memory.dmp

Download

memory/3244-1-0x0000000002B20000-0x0000000002C20000-memory.dmp

Download

memory/3524-18-0x0000000002CE0000-0x0000000002CF6000-memory.dmp

Download

memory/3524-4-0x00000000025F0000-0x0000000002606000-memory.dmp

Download

memory/3784-62-0x0000000000910000-0x000000000146B000-memory.dmp

Download

memory/3784-66-0x0000000000910000-0x000000000146B000-memory.dmp

Download

memory/3784-74-0x0000000000910000-0x000000000146B000-memory.dmp

Download

memory/3784-72-0x0000000000910000-0x000000000146B000-memory.dmp

Download

memory/3784-67-0x00000000035E0000-0x00000000035E1000-memory.dmp

Download

memory/3784-63-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download

memory/3784-65-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/3784-73-0x00000000035F0000-0x00000000035F1000-memory.dmp

Download

memory/3784-64-0x00000000035C0000-0x00000000035C1000-memory.dmp

Download

memory/3784-61-0x0000000003580000-0x0000000003581000-memory.dmp

Download

memory/3784-60-0x0000000003470000-0x0000000003471000-memory.dmp

Download

memory/4884-49-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-52-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-50-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5064-90-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-92-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-94-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-96-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-98-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-100-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-102-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-104-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-106-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-108-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-110-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-112-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-114-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-117-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-119-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-89-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-125-0x00000000053B0000-0x0000000005459000-memory.dmp

Download

memory/5064-88-0x00000000053B0000-0x000000000545E000-memory.dmp

Download

memory/5064-87-0x0000000004E00000-0x00000000053A4000-memory.dmp

Download

memory/5064-86-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/5064-1945-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/5064-1946-0x0000000005600000-0x0000000005C18000-memory.dmp

Download

memory/5064-1947-0x0000000005C20000-0x0000000005C32000-memory.dmp

Download

memory/5064-1948-0x0000000005C40000-0x0000000005D4A000-memory.dmp

Download

memory/5064-1949-0x0000000005D50000-0x0000000005D8C000-memory.dmp

Download

memory/5064-1950-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Download

memory/5064-1951-0x0000000005F30000-0x0000000005F96000-memory.dmp

Download

memory/5064-1952-0x0000000006700000-0x0000000006792000-memory.dmp

Download

memory/5064-1953-0x00000000067B0000-0x0000000006826000-memory.dmp

Download

memory/5064-1954-0x0000000006A00000-0x0000000006A1E000-memory.dmp

Download

memory/5064-1955-0x0000000006F90000-0x0000000006FE0000-memory.dmp

Download

memory/5064-1956-0x0000000007320000-0x00000000074E2000-memory.dmp

Download

memory/5064-1957-0x00000000075E0000-0x0000000007B0C000-memory.dmp

Download

memory/5064-1958-0x0000000000790000-0x0000000000890000-memory.dmp

Download

memory/5064-83-0x0000000004D40000-0x0000000004DF0000-memory.dmp

Download

memory/5064-85-0x0000000004DF0000-0x0000000004E00000-memory.dmp

Download

memory/5064-1974-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/5064-1975-0x0000000074230000-0x00000000749E0000-memory.dmp

Download

memory/5064-84-0x0000000074230000-0x00000000749E0000-memory.dmp

Download

memory/5064-1978-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/5064-1979-0x0000000074230000-0x00000000749E0000-memory.dmp

Download

memory/5064-82-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/5064-81-0x00000000006A0000-0x0000000000765000-memory.dmp

Download

memory/5064-80-0x0000000000790000-0x0000000000890000-memory.dmp

Download