djvu | a578ab8f490d32d4ec916f02ce6ed22ef4572bf21db481dcce5b1b2ccf228d92

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1b4b083e0ea20a087018bde31c37a75.exe
Size 234KB
Sample240208-e2h4qabb4w
SHA256 a578ab8f490d32d4ec916f02ce6ed22ef4572bf21db481dcce5b1b2ccf228d92
MD5 d1b4b083e0ea20a087018bde31c37a75
SHA1 fe5a597a8a0dcf26204e99ef8f7abf2c9359e47f
SHA512 30d41aa90f517119ac77ac0cc9fc86d6f17ccde315dfd05cdbbc7b27e38039a3c2772583c8cf206c21f5a92980cbf1a64f759b364529f88cbdaaa4d85350eb6d
SSDEEP 3072:TxNWLlW4AF8ju87wabOCgCebjiRfo9Nb/ccu57+WC8Xdt5vS5WvtDm:jWLlq8T0cebjiRgvO7LFS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu smokeloader zgrat pub1 backdoor discovery persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.ldhy
offline_id
pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0849ASdw

rsa_pubkey.plain

Signatures

Detect ZGRat V1 19 IoCs

resource	yara_rule
behavioral2/memory/396-88-0x0000000004D50000-0x0000000004E00000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-94-0x0000000005410000-0x00000000054BE000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-95-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-96-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-98-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-100-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-102-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-104-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-112-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-110-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-108-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-106-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-114-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-122-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-120-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-118-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-124-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-126-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/396-116-0x0000000005410000-0x00000000054B9000-memory.dmp	family_zgrat_v1

Detected Djvu ransomware 9 IoCs

resource	yara_rule
behavioral2/memory/4888-24-0x00000000022F0000-0x000000000240B000-memory.dmp	family_djvu
behavioral2/memory/4980-25-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4980-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4980-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4980-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4980-45-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2608-51-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2608-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2608-54-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

.NET Reactor proctector 19 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/396-88-0x0000000004D50000-0x0000000004E00000-memory.dmp	net_reactor
behavioral2/memory/396-94-0x0000000005410000-0x00000000054BE000-memory.dmp	net_reactor
behavioral2/memory/396-95-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-96-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-98-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-100-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-102-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-104-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-112-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-110-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-108-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-106-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-114-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-122-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-120-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-118-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-124-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-126-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor
behavioral2/memory/396-116-0x0000000005410000-0x00000000054B9000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BCD9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	B247.exe

Deletes itself 1 IoCs

pid	Process
3568	Process not Found

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	B247.exe

Executes dropped EXE 8 IoCs

pid	Process
5024	ADF3.exe
4888	BCD9.exe
4980	BCD9.exe
1912	BCD9.exe
2608	BCD9.exe
2312	53BB.exe
396	B247.exe
4772	qemu-ga.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1564	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7779b5e3-833d-450a-9364-1a58bd1edf76\\BCD9.exe\" --AutoStart"	BCD9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	api.2ip.ua
48	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 4980	4888	BCD9.exe	93
PID 1912 set thread context of 2608	1912	BCD9.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3548	2608	WerFault.exe	98
4588	2312	WerFault.exe	102
4552	2312	WerFault.exe	102
2404	2312	WerFault.exe	102
2976	396	WerFault.exe	109

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d1b4b083e0ea20a087018bde31c37a75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADF3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADF3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ADF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d1b4b083e0ea20a087018bde31c37a75.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	d1b4b083e0ea20a087018bde31c37a75.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	d1b4b083e0ea20a087018bde31c37a75.exe
1648	d1b4b083e0ea20a087018bde31c37a75.exe
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found
3568	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1648	d1b4b083e0ea20a087018bde31c37a75.exe
5024	ADF3.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeDebugPrivilege	396	B247.exe
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found
Token: SeShutdownPrivilege	3568	Process not Found
Token: SeCreatePagefilePrivilege	3568	Process not Found

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 5024	3568	Process not Found	91
PID 3568 wrote to memory of 5024	3568	Process not Found	91
PID 3568 wrote to memory of 5024	3568	Process not Found	91
PID 3568 wrote to memory of 4888	3568	Process not Found	92
PID 3568 wrote to memory of 4888	3568	Process not Found	92
PID 3568 wrote to memory of 4888	3568	Process not Found	92
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4888 wrote to memory of 4980	4888	BCD9.exe	93
PID 4980 wrote to memory of 1564	4980	BCD9.exe	94
PID 4980 wrote to memory of 1564	4980	BCD9.exe	94
PID 4980 wrote to memory of 1564	4980	BCD9.exe	94
PID 4980 wrote to memory of 1912	4980	BCD9.exe	95
PID 4980 wrote to memory of 1912	4980	BCD9.exe	95
PID 4980 wrote to memory of 1912	4980	BCD9.exe	95
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 1912 wrote to memory of 2608	1912	BCD9.exe	98
PID 3568 wrote to memory of 2312	3568	Process not Found	102
PID 3568 wrote to memory of 2312	3568	Process not Found	102
PID 3568 wrote to memory of 2312	3568	Process not Found	102
PID 3568 wrote to memory of 396	3568	Process not Found	109
PID 3568 wrote to memory of 396	3568	Process not Found	109
PID 3568 wrote to memory of 396	3568	Process not Found	109
PID 396 wrote to memory of 4772	396	B247.exe	110
PID 396 wrote to memory of 4772	396	B247.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d1b4b083e0ea20a087018bde31c37a75.exe
"C:\Users\Admin\AppData\Local\Temp\d1b4b083e0ea20a087018bde31c37a75.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1648

C:\Users\Admin\AppData\Local\Temp\ADF3.exe
C:\Users\Admin\AppData\Local\Temp\ADF3.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5024

C:\Users\Admin\AppData\Local\Temp\BCD9.exe
C:\Users\Admin\AppData\Local\Temp\BCD9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\BCD9.exe
  C:\Users\Admin\AppData\Local\Temp\BCD9.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\7779b5e3-833d-450a-9364-1a58bd1edf76" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\BCD9.exe
    "C:\Users\Admin\AppData\Local\Temp\BCD9.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\BCD9.exe
      "C:\Users\Admin\AppData\Local\Temp\BCD9.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:2608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 568
        5⤵
        Program crash
        
        PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2608 -ip 2608
1⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\53BB.exe
C:\Users\Admin\AppData\Local\Temp\53BB.exe
1⤵
- Executes dropped EXE
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1116
  2⤵
  - Program crash
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1100
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1160
  2⤵
  - Program crash
  PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2312 -ip 2312
1⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2312 -ip 2312
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2312 -ip 2312
1⤵
PID:624

C:\Users\Admin\AppData\Local\Temp\B247.exe
C:\Users\Admin\AppData\Local\Temp\B247.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 2264
  2⤵
  - Program crash
  PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 396 -ip 396
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53BB.exe

Path C:\Users\Admin\AppData\Local\Temp\53BB.exe
Size 3.2MB
SHA256 f2a9f8bb070263e559379c778fb81204bf9bf1bfc3d366fc11cb48584c4fde3c
MD5 62a86cd2bf1fa8c15a211eb6f67e01b4
SHA1 ca3ff8f72d91c045a9c78f12cb5026fddb3a3058
SHA512 5af4fe676cc8a16da5bc7a069a0b14b2a808e12eb1beca871a6e74a7e1bd54ece415ef48b9210022ac0ab59edf33ad7a83049ca7ddf06f5f9fb94dbb348fd2ec
SSDEEP 98304:luEqDCBNZBMoC5QnwpByzJYdahsJSktid:lwC7MRpY1Y3JKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

53BB.exe

Path C:\Users\Admin\AppData\Local\Temp\53BB.exe
Size 3.4MB
SHA256 2bf6a9598545d9352f7dcfbaa24f426812e06436720b54571ca4cff90bf82af0
MD5 eea9d9eeb2253d96e40438bfdf9f37a5
SHA1 305dbf78911796630561a66667ce9f3ee19ba8cd
SHA512 b64dbe20f795f318543ebbc8450495df5dc72278a5bf3e574d8a6d16d210413b0a3848a9f7fd372b6112a3b79ece957f83bdc7077817dd06e1f3ed5704a2164e
SSDEEP 98304:luEqDCBNZBMoC5QnwpByzJYdahsJSktiFB:lwC7MRpY1Y3JKFB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ADF3.exe

Path C:\Users\Admin\AppData\Local\Temp\ADF3.exe
Size 234KB
SHA256 a578ab8f490d32d4ec916f02ce6ed22ef4572bf21db481dcce5b1b2ccf228d92
MD5 d1b4b083e0ea20a087018bde31c37a75
SHA1 fe5a597a8a0dcf26204e99ef8f7abf2c9359e47f
SHA512 30d41aa90f517119ac77ac0cc9fc86d6f17ccde315dfd05cdbbc7b27e38039a3c2772583c8cf206c21f5a92980cbf1a64f759b364529f88cbdaaa4d85350eb6d
SSDEEP 3072:TxNWLlW4AF8ju87wabOCgCebjiRfo9Nb/ccu57+WC8Xdt5vS5WvtDm:jWLlq8T0cebjiRgvO7LFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

B247.exe

Path C:\Users\Admin\AppData\Local\Temp\B247.exe
Size 649KB
SHA256 9217999518147c602f16ed7d80c9b95dec621f442192ce49192736a27e73847f
MD5 35ffefa212414c2538df410e5ad3afa7
SHA1 e7721fbb85e400c74c7f4de95f1c27b6318caabd
SHA512 7bf9ffe99588a1e6e01a6c84fee7bd998b337653c908e33d3c10f1aa9abc7af925ca9d86a884099824133947614aa070181c973b220163dd99dde87765152a25
SSDEEP 12288:8iKjrHyexBctDvHT5JKxdhlJdMF0GXMHnWI0XSIHEPRMzoAgxAWaxL6:a0tTHTKb3+XuWIaSIHqRpxi6
MD5 SHA1 SHA512 SSDEEP

Submit Download

BCD9.exe

Path C:\Users\Admin\AppData\Local\Temp\BCD9.exe
Size 733KB
SHA256 e701ffa4d637b5a0dce41b547d1c7447a9fdc36198cd83c22a22a983ea828d40
MD5 5b127dfb33460a1a7f49309e53e5074c
SHA1 2f372ad5bfe1395f703dfe0f63980bad366c726e
SHA512 900a9ad9ac8c4dcc6db655d38498b2c2480a4525adfb590ed726d32ca876d89c6dc0565ec370e6a0b06eabdb2e14745c7a7e2b62e49fc05d5ab1354296eb785f
SSDEEP 12288:hXTcab36cloqEoDGFePSV6kEYCPKOyLVQ6YOP7dAxDA9cgExgzzNiREQVYnNzRRc:VLllREoDGFeaYkVCCzLWE7oAOgzzNimH
MD5 SHA1 SHA512 SSDEEP

Submit Download

qemu-ga.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
Size 4KB
SHA256 9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
MD5 a5ce3aba68bdb438e98b1d0c70a3d95c
SHA1 013f5aa9057bf0b3c0c24824de9d075434501354
SHA512 7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79
SSDEEP 48:68kM4rRDxNMk+wwnikZsFtRvlm4MI9BFipfbNtm:8vVDB+wwn0/MvzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-126-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-1945-0x0000000005C10000-0x0000000005C22000-memory.dmp

Download

memory/396-1976-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/396-1975-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/396-1971-0x0000000000530000-0x0000000000630000-memory.dmp

Download

memory/396-1972-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/396-1957-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/396-1955-0x0000000008200000-0x000000000872C000-memory.dmp

Download

memory/396-1954-0x0000000006E30000-0x0000000006FF2000-memory.dmp

Download

memory/396-1953-0x0000000007390000-0x00000000073E0000-memory.dmp

Download

memory/396-1952-0x00000000067D0000-0x00000000067EE000-memory.dmp

Download

memory/396-1951-0x00000000066A0000-0x0000000006716000-memory.dmp

Download

memory/396-1950-0x00000000065F0000-0x0000000006682000-memory.dmp

Download

memory/396-1949-0x0000000005F20000-0x0000000005F86000-memory.dmp

Download

memory/396-1948-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Download

memory/396-1947-0x0000000005D40000-0x0000000005D7C000-memory.dmp

Download

memory/396-1946-0x0000000005C30000-0x0000000005D3A000-memory.dmp

Download

memory/396-95-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-1944-0x00000000055F0000-0x0000000005C08000-memory.dmp

Download

memory/396-1943-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/396-116-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-124-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-118-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-120-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-122-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-114-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-106-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-108-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-110-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-112-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-104-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-102-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-86-0x0000000002160000-0x0000000002225000-memory.dmp

Download

memory/396-87-0x0000000000400000-0x00000000004C8000-memory.dmp

Download

memory/396-85-0x0000000000530000-0x0000000000630000-memory.dmp

Download

memory/396-88-0x0000000004D50000-0x0000000004E00000-memory.dmp

Download

memory/396-89-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/396-90-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/396-92-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/396-91-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/396-100-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-94-0x0000000005410000-0x00000000054BE000-memory.dmp

Download

memory/396-93-0x0000000004E60000-0x0000000005404000-memory.dmp

Download

memory/396-96-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/396-98-0x0000000005410000-0x00000000054B9000-memory.dmp

Download

memory/1648-1-0x0000000000670000-0x0000000000770000-memory.dmp

Download

memory/1648-3-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1648-5-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1648-2-0x00000000005F0000-0x00000000005FB000-memory.dmp

Download

memory/1912-48-0x00000000020A0000-0x0000000002133000-memory.dmp

Download

memory/2312-64-0x0000000001340000-0x0000000001341000-memory.dmp

Download

memory/2312-74-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/2312-73-0x00000000003C0000-0x0000000000F1B000-memory.dmp

Download

memory/2312-75-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/2312-62-0x0000000001300000-0x0000000001301000-memory.dmp

Download

memory/2312-63-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/2312-65-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/2312-77-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/2312-68-0x00000000003C0000-0x0000000000F1B000-memory.dmp

Download

memory/2312-67-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/2312-66-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/2312-79-0x00000000003C0000-0x0000000000F1B000-memory.dmp

Download

memory/2312-76-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/2608-54-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2608-52-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2608-51-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3568-4-0x0000000002440000-0x0000000002456000-memory.dmp

Download

memory/3568-40-0x0000000002AB0000-0x0000000002AC6000-memory.dmp

Download

memory/4772-1977-0x00007FFCA0290000-0x00007FFCA0D51000-memory.dmp

Download

memory/4772-1973-0x00007FFCA0290000-0x00007FFCA0D51000-memory.dmp

Download

memory/4772-1970-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Download

memory/4888-23-0x0000000002150000-0x00000000021E7000-memory.dmp

Download

memory/4888-24-0x00000000022F0000-0x000000000240B000-memory.dmp

Download

memory/4980-27-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4980-25-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4980-28-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4980-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4980-45-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5024-17-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/5024-41-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/5024-16-0x00000000006F0000-0x00000000007F0000-memory.dmp

Download