Resubmissions
16-02-2024 02:54
240216-dd14ysfc71 1016-02-2024 01:10
240216-bjwqbaea93 1009-02-2024 16:00
240209-tfl1taed86 1009-02-2024 13:49
240209-q4sxgsbf9v 1006-02-2024 16:58
240206-vg3kmadccn 1006-02-2024 00:32
240206-avq4jadbfj 10Analysis
-
max time kernel
102s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
09-02-2024 13:49
General
-
Target
4363463463464363463463463.bin.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Malware Config
Extracted
redline
2024
195.20.16.103:20440
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/shell_reverse_tcp
127.0.0.1:12346
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
smokeloader
lab
Extracted
blacknet
v3.6.0 Public
Bot
http://f0483357.xsph.ru/
BN[PHfunXGI-6235724]
-
antivm
true
-
elevate_uac
false
-
install_name
jusched.exe
-
splitter
|BN|
-
start_name
a5b002eacf54590ec8401ff6d3f920ee
-
startup
true
-
usb_spread
true
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
redline
LiveTraffic
20.79.30.95:33223
Extracted
remcos
RemoteHost
hendersonk1.hopto.org:2404
henderson1.camdvr.org:2404
centplus1.serveftp.com:2404
harrywlike.ddns.net:2404
genekol.nsupdate.info:2404
harrywlike1.ddns.net:2404
hendersonk2022.hopto.org:2404
genekol1.nsupdate.info:2404
generem.camdvr.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
sonic.exe
-
copy_folder
yakkk
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
chrome
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
gsgjdwg-1J0WWM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
fuckuuuuu
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Extracted
lumma
http://freckletropsao.pw/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
BlackNET payload 3 IoCs
-
Detect Lumma Stealer payload V4 5 IoCs
-
Detect ZGRat V1 7 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 11 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 5 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Windows security bypass 2 TTPs 7 IoCs
-
XMRig Miner payload 2 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Modifies boot configuration data using bcdedit 14 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Stops running service(s) 3 TTPs
-
.NET Reactor proctector 4 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 31 IoCs
-
Loads dropped DLL 52 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 7 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Suspicious use of SetThreadContext 6 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 13 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\2024.exe"C:\Users\Admin\AppData\Local\Temp\Files\2024.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe"C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe"C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN buildcosta.exe /TR "C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 17⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v6⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe6⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exe"C:\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 6523⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Goldprime.exe"C:\Users\Admin\AppData\Local\Temp\Files\Goldprime.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\hncc.exe"C:\Users\Admin\AppData\Local\Temp\Files\hncc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwAaABuAGMAYwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAaABuAGMAYwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAaABuAGMAYwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAaABuAGMAYwAuAGUAeABlAA==3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\hncc.exeC:\Users\Admin\AppData\Local\Temp\Files\hncc.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\6.exe"C:\Users\Admin\AppData\Local\Temp\Files\6.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Files\art22.exe"C:\Users\Admin\AppData\Local\Temp\Files\art22.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "XGRXZRAP"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "XGRXZRAP" binpath= "C:\ProgramData\wdkmvkocxuib\smazgcisoglo.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "XGRXZRAP"3⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_4.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp86Installerx64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\npp.8.6.2.Installer.x64.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Files\rty49.exe"C:\Users\Admin\AppData\Local\Temp\Files\rty49.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"C:\Users\Admin\AppData\Local\Temp\Files\pinguin.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exeC:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\cpm.exe"C:\Users\Admin\AppData\Local\Temp\Files\cpm.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"C:\Users\Admin\AppData\Local\Temp\Files\costa.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\rty27.exe"C:\Users\Admin\AppData\Local\Temp\rty27.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\licqzghn.cmdline"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\LM.exe"C:\Users\Admin\AppData\Local\Temp\Files\LM.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 923⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\1234pixxxx.exe"C:\Users\Admin\AppData\Local\Temp\Files\1234pixxxx.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AquariumScreening.exe"C:\Users\Admin\AppData\Local\Temp\Files\AquariumScreening.exe"2⤵
-
C:\Windows\SysWOW64\TapiUnattend.exeTapiUnattend.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {31006620-FC86-4B79-8ADD-FE143AF99696} S-1-5-21-3601492379-692465709-652514833-1000:CALKHSYM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exeC:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exeC:\Users\Admin\AppData\Local\Temp\Files\buildcosta.exe2⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240209135006.log C:\Windows\Logs\CBS\CbsPersist_20240209135006.cab1⤵
- Drops file in Windows directory
-
C:\ProgramData\wdkmvkocxuib\smazgcisoglo.exeC:\ProgramData\wdkmvkocxuib\smazgcisoglo.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 272 -s 402⤵
- Loads dropped DLL
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
5Disable or Modify Tools
2Disable or Modify System Firewall
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53f37e595fa431a35a5480ef73513ca6d
SHA1a9f5c9eeb366914e69c0ea3096f9af1b3282f2b0
SHA2567ebd09789675e3cd7a46730291bb3fe513e45cd686e0932c8ca41b8182f0f6d6
SHA512612a982b407a023daf9c0800f8c76422097df88fc123efa9dfc5aa162d6a20e8271bd9d26fe177f3feb0f161fe4a8b9ce5a102120f7efc028c8d2381f5d89172
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a3448692c42182cf82fce0a1934c6267
SHA1ea1a625f9d212ed3f281b1637d00d0ae8d076323
SHA256740cb199721b6ebc4699e97cdd326c39f41806cd5f8dd0a28e1f558fadedf46b
SHA5123e7c2932a02fe3d0ffc009b0779085631257c13e018ca7c13197ed7b3d6ebe40c30656b93d72580342e9966fb218a3f9a291976c7bb146b76869d7e005afdc5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD53248da16688fa2fe0e657eaf882e0e23
SHA19edcdc70fbe126685f2bf5d05d29fe22758497bf
SHA256350ecb5159cbfd6f729cb33ac3f0fb13344b086ab068c3a30e8510ff3373c513
SHA512e7d5c6383dec7f3c89f2f3e64d01f6e46737e5f36930f4facb0d46765783247d6ba2d3d2cc141f653154f10aa55a5328c8107bf23706837d0f74481c37442343
-
C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
4.1MB
MD5ade20fae04d7ffec3d2b6afd687bc064
SHA16bf2ef74d24dce95c177cd29ed525c1984d802b1
SHA256d1db55acd0a0683e84ed687c4484379eb29e92c0189c9f7f5917eb74d18a2537
SHA512140f2fe4e4654fb2f958170cef8c28df2a6a33f554b1e4d04fe39e908c6548be8da30a00e43d09cdecd05f3e1f623390f80d3d2c06ae7bf36ff7abd131f4cb8a
-
C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
2.9MB
MD5b3b2308279ba33ef63fcc733c5ac9ae0
SHA17d16938ef03d728cd3a762f89e65c15649b47413
SHA256bd75d37b7280c0be8f54a346d7f45d559be4d0f98bac8f599c8a85b2c150bbf2
SHA5129b421cc6afcb21391c0be668b9bcbbb0fbf12a8394191b671e05b9ddf3d385d352f23fca71f21082797cb39fd1eb0e9b6048a690146add224f899d57b871ab69
-
C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
2KB
MD5fc8f9f2ec584db0e35fe33c75b363c74
SHA1ecff44fda82a404ec29d569eb676bc811dcb438d
SHA2568abe48eb2dcf5b74032651640299fe1c6427dc7000a02020ceb3c787e67160b0
SHA5124fdce068f0546ec406dda8bbba8ae30dfc5c7a0c50116be366ff1372531b5ba4caf578fd4a3c799e4b7450451e01622321cee9abd636901a852ba398478fcc20
-
C:\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
1.1MB
MD564eb365ba5f1c01087e5de2284caff0e
SHA1a32a8c9cf89c37e22f20a25d8cc54ebe56d0367f
SHA2567d9fd622028040e4bfc8a12a4cb881a286e729b4ee0c8c1a708037108d39a823
SHA5126be7d2c11c12dd8026bdb78c1989682f791fabfeaac8807ee386765738170a0e3b620730299b0524d6f5c0f343e605aa8906fc7b10061df205ee0bfc5ef0fd07
-
C:\Users\Admin\AppData\Local\Temp\Cab13E0.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Files\07c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108.exeFilesize
187KB
MD5abf4e375c25ab5517be3201ec47a0efd
SHA16c1f3667edf6cfb15960cf452de2ab524a6f7cb5
SHA25607c0acc9cd9a6ae4af685344e28e0a756d3f3a77a60f607d3f90f493d7061108
SHA512d153a681ea10a70e922e18a32f6f026609182b6e3643a86dbbabe42a93e617ebed3f95224d5796d98fee406ec6517d4f038a4abf4d398cbb2e86460d2e2bac78
-
C:\Users\Admin\AppData\Local\Temp\Files\1234pixxxx.exeFilesize
1.2MB
MD5e2695d45520fe4058a6df4dff94b51e9
SHA1d78899abd8d0cca04c062a9bc5a5a3758c77683d
SHA2569f51a2ea69977f334c9bc84a4b16a144b8480f978eb975a0e8027a4614c36e8f
SHA512a7f30148367905b1ed413fda9f7c008e651f723a39b582ea095c14728cdc971c43918136c760cbac8d5731db471067a7acb3f311111022f529b9b62c978cdfb7
-
C:\Users\Admin\AppData\Local\Temp\Files\LM.exeFilesize
578KB
MD5196921b3788eac48b29d5ce802ff8e27
SHA1ffc40d6063534e089c897e0baa7116da68b5a4b9
SHA2564059f68b4493074e4baa8129a4d60e6f8c7a01f67b9ba74e10e7a7464d5c6aa9
SHA512c706bf4450da062828b58f2fe37fca957c89546249401be4e86eb7f6bf952ffd7a13d8955c1d0b25aa2d65d4828c20a548a3d178c5fbefbf01bb384afbf6ac17
-
C:\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exeFilesize
237KB
MD577dff22b6f0e083015de3d99c2e483f9
SHA1e606af70a7d6a07cbaf4b4c6dfc34992c1686a5d
SHA256c87a76e508cb9252f3516a5cc2efad3e791f99422abc9f397a23a42834a2613c
SHA51244ffccaed82eab7c97ce917d04217031c70dbd5051520aa8c36b4faa6311f0441a1100a3e0c79caf38c2c643c2823ea276ee9c8675f80837ca280351ab1386f4
-
C:\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exeFilesize
5.8MB
MD54e40c7eb6501b5f46d3dcaab97bdb24a
SHA142869d000caa93a4a87483491c6fd46a79f66e7c
SHA256b042d28c3a644853fa7582b13db9bfb7cd9bd4298c3918aaf68bd8602e623118
SHA5128f225213550ebd2174f76ad05adf55f7281bfac85337eef3ad014bbd4a3c47e32c3ae9104fcb3c41d1924d34fe0e5684a60e22cc1a262c8a14cf2720031058ed
-
C:\Users\Admin\AppData\Local\Temp\Files\art22.exeFilesize
2.5MB
MD568bb10f285c0dbab62f5a8ad7c25ee7a
SHA1bdef33a285d044d88f00136dae499d9e4d714d60
SHA25677dee6099cf3f0bc7cd43f2f44ed61598fc915c30f5ca291338f883c9b86cc1d
SHA5127fb5ea2294d88186bf374ef8f336e10c99d9b224ca0212fbd5399959894c9175ca646a20ef399d0e988474314272f7d7be788a5345c61e3b728f0ba3c72754bd
-
C:\Users\Admin\AppData\Local\Temp\Files\cpm.exeFilesize
3.1MB
MD58069dbf0152888530abe8733b4516d14
SHA194040031b77d1a1e08bff14907d71e313724a281
SHA256f6270f403770f1f2bcc273da2acd9c45f2f7f592a718b8366020b2bc5798e3bb
SHA51293b883d76747dbd0cb9aef40db8607e7df6c45a738a020a5a46b2b01873b81ee4218b80f4c21f9410ab8f1cd7fb7197fedcb1d50a98a1504975879343fb32e1e
-
C:\Users\Admin\AppData\Local\Temp\Files\hncc.exeFilesize
320KB
MD50d177e64941bff99d7b8a26a475450d9
SHA151dab1077ef5061b45e831a3220e9fb4bc27f21d
SHA2563057fbd4c048fd8de15483afce47198975233345f367eed233e582fd50be2939
SHA5124e690654cc9ed20c7bdffade8483c46fe0d77072a7af7d7ffe6e8b7e2537c9d5bab964299787a6e909bd9768056c04a512b5f3b6f16289fae8051ece475b8e02
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exeFilesize
2.1MB
MD55f4e2c8927292f7c85f15f766b11159e
SHA1fe64e693d15e67e05058a0b88afc4600ec19d0a6
SHA2567e77bbb242f36bb7993ec081fbe6881db928c3d3ddf2a67414e2c5fc732235b9
SHA512332b5713c9cb6464ed0ce0594ff785de592ab37a2fee16023cde183b458380c5bef1a2c235f1195684003f9b7fbbb2ed905159c81dc0743710418142e68f9a32
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exeFilesize
1.8MB
MD5d646912c01e012c63d8249a9bb48207b
SHA111d62f9a8873272b37aa69af387bdd3690fac5f8
SHA256de995b5e67b8ec3b5611c4e99fd42a44b6b7af0a49bd5432e1a2dcfc7177a83a
SHA51222a26520e1391ebc4f33e6111b428ce3c94b8514128a06e5b015da99537c27f69b7901a95867007a5dadb78742703d353331b709a2d70bfd3c5b590d2c11e70d
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.errorFilesize
8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.errorFilesize
492KB
MD5fafbf2197151d5ce947872a4b0bcbe16
SHA1a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020
SHA256feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
SHA512acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6
-
C:\Users\Admin\AppData\Local\Temp\Tar1403.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
2.2MB
MD5251cc9f84de7fa1b2e675b7c03caf2de
SHA1d785c1d5f71744e7aad0e7d590a61ae92b914e75
SHA256f71210c2b9f5ee4f11e23528b225ae072b4dc214c0dd155677623ca681519790
SHA512dd1b25df8aad5001471f299b0364fa5a23c48b0d6fd8131066d361d0aa86cb1457054afacce004e86a86dbd650032e07895add8a42e95dbf83e43774195f1927
-
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
960KB
MD51f75e653004692c56ba29f450b71ca86
SHA1e0d9e9482f2ff759cb155b921f81f4c895cd1501
SHA256c3730b5158a1f03445ede701b65982d8e1dc1997bbd36cde8c8b9103167cbfb8
SHA512a35cc3007152dd1b33bd5258142708e693573548f02bad2b0b589bdc87a88766efb5c32f1b865408b05955a12f776b5123b66543f043505e848f73ec4f0d0237
-
C:\Users\Admin\AppData\Local\Temp\tmp16EC.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Roaming\chrome\logs.datFilesize
162B
MD586cd7b74d691aadcd500c80352cc0806
SHA17a4d8346e71af7eeaa6c458d322e56d1f36872d4
SHA25690f2e150386e243ed3b7d6ed6324d0974e108660f9b4b09e78febd9cf543c6bf
SHA512c1e21bf88b0dbee8eadfec8c734beae98b38fb91d0002cf88f8c8e6f099ae8ca9da7579ef46434e20a532705d300c984eadd70b3a052606e8cb2dbab36ece912
-
C:\Users\Admin\AppData\Roaming\hncc.exeFilesize
1.1MB
MD5c227e22771466226949f8c53af85465c
SHA1725a95a7ef0a2b5cccaffe3d8bc1ff12190794d0
SHA256440a17e8dbd0bfad5f1587fe8c758e9461106eb7b04235477d4b7cab156fcfbf
SHA5120a00b6980928ac3984cf512d28c7801050b851b8552cc31b0ad2740873b16b6d64332ce68d8f2981356b1c0e9c22f65d95a42867e9f3547ec0c7fe5b80586aa4
-
C:\Windows\rss\csrss.exeFilesize
960KB
MD5be6a7ca097a81ab6bcda1e03e4c15f93
SHA1ee13f29a65a13f6752cf89d0792efcb0671c21f1
SHA25632c396bf686c566efdb8fe54810fad3175e8937207bc1c6c28ccf3e0cc834be4
SHA512fd622cf886f04d9c7909b990168fd8a6f2ee0b853690995d9b11f288351e8025916e880bcd5e9d89a66756c431c47b2a0dba3ebadcb50604eec7e88358c5448e
-
\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
2.9MB
MD56c95d5bd2c754c19f73291daf7ec2329
SHA1624d2497030f27102b06d444c73c1fde55bbc8b3
SHA256b169ffb3e5873ea300867b9390ab8de16434dda3326ba7dce69bdaad71f78cf3
SHA5128d1c08c81adc3affd4e37d262ef0a04a65cca107ffc1e083f66fe56753500ec689c56812fc593eab63343064162aac92c596cde14d4d0fd3bc48f7b91d0f4681
-
\Users\Admin\AppData\Local\Temp\1000130001\e0cbefcb1af40c7d4aff4aca26621a98.exeFilesize
3.1MB
MD5a273e8a936d48f3367c1f421d1431c1c
SHA165a348609821ac5a1593f17bfc6ec206112d6a08
SHA25697253e6f494c0a74a0ab136da9c59c1435969ac135a313f9a66246cf6d1684ae
SHA5129ba349fae377eb30c2ce5ea5e652b737e9c2e6c0a466d3d7646991049353cde3f9655ecf71d741eecff437bc0a8e9d39a8ee917b28b75df2ae4c3aa3f10220bc
-
\Users\Admin\AppData\Local\Temp\Files\2024.exeFilesize
300KB
MD52c470494b6dc68b2346e42542d80a0fd
SHA187ce1483571bf04d67be4c8cb12fb7dfef4ba299
SHA2561ca8f444f95c2cd9817ce6ab789513e55629c0e0ac0d2b7b552d402517e7cfe9
SHA512c07332228810928b01aba94119e0f93339c08e55ad656d2eaff5c7647e42bbf5ab529232163fb1bbd14af3331a49d0fb537cfb5eb83565f674155e53d4ae41b5
-
\Users\Admin\AppData\Local\Temp\Files\6.exeFilesize
463KB
MD50a28fcd4193b6245f996e04769f8f636
SHA122fe9a8b9a414a42c0119890c90da877fd136b15
SHA256e133f61dfecdf2887af9942b8ac8cdbef141829bcf6aa03037d6d3e7d5c2d623
SHA512f551667b1261780e4946214d2791fefcc57afa256c210d103e93342fce89d1f07c9ee3332c1d42c596d8057725afe7ab06e9e97e00d98de9e0eaa0c2464aaa54
-
\Users\Admin\AppData\Local\Temp\Files\Goldprime.exeFilesize
334KB
MD57e9e39a623a04307eb499ff6617b9746
SHA18d96a7b6464765f32a86e9103955ec74b9b87da9
SHA25688cb62dfdf42ef1b6c083b8c25df0a383476a274ae1e1f0043585d4bdfd1217a
SHA512bae1719b17d910ae001e0e81f9b5af535d844243ff9974da4794e73e73db115f46cc6d9053cedd4dab1b04416ec444774490cbab9b5dac8310aad43fde7c32a1
-
\Users\Admin\AppData\Local\Temp\Files\WinlockerBuilderv5.exeFilesize
256KB
MD556bd918e1976177916a30b27944690eb
SHA1fed9ff0aeeca69ac1ff5cf31a880120db62c8e80
SHA2564aaa964d81ace67b51a2a50ad0060281afc443cdc87514c248f9c1701e77f5b7
SHA5123e929e09e239fe9e03c3ade1d254532532d6314bd31beec7704d130829120dae8ec511f9a1ea59383e54e17b57e2cf6f55b24de5d01594e8b2c305884a2f3218
-
\Users\Admin\AppData\Local\Temp\Files\asas.exeFilesize
443KB
MD55ac25113feaca88b0975eed657d4a22e
SHA1501497354540784506e19208ddae7cc0535df98f
SHA2569a0d8a0fc3c799da381bc0ca4410fd0672f0a8b7c28c319db080325f4db601fe
SHA512769fa8c71855ba1affc7851d394fd6870e01ab8a5e5ee9ab5e63290708b3233e1b0a47185a13d2e52d29917c5b40f8adedb1efc3305b1cdf31802b4c796a25aa
-
\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exeFilesize
63KB
MD5eef08365ee3d38dcf90a93c1a0817e64
SHA132a92c1beef6af07069924387a8bd069572eb83f
SHA256484051fcf1d7f8de7084c7419cf49f65b85ab16642093d5c4249002e9e31a00c
SHA512748479cf7d575a4b14f08a113989ffc79f14bdf49c453be04ef4bdeaaec347590d0661e08dc486329c1ec9119d4c6ffe3ee51430efe90283d1f89eada7d20304
-
\Users\Admin\AppData\Local\Temp\Files\bin.exeFilesize
2.2MB
MD5bbb01993344d8a2b73f43a789982a432
SHA13aa996cb23c3699c1fca30acef86a03a2103564a
SHA2564efe531c56e2be66561bf1c7c800891df978a5f5fb0cc0b4c047464cf6d18252
SHA512434bba5cd42cdb9b148a739a6d40ea9b0e99d6d13184e12a54b0bbbbbf82fd571949f495a8d6b3c29587b6655f132d9b92cd332e908f85ae9a74456d2b6b8609
-
\Users\Admin\AppData\Local\Temp\Files\buildcosta.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exeFilesize
136KB
MD5ab13d611d84b1a1d9ffbd21ac130a858
SHA1336a334cd6f1263d3d36985a6a7dd15a4cf64cd9
SHA2567b021b996b65f29cae4896c11d3a31874e2d5c4ce8a7a212c8bedf7dcae0f8ae
SHA512c608c3cba7fcad11e6e4ae1fc17137b95ee03b7a0513b4d852405d105faf61880da9bf85b3ce7c1c700adedbf5cdccaae01e43a0345c3f1ee01b639960de877f
-
\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exeFilesize
187KB
MD58e34d5cf7e39f355cdaa0a9ba0533901
SHA1896a0ef46306262742dc5631f225252e37266c86
SHA256f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae
SHA51250b0cb12315e97636ec9de08f3d49b4ddb7ef02377936a4bf0a44c47df4a85b3fe1284a20b23c86e52e1c916be61b757afb7fe00abc028d30b38fb9ff0151d3c
-
\Users\Admin\AppData\Local\Temp\Files\hncc.exeFilesize
448KB
MD5635bc6a7d1a8173c654c21c4874eddd1
SHA1b69c723ba007c9eaf9cb1b70108d296a4690f29e
SHA2565e8a4b333c5aa68f471b72a450ffbf57638cb2cf955804681e0acb817a8b9d04
SHA51262f99cebce65f0ee5d77227ea455aa912882e954667d887093405256793ea1441b94c85733aea5645a6b56bb8a51477ad39b0426a9620f6f54fc59ff160a26d3
-
\Users\Admin\AppData\Local\Temp\Files\hv.exeFilesize
5.4MB
MD5bde65ceac062139cc65ad0222eb0a336
SHA170d9258459d7ef385eb34dfa2e1d7258077e1e37
SHA25643cc8ad6513f7c8e9b76fed2fd6737a3ab7d4c48f75fd1fc76c02d3140131375
SHA512584c3cff57a1de5f906e606e7ac44bc47c09bc0cf40904d3d2599f1e0fa97b795f734a6f3a7769773a0add0157deaeaf5c11e9e7c5ec4a1eb0484f1c56aa0632
-
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dllFilesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeFilesize
94KB
MD5d98e78fd57db58a11f880b45bb659767
SHA1ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA256414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
SHA512aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
-
\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
\Users\Admin\AppData\Local\Temp\dbghelp.dllFilesize
1.5MB
MD5f0616fa8bc54ece07e3107057f74e4db
SHA1b33995c4f9a004b7d806c4bb36040ee844781fca
SHA2566e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
SHA51215242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
1.1MB
MD5a9a6778b7b83e913b9b55eb4d1476042
SHA13256dede4bd1214ba19e0bc67900ffbae364f854
SHA256f5872a7bab6d3dd42bb26aa43dcfc7ea54f18e91d315ab252f6737d1db41e01d
SHA5125037711a23458f9deb618391d57b50a6a5e8dce52fd10415783540ed23ddb31dc823e2d4fecbcd607f38625eb6259d289eecee30c5eda50578df86ac042dae59
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
2.5MB
MD573b1f002db75e894b53dac0c507a1064
SHA13196a961d35f836f8118728d696c264e233a617b
SHA25656b5841db54c135a4e3775f4af1a73a37bca61750e6257914b3c8fdf2635d181
SHA512af404beeeef948b6403bb2d4a06b7809b1cd1122b4e8e48adba6068cfe322448db348302602b744e9d04fa00a29c1e43081e749e6cc54165b23e61ac8f6118f6
-
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
1024KB
MD536faf3a793dbb6e80cd9ec2282ae4404
SHA16118ce7d7e64040e97018d6d4383ddfb6f1394e5
SHA256f8785b8eef542d5f08fdcb9d8d275aab8d8980dece2e4e5c7f26df3b02879cec
SHA512f395e3d2c71117f5b8256ec25172f280ae74b99e4e7c3eec40e21ab14d486dfaeed3851437851deab9c7c54c3725b3c5a485e562cdd02e548ee9edd1df031e8e
-
\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
\Users\Admin\AppData\Local\Temp\symsrv.dllFilesize
163KB
MD55c399d34d8dc01741269ff1f1aca7554
SHA1e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA256e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
SHA5128ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
-
\Windows\rss\csrss.exeFilesize
2.4MB
MD5d673f41dacca051cc4f1e8956160affa
SHA1a741fb8d904c9547a529ed9638c1242261e0cbf5
SHA256882cf63d4246a00bbba4da23e5d71b9da9c92810bce8267fa7458052ae6fa68b
SHA5128f9eae8ffccfad1ce9abb51a2426be9ab97562641e669db1994415fedd7f2160799e999c297404c0ba13ca58e1be888a4cd14c928d1b4b06921d37f65d0f9dfc
-
\Windows\rss\csrss.exeFilesize
3.3MB
MD531b26a23f94ef8ed2cbb13598f16c7c9
SHA1717a56daafcce79b44aa998a4a5caa5969cac755
SHA256065b81c65931c9981a406e1f102cb67ff86b1b99458dd77d4765280cada9c6d1
SHA512ed29f75bb12a8b987ea8079301a9f0de2585f014d2726b91b829a66a660d70a960f0a6e0e0e5e422b32a834a050963c5ce56c9a418a6033fb97235b876e60953
-
memory/280-84-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/280-83-0x0000000000C70000-0x0000000000CC2000-memory.dmpFilesize
328KB
-
memory/280-168-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/280-85-0x0000000000AF0000-0x0000000000B30000-memory.dmpFilesize
256KB
-
memory/280-195-0x0000000000AF0000-0x0000000000B30000-memory.dmpFilesize
256KB
-
memory/332-198-0x000007FEF6270000-0x000007FEF6C0D000-memory.dmpFilesize
9.6MB
-
memory/332-200-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/332-199-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/332-197-0x0000000002BB0000-0x0000000002C30000-memory.dmpFilesize
512KB
-
memory/332-230-0x000007FEF6270000-0x000007FEF6C0D000-memory.dmpFilesize
9.6MB
-
memory/332-196-0x000007FEF6270000-0x000007FEF6C0D000-memory.dmpFilesize
9.6MB
-
memory/340-239-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/340-253-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/660-315-0x00000000008D0000-0x000000000092A000-memory.dmpFilesize
360KB
-
memory/660-360-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/660-348-0x0000000002020000-0x0000000004020000-memory.dmpFilesize
32.0MB
-
memory/660-316-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/1084-180-0x0000000077A70000-0x0000000077C19000-memory.dmpFilesize
1.7MB
-
memory/1084-113-0x0000000077A70000-0x0000000077C19000-memory.dmpFilesize
1.7MB
-
memory/1084-112-0x0000000077A70000-0x0000000077C19000-memory.dmpFilesize
1.7MB
-
memory/1092-208-0x0000000002500000-0x0000000002516000-memory.dmpFilesize
88KB
-
memory/1248-68-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1248-73-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-66-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-65-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-64-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-63-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-69-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-67-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1248-71-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1456-166-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB
-
memory/1456-165-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/1524-328-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/1524-424-0x0000000004E90000-0x0000000004F87000-memory.dmpFilesize
988KB
-
memory/1524-358-0x0000000004E90000-0x0000000004F8E000-memory.dmpFilesize
1016KB
-
memory/1524-364-0x0000000004E90000-0x0000000004F87000-memory.dmpFilesize
988KB
-
memory/1524-365-0x0000000004E90000-0x0000000004F87000-memory.dmpFilesize
988KB
-
memory/1524-367-0x0000000004E90000-0x0000000004F87000-memory.dmpFilesize
988KB
-
memory/1524-369-0x0000000004E90000-0x0000000004F87000-memory.dmpFilesize
988KB
-
memory/1524-371-0x0000000004E90000-0x0000000004F87000-memory.dmpFilesize
988KB
-
memory/1524-413-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/1524-353-0x00000000049A0000-0x0000000004A9C000-memory.dmpFilesize
1008KB
-
memory/1524-351-0x0000000004B70000-0x0000000004BB0000-memory.dmpFilesize
256KB
-
memory/1524-346-0x0000000004280000-0x000000000437C000-memory.dmpFilesize
1008KB
-
memory/1524-327-0x00000000000E0000-0x00000000001FA000-memory.dmpFilesize
1.1MB
-
memory/1540-209-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1540-163-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1540-167-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1540-161-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1756-337-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1756-361-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1756-331-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1756-349-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1756-347-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1756-345-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1756-354-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1756-357-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/1944-114-0x0000000000030000-0x0000000000044000-memory.dmpFilesize
80KB
-
memory/2072-373-0x0000000006D80000-0x0000000007160000-memory.dmpFilesize
3.9MB
-
memory/2072-379-0x0000000000670000-0x0000000000680000-memory.dmpFilesize
64KB
-
memory/2072-122-0x0000000001330000-0x000000000189C000-memory.dmpFilesize
5.4MB
-
memory/2072-123-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2072-124-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-203-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2072-205-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-412-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2072-386-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-374-0x0000000007160000-0x00000000072F2000-memory.dmpFilesize
1.6MB
-
memory/2072-388-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-387-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-381-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-382-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-383-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-384-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2072-385-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2196-394-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2196-396-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2196-402-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/2196-400-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2196-389-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2196-391-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2196-392-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2196-393-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2196-398-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2376-190-0x00000000024D0000-0x00000000028C8000-memory.dmpFilesize
4.0MB
-
memory/2376-202-0x00000000028D0000-0x00000000031BB000-memory.dmpFilesize
8.9MB
-
memory/2376-217-0x00000000028D0000-0x00000000031BB000-memory.dmpFilesize
8.9MB
-
memory/2376-215-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2376-218-0x00000000024D0000-0x00000000028C8000-memory.dmpFilesize
4.0MB
-
memory/2376-201-0x00000000024D0000-0x00000000028C8000-memory.dmpFilesize
4.0MB
-
memory/2376-204-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2464-95-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2484-206-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/2732-229-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2732-216-0x0000000002640000-0x0000000002A38000-memory.dmpFilesize
4.0MB
-
memory/2732-219-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2732-214-0x0000000002640000-0x0000000002A38000-memory.dmpFilesize
4.0MB
-
memory/3012-228-0x0000000002580000-0x0000000002978000-memory.dmpFilesize
4.0MB
-
memory/3012-307-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3012-425-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3012-380-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3012-401-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3012-231-0x0000000002580000-0x0000000002978000-memory.dmpFilesize
4.0MB
-
memory/3012-232-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3048-0-0x0000000000980000-0x0000000000988000-memory.dmpFilesize
32KB
-
memory/3048-75-0x00000000006B0000-0x00000000006F0000-memory.dmpFilesize
256KB
-
memory/3048-74-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB
-
memory/3048-2-0x00000000006B0000-0x00000000006F0000-memory.dmpFilesize
256KB
-
memory/3048-1-0x0000000074C70000-0x000000007535E000-memory.dmpFilesize
6.9MB