6d5fad66f8931dcf8ee3223c0462a2e5da92e77af9e241301646ce8460124692

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a2685e9034914b7c8381fbafcf00ee1.exe
Size 249KB
Sample240213-22spgsbc2v
SHA256 6d5fad66f8931dcf8ee3223c0462a2e5da92e77af9e241301646ce8460124692
MD5 9a2685e9034914b7c8381fbafcf00ee1
SHA1 2f99826362b6105aac0316ab655857a410cfb4ad
SHA512 01859fbfa65e829564bd0d4af38089f08e0f39604d7223a558aabb6f9187471e3b79a49a1fbff06cabc16cfac7eab2ce39f0d916ca9bf0e7437ec2fa35d68182
SSDEEP 6144:h1OgDPdkBAFZWjadD4s5RhcmsuGJD7OOjdNpCjtSs:h1OgLdaORhcduGl6OjLoF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000023240-49.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2996	50d925e6334af.exe

Loads dropped DLL 3 IoCs

pid	Process
2996	50d925e6334af.exe
2996	50d925e6334af.exe
2996	50d925e6334af.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023240-49.dat	upx
behavioral2/memory/2996-52-0x00000000745C0000-0x00000000745CA000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\ = "Zoomex"	50d925e6334af.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\NoExplorer = "1"	50d925e6334af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000600000002322b-21.dat	nsis_installer_1
behavioral2/files/0x000600000002322b-21.dat	nsis_installer_2
behavioral2/files/0x0006000000023244-78.dat	nsis_installer_1
behavioral2/files/0x0006000000023244-78.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\ProgID\ = "Zoomex.1"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Zoomex"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\InProcServer32\ThreadingModel = "Apartment"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Zoomex\\50d925e6334e8.tlb"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\ = "Zoomex"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\InProcServer32\ = "C:\\ProgramData\\Zoomex\\50d925e6334e8.dll"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\ProgID	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}	50d925e6334af.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6}\InProcServer32	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	50d925e6334af.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2996	4812	9a2685e9034914b7c8381fbafcf00ee1.exe	84
PID 4812 wrote to memory of 2996	4812	9a2685e9034914b7c8381fbafcf00ee1.exe	84
PID 4812 wrote to memory of 2996	4812	9a2685e9034914b7c8381fbafcf00ee1.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	50d925e6334af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{47354EEE-30C2-647D-F4F8-2BE06539F2E6} = "1"	50d925e6334af.exe

C:\Users\Admin\AppData\Local\Temp\9a2685e9034914b7c8381fbafcf00ee1.exe
"C:\Users\Admin\AppData\Local\Temp\9a2685e9034914b7c8381fbafcf00ee1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\50d925e6334af.exe
  .\50d925e6334af.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\Zoomex\uninstall.exe
Size 48KB
SHA256 43c3e8d7aa00a299f084db17e384aa96de508565f82264ee88bd9c7647fa9fc9
MD5 e9c9582996a23b2a49a058dcaa3b5525
SHA1 f527cc64e759f06c011e5eeffbd217d5249c04df
SHA512 665613fc7f20e2c4ea40b7a8f39b4c2ea2a24c5119ee86ef072bbe29f606cd78a43081aa0a89b678a46d34e470e1ed10e31d590d3cb5447e1231707fea8e490f
SSDEEP 768:l4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJGfg4RoeMZeUZB/WvnQ9qI2:WLXB65939tY6HBg4sXJL4RoKu/WvQYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 e2ea4f4afeb5fda677909f36953789de53da7674fe5cce886956954d8012ae8c
MD5 1ad972804dc271a8ecdf280c7d2fa929
SHA1 20c3499913e34dc48f276e823bd3cc4781d61cc3
SHA512 c2a730c9d7a86e6ffb1e05554059de2a3a3b43df905ced6fd141fd8d2ef679b0b8842c7dca7f3070a3c798c181659785f7870534d6cd4ea682018ac6fb8390ea
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 e2d2363f9a40a52810b96540a48f9c3ce2018015f6a1a6181292726529bc140c
MD5 2cdad6df8de6a62642f72643356bb96e
SHA1 08f8a3e0c8ac26f0a9d25a2eb196a92b2ba78695
SHA512 ddc0528c39132eabaf672551b3269715c5010286fd09628556b131058aa88f61e88892664c418695a7abf2af6a1c010f3b00103e31d52d28696ce594e337f588
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 c5be8a5836bd5e92acc991e9555f054ff41890828b8d0588a335b4db5babfa27
MD5 94728fab3eaf4e353d6341e1cb5204dc
SHA1 690bec43fb95c2dc8af2882741a8d5304bf7b5bc
SHA512 70bd462ae2e8a5761ab8a746235292b2374aff4bb7a0eff34a7774a7c2d11c6c6e9742c69155bce55e3107e8308be62efa4b13b45518dce1ecc5ee6de90d05e6
SSDEEP 192:lo3v4UCtgg3LE235UsZkJn7ERhz7QnVqkYTvac7E:uvHkggYu1ZkJ4Pz7wTyvB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\[email protected]\content\zy.xul
Size 225B
SHA256 61c67cd7aab1f26674e1389efc74afc5f5c3ba2fad31e10edfc1025ce6244f70
MD5 a9b85f876f4953229ae985580f4285f1
SHA1 790a27428bf40ce1f19e6d150371a34ba357d7cd
SHA512 e7cfc8737c0b582ba02c694dc2bb36f8b26d6ac05bf26f2e57ff6c50c0bc9118309ed10ed01c3ed532bcac856c86410bd1d49776172089c3a5dba0af582a7ec6
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\[email protected]\install.rdf
Size 700B
SHA256 6dc54047a9ab9369ea224991316b14c49d210618b8addeaaa40d51868b0b7732
MD5 aa6b4c3a49b75e14a39873ff67ef6fa0
SHA1 31a67afdac82d7253c8756767ce324ff14fbcca3
SHA512 d614e5d0ff9e0115545413ade6dc808a42bee8d129620bfbc7d972425a42a8f9504fda2cb902259b0265b4c221faa8f6408ce73f5c97b047325d688ee1c25663
MD5 SHA1 SHA512

Submit Download

50d925e6334af.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\50d925e6334af.exe
Size 70KB
SHA256 5e74f0e710c067ad82301c7c14ed6afb138f974f351042cfe0ecd275cea2612c
MD5 ebcc3eb1a7021aaead55fb677465a717
SHA1 3c8347f0fd520ee423a4aafea1112a0b06f4b6c8
SHA512 0f18c22e6eff8ec90ccc616e62f32701d046185311e01e5f506778fae0c31f35123c3ce756ff2c0eef6f23e06e280f870b80080d11dc6da3aa25901f5a92d995
SSDEEP 1536:WLXB65939tY6HBg4sXJd4Romu/FverCj/LnVL93MnlYU:WLk395hYXJd45QvTndaOU
MD5 SHA1 SHA512 SSDEEP

Submit Download

50d925e6334e8.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\50d925e6334e8.dll
Size 115KB
SHA256 73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125
MD5 6696822add17061dc0bb8ee5b42cc2d4
SHA1 d4622558ba366f2f94560da301a81c6c16f95a3c
SHA512 0f1946ce002441d010f67156f67b9d18e01ba35edfeb66ce8096467d3126b547e5040032253275b173f2dba9bce983775f360d83ec026986b55cb85e4b63f099
SSDEEP 1536:qqOF5F2jFD9a+ExxZcfV4LnUP/Cwiu4qu6RFap2sUXTYXchpiSdIMO15kC6/18k:3W5Fs5qj/DUP/CDxIWAg/z15kC6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

50d925e6334e8.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\50d925e6334e8.tlb
Size 2KB
SHA256 a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568
MD5 096a65b8a695249d5d554776f1eeace3
SHA1 2f2506b886a59b4408b23653d8734004ec2dda6d
SHA512 6e832caff1951b4fdb489997af5736fdbafa1de5573f629fc6798666bffd0ca0715311ce6590202cc970cce4492d94994a588547bb579bf70bc264683bc45cdc
MD5 SHA1 SHA512

Submit Download

bnmllalbefkkecnmmobgcpokfijiecij.crx

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\bnmllalbefkkecnmmobgcpokfijiecij.crx
Size 8KB
SHA256 5a22e99776d8111051c5ab7a921ae9159cef8a2a7688091ebb7fb4d9e585f817
MD5 6ef031c5bf7b8db26d2ae7fd13509e4a
SHA1 18e32f3e7601335f97912dd102f6768a27b58456
SHA512 f22166b1afeca227b244373d2e40862e22f07ecd2e1774bb2510fb2d271ce103e14a76ae1677a36b9296a9fdbdcdbd27a4cba8433deaf94e3e7e3e2873d9bfae
SSDEEP 96:CP+AMyh5LJxjTWgUzQfWN0wvpjeXY7/aU7HJJ0vOay7HMo9Hcbg2mBSXh9AVg8t:ZmNKgUzQf7qpIY7/aU7B9Hcbg2tolt
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS6A72.tmp\settings.ini
Size 6KB
SHA256 a1c79bc7d7fb4c79cbd638226792fc63b473f49f894ce8d75eb32e75dda4a435
MD5 751a00a4c9185a634b648d065a3aa9f1
SHA1 f59e5a285d5ba56c0c1ca84f2d95c3eb682ccee8
SHA512 5f0645e8c782a5d29a55b3e162b5da331d102eb92c90c8684532f42aabd36eae9d1a2e5cc3c65145e1311388545470d0bf083ba0c1a039d8fe8b89dea172656d
SSDEEP 192:+F33bCsfP/yKPsfPOKU/sfPQfZth/BEbhhGXQ9pU9z/6:+NbfnrEnHUUnQfpBcW9z/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk6CC5.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk6CC5.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2996-52-0x00000000745C0000-0x00000000745CA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads