zgrat | cdb8b8b1134a657a1fef24640d2e11005cf81c370380cff8634b2a7da776cea4

Analysis

max time kernel
69s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8953bbaa868dd7f66a3a7e73da80585.exe
Size 61KB
Sample240222-1c14wsff95
SHA256 cdb8b8b1134a657a1fef24640d2e11005cf81c370380cff8634b2a7da776cea4
MD5 a8953bbaa868dd7f66a3a7e73da80585
SHA1 775fb754dcc83e0ae397862d5d84060e40859d69
SHA512 24c8f584413170e96af5235ee867410c40e609ec288f12e6fa80632e7893d30a1a21878ac37f5e79775e20e58276c6d0f06e3127626c2b6edd3f15503a81d142
SSDEEP 768:rlK8yVL66zg/23bhSyk2gPN2e9cF7ojZ4RQrxY2nNKXCTs1gL8:rlKhJ69/dyk32eW6SQi2NKz1U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 9 IoCs

resource	yara_rule
behavioral1/files/0x00370000000144d4-9.dat	family_zgrat_v1
behavioral1/files/0x00370000000144d4-10.dat	family_zgrat_v1
behavioral1/files/0x00370000000144d4-13.dat	family_zgrat_v1
behavioral1/files/0x0008000000014aac-165.dat	family_zgrat_v1
behavioral1/files/0x0008000000014aac-166.dat	family_zgrat_v1
behavioral1/files/0x0008000000014aac-167.dat	family_zgrat_v1
behavioral1/memory/2284-169-0x0000000000160000-0x00000000004F8000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0004000000019368-249.dat	family_zgrat_v1
behavioral1/memory/1680-263-0x0000000000E50000-0x00000000011E8000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2496	schtasks.exe	43
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2496	schtasks.exe	43

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2616	WindowsMD5Checker.exe
2452	SandelloChecker.exe
2284	agentreviewIntoRefdhcp.exe
1680	audiodg.exe

Loads dropped DLL 8 IoCs

pid	Process
2144	a8953bbaa868dd7f66a3a7e73da80585.exe
2144	a8953bbaa868dd7f66a3a7e73da80585.exe
2748	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
2748	MsiExec.exe
1528	cmd.exe
1528	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Telegramm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsMD5Checker.exe"	a8953bbaa868dd7f66a3a7e73da80585.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	SandelloChecker.exe
File opened (read-only)	\??\I:	SandelloChecker.exe
File opened (read-only)	\??\R:	SandelloChecker.exe
File opened (read-only)	\??\V:	SandelloChecker.exe
File opened (read-only)	\??\X:	SandelloChecker.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	SandelloChecker.exe
File opened (read-only)	\??\J:	SandelloChecker.exe
File opened (read-only)	\??\L:	SandelloChecker.exe
File opened (read-only)	\??\T:	SandelloChecker.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	SandelloChecker.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	SandelloChecker.exe
File opened (read-only)	\??\G:	SandelloChecker.exe
File opened (read-only)	\??\K:	SandelloChecker.exe
File opened (read-only)	\??\Z:	SandelloChecker.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	SandelloChecker.exe
File opened (read-only)	\??\W:	SandelloChecker.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	SandelloChecker.exe
File opened (read-only)	\??\U:	SandelloChecker.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	SandelloChecker.exe
File opened (read-only)	\??\S:	SandelloChecker.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	SandelloChecker.exe
File opened (read-only)	\??\O:	SandelloChecker.exe
File opened (read-only)	\??\P:	SandelloChecker.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\conhost.exe	agentreviewIntoRefdhcp.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\088424020bedd6	agentreviewIntoRefdhcp.exe
File created	C:\Program Files\Windows Mail\it-IT\conhost.exe	agentreviewIntoRefdhcp.exe
File created	C:\Program Files\Windows Mail\it-IT\088424020bedd6	agentreviewIntoRefdhcp.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\WMIADAP.exe	agentreviewIntoRefdhcp.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\75a57c1bdf437c	agentreviewIntoRefdhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\es-ES\cmd.exe	agentreviewIntoRefdhcp.exe
File created	C:\Windows\es-ES\ebf1f9fa8afd6d	agentreviewIntoRefdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1780	schtasks.exe
924	schtasks.exe
2620	schtasks.exe
1320	schtasks.exe
2844	schtasks.exe
2020	schtasks.exe
2828	schtasks.exe
1104	schtasks.exe
2720	schtasks.exe
2768	schtasks.exe
804	schtasks.exe
2584	schtasks.exe
2436	schtasks.exe
2968	schtasks.exe
2624	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	SandelloChecker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	SandelloChecker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	SandelloChecker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	SandelloChecker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe
2284	agentreviewIntoRefdhcp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe
Token: SeShutdownPrivilege	2144	a8953bbaa868dd7f66a3a7e73da80585.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	SandelloChecker.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2488	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	31
PID 2144 wrote to memory of 2488	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	31
PID 2144 wrote to memory of 2488	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	31
PID 2144 wrote to memory of 2488	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	31
PID 2144 wrote to memory of 2776	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	32
PID 2144 wrote to memory of 2776	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	32
PID 2144 wrote to memory of 2776	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	32
PID 2144 wrote to memory of 2776	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	32
PID 2144 wrote to memory of 2616	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	33
PID 2144 wrote to memory of 2616	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	33
PID 2144 wrote to memory of 2616	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	33
PID 2144 wrote to memory of 2616	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	33
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2144 wrote to memory of 2452	2144	a8953bbaa868dd7f66a3a7e73da80585.exe	34
PID 2616 wrote to memory of 2212	2616	WindowsMD5Checker.exe	35
PID 2616 wrote to memory of 2212	2616	WindowsMD5Checker.exe	35
PID 2616 wrote to memory of 2212	2616	WindowsMD5Checker.exe	35
PID 2616 wrote to memory of 2212	2616	WindowsMD5Checker.exe	35
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 664 wrote to memory of 2748	664	msiexec.exe	37
PID 2212 wrote to memory of 1528	2212	WScript.exe	38
PID 2212 wrote to memory of 1528	2212	WScript.exe	38
PID 2212 wrote to memory of 1528	2212	WScript.exe	38
PID 2212 wrote to memory of 1528	2212	WScript.exe	38
PID 1528 wrote to memory of 2284	1528	cmd.exe	40
PID 1528 wrote to memory of 2284	1528	cmd.exe	40
PID 1528 wrote to memory of 2284	1528	cmd.exe	40
PID 1528 wrote to memory of 2284	1528	cmd.exe	40
PID 2284 wrote to memory of 2948	2284	agentreviewIntoRefdhcp.exe	59
PID 2284 wrote to memory of 2948	2284	agentreviewIntoRefdhcp.exe	59
PID 2284 wrote to memory of 2948	2284	agentreviewIntoRefdhcp.exe	59
PID 2948 wrote to memory of 1628	2948	cmd.exe	61
PID 2948 wrote to memory of 1628	2948	cmd.exe	61
PID 2948 wrote to memory of 1628	2948	cmd.exe	61
PID 2948 wrote to memory of 1180	2948	cmd.exe	62
PID 2948 wrote to memory of 1180	2948	cmd.exe	62
PID 2948 wrote to memory of 1180	2948	cmd.exe	62
PID 2948 wrote to memory of 1680	2948	cmd.exe	63
PID 2948 wrote to memory of 1680	2948	cmd.exe	63
PID 2948 wrote to memory of 1680	2948	cmd.exe	63

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a8953bbaa868dd7f66a3a7e73da80585.exe
"C:\Users\Admin\AppData\Local\Temp\a8953bbaa868dd7f66a3a7e73da80585.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MpCmdRun.exe -AddExclusion -FileName C:\Users\Admin\AppData\Local\Temp\\WindowsMD5Checker.exe
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MpCmdRun.exe -AddExclusion -FileName C:\Users\Admin\AppData\Local\Temp\\SandelloChecker.exe
  2⤵
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\MsWebSession\aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\MsWebSession\28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\MsWebSession\agentreviewIntoRefdhcp.exe
        
        "C:\MsWebSession/agentreviewIntoRefdhcp.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2284
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hO65TX3R2N.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1628
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1180
        
        C:\Recovery\53c2ef02-d124-11ee-be41-9f00cc481deb\audiodg.exe
        
        "C:\Recovery\53c2ef02-d124-11ee-be41-9f00cc481deb\audiodg.exe"
        7⤵
        Executes dropped EXE
        
        PID:1680
- C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
  "C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  PID:2452

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD8E34337114C1276305A4865C9F4220 C
  2⤵
  - Loads dropped DLL
  PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Recovery\53c2ef02-d124-11ee-be41-9f00cc481deb\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\53c2ef02-d124-11ee-be41-9f00cc481deb\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Recovery\53c2ef02-d124-11ee-be41-9f00cc481deb\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\it-IT\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\it-IT\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\it-IT\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\es-ES\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\es-ES\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat

Path C:\MsWebSession\28GBsRQl2u5EqD0HGx7YGeYZyO2za9W9ftVvHiRGielbEoVm.bat
Size 95B
SHA256 102e9e1f76065e7c6207880bdcdba7cad4aebb61e2644ac80f76ed1a2ca92b1b
MD5 d7fa26c8b1aa0d91d5c3682c87970269
SHA1 9934cb04ec5d81e86519c36c38d9e7caf5c01a1d
SHA512 71d72daaab45e8198d375a6fdf78bb7b3173c757cb2b6e349bbe516a67461b8ddb183ab028579f80c44392bba46a00b82f66bc5f01da4297af2a222be7ac5117
MD5 SHA1 SHA512

Submit Download

aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe

Path C:\MsWebSession\aISwmBA1tz2Li9c6LCYbI0c56v7tmGzpAA7ZdNSGvv0YyEqFbmxvfE9xX.vbe
Size 250B
SHA256 fee3cc05c5cd12982240bd1e83cf2362871ab9b656fd807928387ddb67e831f7
MD5 472b891861c2851f23fc56f0da9834f0
SHA1 1938881b09e054a23c46369d850f92c52a9b1164
SHA512 77850c8c9d95733ff9128a9e19f87be4b64ee450ed4aa27be4dcaceded74c0ec8c05d57d8c78249c30ad8cdfcd96a9eeae51e587adef1ad38cd24a0125cbb129
MD5 SHA1 SHA512

Submit Download

agentreviewIntoRefdhcp.exe

Path C:\MsWebSession\agentreviewIntoRefdhcp.exe
Size 1.8MB
SHA256 08daa72b2037bc39aa4a753c18d1552fb892322cf747042a8823de26e8a4d0c0
MD5 51895248f6a0d005a7824717a437f3c7
SHA1 b3a0be9028a3c17f690ec7381f75245104e7e408
SHA512 119c7193caef1361dc2f68cbfc50e977fb0881eb81d000ce771cdf7c9d82ef23d24d5b068dd5973c7d5fe941d28a6282adcf63edb549b83b6f7ceff50410ffab
SSDEEP 24576:x4NHJB4lTzYu9HNxZX6GoTBABGDCYrfztMrrp2ZOm9ao9XNgfwzN94qQ2GdLwcq/:CW1X6BWkOYXz19tXN1zNOqeRvycGRkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Program Files\Windows Mail\it-IT\conhost.exe
Size 3.6MB
SHA256 3ed028c17d0038c69998ad942feb78aff2f9f363bae2203250b0eba6ce0d26be
MD5 1e8b556d7c4cefe0023e5ba9b6d021e5
SHA1 1f2dd53b352fd7b5972b38d1a5eeb2aec378b9e5
SHA512 788395a9013db192ff4054fc766aef4f55335c5816d0b5fa57d3019f7254aea32e194790930bc8255e05e80e9e9d5e2a77d0dfb45aac142c6f65edb9ae6061c0
SSDEEP 98304:CYX6sYD1rXzznYLGRk3/ZuPqInTeNlZD6jdKkb8:Ckdq1rIH3/OnaJu
MD5 SHA1 SHA512 SSDEEP

Submit Download

aboutbtn

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2452\aboutbtn
Size 1KB
SHA256 9d7243c688264329a8cb9e22da00b651e0a9407741d722e03dd67cc8b3ee1335
MD5 b51b54b77e9cbfdb1063f7487c1c07ec
SHA1 8a8a7036cfbc86a537447bf71b9f6795923db8b9
SHA512 04cef1aa3a530e7f03054369450eb42f36bf45c13c7445adf450ec4635a8601447c5bb6e978b3adabe9021019644681bf1609539eb548dd50ada973aac0c6555
MD5 SHA1 SHA512

Submit Download

background

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2452\background
Size 2KB
SHA256 b671008e5d4a15409051d7b3d2aa40f7c028e1dab5876c2882976793abb9356c
MD5 9e23da7c3cd3fb8113e698a12a3d3047
SHA1 6d021109495d77a53afe101f2b03a4da847e6d99
SHA512 65e885984681cee190764515f61bb8da3c29463b87f4371fff27ae4c4089af46c9b98910a847ec29d7368160d6aaf841fb93f1347c9abc47bce5cf997c8b4ef2
MD5 SHA1 SHA512

Submit Download

buttonimgs

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2452\buttonimgs
Size 1KB
SHA256 f8f4efdb34b00775638c95568761c93436812af56c8f41116f2f92a987ca9ae0
MD5 6956ac5e9d5e47daeb7d147d67d9e526
SHA1 427449cf08f0c78f1bf3850565201991828e278c
SHA512 a82f9d199e36dfcdad7393761d1cf541d67b0b70d4b31cf71ad38dab3e95b351143c1aff4adea3207d1fd1e9c3523e9b7e3cea37cb61f9f2845894c60327651c
MD5 SHA1 SHA512

Submit Download

checkernewicon.png

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2452\checkernewicon.png
Size 3KB
SHA256 76adccd20b35ba40b9be5ac4194941625826084f32a9c7c07090708946fc39c5
MD5 b1618ec6d5e7c1e293cb36ab87371615
SHA1 a9c47241b1378bca3b541abb07aeb4b1feb0ccf4
SHA512 a45e20225fe4d5989f6f8891274a8ed07f27c2b33545458f36bbb3356124fbf83c6d1523155b4830e6bb78a96e4fd282a7f43ec3d3ce77fe488f8640ff49da2a
MD5 SHA1 SHA512

Submit Download

Cab9E06.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab9E06.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIA214.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA214.tmp
Size 587KB
SHA256 42b8adafcb4e8496d9822a0c504f449e56456528a9251c153381d3f63d197e5b
MD5 9e0aef52f6c03b2fea067342d9d4f22f
SHA1 d4431a858c8a7a79315829ec7aa82e838c2714f4
SHA512 42858a6695d7906b3df4dc97f3b1fac737633a51ffb52e8ec8eddeb21f8cdb53c199bb698e54c4a931155eafd879de6fff114b84f298c84436b776e286ebeeb1
SSDEEP 12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIA61C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA61C.tmp
Size 1.1MB
SHA256 3c21e1f3bb3ebeb5f0ff68658db8abd18b62f8b195288c4bf87936fc51f8ae9e
MD5 c04ed00ddcb3518e8cf6db24db294a50
SHA1 cc98cc3ab9c4371f85ea227d9f761bab4aa76baa
SHA512 736946a3130f294878ea51145960017babcc1b8ac2c96afd8b9e2a4d120f173afb84bbd04b6f0113f286d4bc671befecd4e92c582f1de1a0d5bc8738c3cae9c5
SSDEEP 24576:96KyJqotyEbjgE3pr9CxKoibHCMm7HH4d5+u+Tx5KzEKrbsUT1wZS:d+qotJCxKoibHCNbH4d5+u+Tx5KzEKrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 5.0MB
SHA256 c630495220149dea3714baa6fc2d1b2a77dadd62a4456795ccceea23bf06b643
MD5 d6b289c564de8f8b4146dfa487222228
SHA1 0597198c7030eef3ad4da2851321ca2af55e8839
SHA512 c37173d13306228f8828e49482082e52fe968d820aeb33a31f9b859358392e2dabdff58a3f22f50be90f749bfd873ef483a0ac7929a238cc686a5f3a2f66d145
SSDEEP 98304:nrvLO010gIuekBbIAAvoTe4tN46aFu7/YwLbWxtfxjh:bLO0Ejuu6RDDXsfxjh
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 4.8MB
SHA256 834a29dbdb0467470a76685e94f40522cb6165f41618f4f50aaf801f242c6eed
MD5 6955c2ab3d3a090525fd00a05bb0eb76
SHA1 b7e4ac3d839cc9981ef4deda0c6772e5c85f389b
SHA512 bf7d43cf23c0684b4fea22ced31ac5e538bc1be4919da097ccac2090176f98053793f21153e1b59575e2bc3058b542faa84dd460dbcc2ee28d1df98029f6a0b7
SSDEEP 98304:nrvLO010gIuekBbIAAvoTe4tN46aFu7/YwLbWxtfxjD:bLO0Ejuu6RDDXsfxjD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 13.5MB
SHA256 dac551ee5f8158a8803dc0b1f1591b4460ea07eaf908e76badec9b772cbc21c2
MD5 51a442610bb9dcfc6294ddd50a137cd4
SHA1 11fb67d5745b77ef448c4fb8937493d26c533ab9
SHA512 4d5a95b9ca933189c3ff875cadfa2d28e5b7e3ab33fb2ac0300da0e7a5b43093ee80e9f9dfb57a46288cf764fe1922a7126f752c3021833e1f10c7833a0a1a2e
SSDEEP 393216:W0EjEDXajAA7ZNU5DanvweSC1abTNp83uQz94:9Ewuj9785GITC1ancucS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar9E18.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar9E18.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsMD5Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
Size 3.9MB
SHA256 3b9330b09929cc5391a31e5780a967d26f21b010b586b2226e3d22038226f800
MD5 c93eb1803d22b1ea86a0e5b4c61ab5fc
SHA1 e1be31f724ba662e5067767f6144a3ce64167897
SHA512 f2509c0e58064a517708e2cadee34805cf3d25043af41f70a34af69b6acfd74b09f1c0c2dc851128f2777e2e49bd9766c719c0f1f8bcf52d325bff54dcce08e1
SSDEEP 98304:yOYX6sYD1rXzznYLGRk3/ZuPqInTeNlZD6jdKkb8p:Fkdq1rIH3/OnaJuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsMD5Checker.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
Size 512KB
SHA256 a9f715cd25b09f30e5e8ed6e02d9cd9389e13b1bf276c7b49c3ef61e9cea394d
MD5 49741248513347ec7b62643a4490ecef
SHA1 832c2be76d30feaa2e9cb1b7fb519ee2ded9a25d
SHA512 743276ded2fdeedfa751dbeb893709a40a27e2e036e5bba9691d6e1a401f3935dcf43d746998e2df714557c3a3a5c3709c31c35e9acfa1a2d35a0896a27a66cb
SSDEEP 6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/ulDyDsu6ji:2ToPWBv/cpGrU3yVtX+t4Vou4PW
MD5 SHA1 SHA512 SSDEEP

Submit Download

hO65TX3R2N.bat

Path C:\Users\Admin\AppData\Local\Temp\hO65TX3R2N.bat
Size 236B
SHA256 ec98754b2e399e23b00a714492abd95d15dd363cfbdb85a753e3c221267601a5
MD5 9a77fc78c1f6c97b09f5ea8a7707d840
SHA1 220fae86207a9671443b292551e7128512e26a63
SHA512 6065725f4f3fe2c62e9ec0f09f3ef3cd1d96339520b7fe870afd8e06b51fa9ad9b630fa63da71c2eb933d60d1e7bb8812a314bbb7d6b3d4bbf4b8c863d761fef
MD5 SHA1 SHA512

Submit Download

SandeLLoCHECKER_Installer.msi

Path C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\install\51B5780\SandeLLoCHECKER_Installer.msi
Size 4.7MB
SHA256 2fc0bc7675b71742b759f44f00e23662f28ad3d04cc5e2956428e57cb61d55b7
MD5 69d9a69f84bc67feed975148b9e2ec7c
SHA1 b4cd30ae6c20a0a5297589a4739d9b5a3fc5154f
SHA512 63b5c471d372611b3936f9f2dba302b95490719f228b7362c99957162f92fb4fb31d82dc5c6a55cf1f793dca9f321d601439c7f61aa94c11cc25302e365a428f
SSDEEP 98304:KzC3VQlLtFHCNbHXpf1YcCaSqV7EgvdOOzre:KznlJF+XDYceU
MD5 SHA1 SHA512 SSDEEP

Submit Download

agentreviewIntoRefdhcp.exe

Path \MsWebSession\agentreviewIntoRefdhcp.exe
Size 1024KB
SHA256 34d1c0bc4e159421d45f3b09cfb20d6745a203e0a2ccb5e82be8caa5d833e8e7
MD5 5412c370c11788de3c87989f4f48cc89
SHA1 64bcbcf444ebd77cb6310c2e1016ac7214bd8b6a
SHA512 2525c6c66b5564cbd577065d5a1e4c2443a3d552ff87e94c21f910a2b784424692a8445048df24bb9f179b840d0644720c86d7bd418304a6c7d166dcfc3680a7
SSDEEP 24576:x4NHJB4lTzYu9HNxZX6GoTBABGDCYrfzi:CW1X6BWkOYXi
MD5 SHA1 SHA512 SSDEEP

Submit Download

agentreviewIntoRefdhcp.exe

Path \MsWebSession\agentreviewIntoRefdhcp.exe
Size 1.2MB
SHA256 9ef5daa8ee8c98bf35c6f6acd7f27b4594756f8a3e40e80210c2bf582cb4da63
MD5 2699dba05663e5dcff8e6f0db9650fc2
SHA1 6fa25c27fc7afed9a3cf50cb1672a7e2a7f20f05
SHA512 9f96b4473eec712ef874d8b15d17bc74d874d8c73eff80cf89052ed8e41167f9a35e9a281e918a106f780861e49ac95033c92a395979c922ea504219d0b23ee4
SSDEEP 24576:x4NHJB4lTzYu9HNxZX6GoTBABGDCYrfztMrrp2ZOm9ao9XJ:CW1X6BWkOYXz19tXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIAA32.tmp

Path \Users\Admin\AppData\Local\Temp\MSIAA32.tmp
Size 709KB
SHA256 ad706739b04256b9215e80d2d030863a37f0d7fd0e4071d0a3a73d6704d8bd8f
MD5 eb7811666ac7be6477e23af68511424f
SHA1 1623579c5a3710dcc694a2fd49defa27d56d9175
SHA512 3055baa15c92f476513c66a423043dc4b8c5f83f47643ad77665d6a2f823f4655bf4ae241d8af4bc34d53630df1c35989f0b11b934a631960668fcc7a8c81a7b
SSDEEP 12288:jn6hflHZVr6xVYUiONE4i1uDiSNrETsc4UYK/DAt5c1+vn2eFzLT:mUTxipSxETsNV35c8vn2mzLT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SandelloChecker.exe

Path \Users\Admin\AppData\Local\Temp\SandelloChecker.exe
Size 7.6MB
SHA256 882cee3547e9b76f417d46efdd183be7ceecf25e64a8fb0967e7690beb3e21f4
MD5 540ea791dde4ae99be9b079db2782aaf
SHA1 4bb474c8c1b5e8c9612c3471b518ee0dc13c800f
SHA512 5f1a1f0bd39b72b9e49bbe94f3b539a27a8938f6511239165d829c29784371e81b9f1d83aa3412d04e671873b2f44622ea009264c2ffe0c2b89b3ca60ad0506e
SSDEEP 196608:bLO0Ejuu6RDDXsfxjAA7ZeCRy5D1YngKr:W0EjEDXajAA7ZNU5Danvr
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsMD5Checker.exe

Path \Users\Admin\AppData\Local\Temp\WindowsMD5Checker.exe
Size 607KB
SHA256 6e50d404e6b5beb355482538bd590a34d5a95bed2ef1adac3ae5c8047cd73c40
MD5 42c5096ec2de19b7e4ad67077ca7480a
SHA1 2e3b7d7c4f7299cab2e214a631e5b795b7d2bb29
SHA512 6f1c301a648601de8f763146f69a0ddc2a9b2d6c4a4742d82ebb777e38631ca6f5abe0ee6d7059b49bb78caae1201c6d4beb3d7d14718638f09394ef7b9e19b8
SSDEEP 6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/ulDyDsu6jt7/bEuu9L4t7L:2ToPWBv/cpGrU3yVtX+t4Vou4PVHJL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-275-0x0000000076AB0000-0x0000000076AB1000-memory.dmp

Download

memory/1680-269-0x0000000076AC0000-0x0000000076AC1000-memory.dmp

Download

memory/1680-267-0x000000001B4C0000-0x000000001B540000-memory.dmp

Download

memory/1680-266-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1680-265-0x000000001B4C0000-0x000000001B540000-memory.dmp

Download

memory/1680-264-0x000007FEF3920000-0x000007FEF430C000-memory.dmp

Download

memory/1680-263-0x0000000000E50000-0x00000000011E8000-memory.dmp

Download

memory/1680-270-0x000000001B4C0000-0x000000001B540000-memory.dmp

Download

memory/2144-0-0x0000000000020000-0x000000000002F000-memory.dmp

Download

memory/2284-195-0x000000001B390000-0x000000001B410000-memory.dmp

Download

memory/2284-218-0x000000001AE30000-0x000000001AE42000-memory.dmp

Download

memory/2284-182-0x0000000076AA0000-0x0000000076AA1000-memory.dmp

Download

memory/2284-184-0x00000000006F0000-0x000000000070C000-memory.dmp

Download

memory/2284-187-0x0000000000530000-0x0000000000540000-memory.dmp

Download

memory/2284-185-0x0000000076A90000-0x0000000076A91000-memory.dmp

Download

memory/2284-188-0x0000000076A80000-0x0000000076A81000-memory.dmp

Download

memory/2284-190-0x00000000009D0000-0x00000000009E8000-memory.dmp

Download

memory/2284-192-0x0000000000540000-0x0000000000550000-memory.dmp

Download

memory/2284-193-0x000007FEF4310000-0x000007FEF4CFC000-memory.dmp

Download

memory/2284-194-0x0000000076A70000-0x0000000076A71000-memory.dmp

Download

memory/2284-179-0x0000000076AB0000-0x0000000076AB1000-memory.dmp

Download

memory/2284-198-0x0000000000550000-0x0000000000560000-memory.dmp

Download

memory/2284-197-0x0000000076A60000-0x0000000076A61000-memory.dmp

Download

memory/2284-199-0x0000000076A50000-0x0000000076A51000-memory.dmp

Download

memory/2284-201-0x0000000000660000-0x000000000066E000-memory.dmp

Download

memory/2284-204-0x00000000023D0000-0x00000000023E2000-memory.dmp

Download

memory/2284-202-0x0000000076A40000-0x0000000076A41000-memory.dmp

Download

memory/2284-205-0x000000001B390000-0x000000001B410000-memory.dmp

Download

memory/2284-206-0x0000000076A30000-0x0000000076A31000-memory.dmp

Download

memory/2284-208-0x00000000009F0000-0x00000000009FC000-memory.dmp

Download

memory/2284-209-0x000000001B390000-0x000000001B410000-memory.dmp

Download

memory/2284-212-0x0000000076A20000-0x0000000076A21000-memory.dmp

Download

memory/2284-211-0x0000000000A00000-0x0000000000A10000-memory.dmp

Download

memory/2284-215-0x000000001AD00000-0x000000001AD16000-memory.dmp

Download

memory/2284-213-0x0000000076A10000-0x0000000076A11000-memory.dmp

Download

memory/2284-216-0x0000000076A00000-0x0000000076A01000-memory.dmp

Download

memory/2284-181-0x0000000000520000-0x000000000052E000-memory.dmp

Download

memory/2284-219-0x00000000769F0000-0x00000000769F1000-memory.dmp

Download

memory/2284-221-0x0000000000A10000-0x0000000000A1E000-memory.dmp

Download

memory/2284-222-0x00000000769E0000-0x00000000769E1000-memory.dmp

Download

memory/2284-224-0x00000000022C0000-0x00000000022D0000-memory.dmp

Download

memory/2284-225-0x00000000769D0000-0x00000000769D1000-memory.dmp

Download

memory/2284-227-0x000000001A900000-0x000000001A910000-memory.dmp

Download

memory/2284-228-0x00000000769C0000-0x00000000769C1000-memory.dmp

Download

memory/2284-230-0x000000001B2D0000-0x000000001B32A000-memory.dmp

Download

memory/2284-231-0x00000000769B0000-0x00000000769B1000-memory.dmp

Download

memory/2284-233-0x000000001ACE0000-0x000000001ACEE000-memory.dmp

Download

memory/2284-235-0x000000001ACF0000-0x000000001AD00000-memory.dmp

Download

memory/2284-237-0x000000001AD20000-0x000000001AD2E000-memory.dmp

Download

memory/2284-239-0x000000001AE70000-0x000000001AE88000-memory.dmp

Download

memory/2284-241-0x000000001AE50000-0x000000001AE5C000-memory.dmp

Download

memory/2284-242-0x0000000076960000-0x0000000076961000-memory.dmp

Download

memory/2284-244-0x000000001B330000-0x000000001B37E000-memory.dmp

Download

memory/2284-178-0x0000000000990000-0x00000000009B6000-memory.dmp

Download

memory/2284-259-0x000007FEF4310000-0x000007FEF4CFC000-memory.dmp

Download

memory/2284-176-0x000000001B390000-0x000000001B410000-memory.dmp

Download

memory/2284-175-0x0000000076AC0000-0x0000000076AC1000-memory.dmp

Download

memory/2284-169-0x0000000000160000-0x00000000004F8000-memory.dmp

Download

memory/2284-174-0x000000001B390000-0x000000001B410000-memory.dmp

Download

memory/2284-172-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/2284-171-0x000000001B390000-0x000000001B410000-memory.dmp

Download

memory/2284-170-0x000007FEF4310000-0x000007FEF4CFC000-memory.dmp

Download

memory/2452-173-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/2452-21-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download