dcrat | 9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c

Analysis

max time kernel
107s
max time network
303s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
26/02/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
Size 252KB
Sample240226-cd33waaf91
SHA256 9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c
MD5 56d4fff8a9409a1892dec625d2a0307a
SHA1 e844eb91497642ae8347d3e759386f4aa15075b6
SHA512 bf1e42f7f519953d88347aa04f29f24a42a33cba16bcd5c08790e34819cbd3d3976376e98fa2493156f82813a4b387b6339cc9e8d1c0004f733a238f073d95c9
SSDEEP 3072:a1Dn5YORgjwstWB0aZsPWwC+gc91tu4gbS58Px2VFplTKFa:wjfgjwPBBZs+1+rJkPIVFbT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat glupteba lumma smokeloader pub1 backdoor bootkit discovery dropper evasion infostealer loader persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://kamsmad.com/tmp/index.php
http://souzhensil.ru/tmp/index.php
http://teplokub.com.ua/tmp/index.php

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

lumma

https://resergvearyinitiani.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 7 IoCs

resource	yara_rule
behavioral2/memory/4904-95-0x0000000002E60000-0x000000000374B000-memory.dmp	family_glupteba
behavioral2/memory/4904-96-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4904-146-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4904-152-0x0000000002E60000-0x000000000374B000-memory.dmp	family_glupteba
behavioral2/memory/4904-161-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4904-169-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4904-174-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Pitou 2 IoCs

Pitou.

resource	yara_rule
behavioral2/memory/4408-137-0x0000000000400000-0x0000000002D8C000-memory.dmp	pitou
behavioral2/memory/4408-150-0x0000000000400000-0x0000000002D8C000-memory.dmp	pitou

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3416	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3496	Process not Found

Executes dropped EXE 15 IoCs

pid	Process
4748	CCE5.exe
520	D757.exe
1732	D757.tmp
2648	CA0.exe
4904	288c47bbc1871b439df19ff4df68f076.exe
2764	InstallSetup4.exe
3712	FourthX.exe
2044	BroomSetup.exe
1624	1DF7.exe
3420	25F7.exe
2136	25F7.exe
4408	2B28.exe
2220	nsx970D.tmp
2920	ubgcihs
4120	vueqjgslwynd.exe

Loads dropped DLL 7 IoCs

pid	Process
3228	regsvr32.exe
1732	D757.tmp
2764	InstallSetup4.exe
2136	25F7.exe
2764	InstallSetup4.exe
2220	nsx970D.tmp
2220	nsx970D.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2136-116-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2136-119-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2136-121-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2136-123-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2136-124-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2136-125-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
69	pastebin.com
70	pastebin.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	2B28.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	FourthX.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3420 set thread context of 2136	3420	25F7.exe	91

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4184	sc.exe
2564	sc.exe
3656	sc.exe
2656	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1DF7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ubgcihs
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1DF7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1DF7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ubgcihs
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ubgcihs

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsx970D.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsx970D.tmp

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1844	schtasks.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
928	9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
928	9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found
3496	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
928	9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
1624	1DF7.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeIncreaseQuotaPrivilege	4164	powershell.exe
Token: SeSecurityPrivilege	4164	powershell.exe
Token: SeTakeOwnershipPrivilege	4164	powershell.exe
Token: SeLoadDriverPrivilege	4164	powershell.exe
Token: SeSystemProfilePrivilege	4164	powershell.exe
Token: SeSystemtimePrivilege	4164	powershell.exe
Token: SeProfSingleProcessPrivilege	4164	powershell.exe
Token: SeIncBasePriorityPrivilege	4164	powershell.exe
Token: SeCreatePagefilePrivilege	4164	powershell.exe
Token: SeBackupPrivilege	4164	powershell.exe
Token: SeRestorePrivilege	4164	powershell.exe
Token: SeShutdownPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeSystemEnvironmentPrivilege	4164	powershell.exe
Token: SeRemoteShutdownPrivilege	4164	powershell.exe
Token: SeUndockPrivilege	4164	powershell.exe
Token: SeManageVolumePrivilege	4164	powershell.exe
Token: 33	4164	powershell.exe
Token: 34	4164	powershell.exe
Token: 35	4164	powershell.exe
Token: 36	4164	powershell.exe
Token: SeShutdownPrivilege	3496	Process not Found
Token: SeCreatePagefilePrivilege	3496	Process not Found
Token: SeDebugPrivilege	2432	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	D757.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2044	BroomSetup.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4748	3496	Process not Found	75
PID 3496 wrote to memory of 4748	3496	Process not Found	75
PID 3496 wrote to memory of 4748	3496	Process not Found	75
PID 3496 wrote to memory of 2688	3496	Process not Found	76
PID 3496 wrote to memory of 2688	3496	Process not Found	76
PID 2688 wrote to memory of 3228	2688	regsvr32.exe	77
PID 2688 wrote to memory of 3228	2688	regsvr32.exe	77
PID 2688 wrote to memory of 3228	2688	regsvr32.exe	77
PID 3496 wrote to memory of 520	3496	Process not Found	78
PID 3496 wrote to memory of 520	3496	Process not Found	78
PID 3496 wrote to memory of 520	3496	Process not Found	78
PID 520 wrote to memory of 1732	520	D757.exe	79
PID 520 wrote to memory of 1732	520	D757.exe	79
PID 520 wrote to memory of 1732	520	D757.exe	79
PID 3496 wrote to memory of 2648	3496	Process not Found	80
PID 3496 wrote to memory of 2648	3496	Process not Found	80
PID 3496 wrote to memory of 2648	3496	Process not Found	80
PID 2648 wrote to memory of 4904	2648	CA0.exe	81
PID 2648 wrote to memory of 4904	2648	CA0.exe	81
PID 2648 wrote to memory of 4904	2648	CA0.exe	81
PID 2648 wrote to memory of 2764	2648	CA0.exe	82
PID 2648 wrote to memory of 2764	2648	CA0.exe	82
PID 2648 wrote to memory of 2764	2648	CA0.exe	82
PID 2764 wrote to memory of 2044	2764	InstallSetup4.exe	83
PID 2764 wrote to memory of 2044	2764	InstallSetup4.exe	83
PID 2764 wrote to memory of 2044	2764	InstallSetup4.exe	83
PID 2648 wrote to memory of 3712	2648	CA0.exe	84
PID 2648 wrote to memory of 3712	2648	CA0.exe	84
PID 2044 wrote to memory of 3620	2044	BroomSetup.exe	85
PID 2044 wrote to memory of 3620	2044	BroomSetup.exe	85
PID 2044 wrote to memory of 3620	2044	BroomSetup.exe	85
PID 3496 wrote to memory of 1624	3496	Process not Found	87
PID 3496 wrote to memory of 1624	3496	Process not Found	87
PID 3496 wrote to memory of 1624	3496	Process not Found	87
PID 3620 wrote to memory of 3220	3620	cmd.exe	88
PID 3620 wrote to memory of 3220	3620	cmd.exe	88
PID 3620 wrote to memory of 3220	3620	cmd.exe	88
PID 3496 wrote to memory of 3420	3496	Process not Found	90
PID 3496 wrote to memory of 3420	3496	Process not Found	90
PID 3496 wrote to memory of 3420	3496	Process not Found	90
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3420 wrote to memory of 2136	3420	25F7.exe	91
PID 3496 wrote to memory of 4408	3496	Process not Found	92
PID 3496 wrote to memory of 4408	3496	Process not Found	92
PID 3496 wrote to memory of 4408	3496	Process not Found	92
PID 3620 wrote to memory of 1844	3620	cmd.exe	93
PID 3620 wrote to memory of 1844	3620	cmd.exe	93
PID 3620 wrote to memory of 1844	3620	cmd.exe	93
PID 4904 wrote to memory of 1396	4904	288c47bbc1871b439df19ff4df68f076.exe	94
PID 4904 wrote to memory of 1396	4904	288c47bbc1871b439df19ff4df68f076.exe	94
PID 4904 wrote to memory of 1396	4904	288c47bbc1871b439df19ff4df68f076.exe	94
PID 2764 wrote to memory of 2220	2764	InstallSetup4.exe	98
PID 2764 wrote to memory of 2220	2764	InstallSetup4.exe	98
PID 2764 wrote to memory of 2220	2764	InstallSetup4.exe	98
PID 4800 wrote to memory of 1308	4800	cmd.exe	111
PID 4800 wrote to memory of 1308	4800	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe
"C:\Users\Admin\AppData\Local\Temp\9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:928

C:\Users\Admin\AppData\Local\Temp\CCE5.exe
C:\Users\Admin\AppData\Local\Temp\CCE5.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D226.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\D226.dll
  2⤵
  - Loads dropped DLL
  PID:3228

C:\Users\Admin\AppData\Local\Temp\D757.exe
C:\Users\Admin\AppData\Local\Temp\D757.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\is-N6LRR.tmp\D757.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N6LRR.tmp\D757.tmp" /SL5="$800CC,2376314,54272,C:\Users\Admin\AppData\Local\Temp\D757.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:1732

C:\Users\Admin\AppData\Local\Temp\CA0.exe
C:\Users\Admin\AppData\Local\Temp\CA0.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    PID:3052
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2132
  - - C:\Windows\System32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:428
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3416
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:688
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4528
- C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:3220
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:1844
- - C:\Users\Admin\AppData\Local\Temp\nsx970D.tmp
    C:\Users\Admin\AppData\Local\Temp\nsx970D.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:2220
- C:\Users\Admin\AppData\Local\Temp\FourthX.exe
  "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3712
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1308
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "UTIXDCVF" binpath= "C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2656
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "UTIXDCVF"
    3⤵
    - Launches sc.exe
    PID:4184
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2564

C:\Users\Admin\AppData\Local\Temp\1DF7.exe
C:\Users\Admin\AppData\Local\Temp\1DF7.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1624

C:\Users\Admin\AppData\Local\Temp\25F7.exe
C:\Users\Admin\AppData\Local\Temp\25F7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\25F7.exe
  C:\Users\Admin\AppData\Local\Temp\25F7.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2136

C:\Users\Admin\AppData\Local\Temp\2B28.exe
C:\Users\Admin\AppData\Local\Temp\2B28.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4408

C:\Users\Admin\AppData\Roaming\ubgcihs
C:\Users\Admin\AppData\Roaming\ubgcihs
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2920

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
1⤵
- Executes dropped EXE
PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3208
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:904
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4400
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 1KB
SHA256 d57a785680d54b9634c0d27d0a93a0b847ba0c997a2bc5e4dc12a8d5f41e447d
MD5 64d43c55cca6b0ed126739c87e9bc220
SHA1 a0e9c9ba2e238423dea709ee346de2184eb5b9dc
SHA512 d79e4b6d1b9b20ec7bb831c718e71ec64dc66e3ade9451b5183e37db9d37aeb2158cd9a0dca4150e397cf297eb8bee6d05dfbdcb0cd39e9ebd19715b512e2d5a
MD5 SHA1 SHA512

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 482KB
SHA256 42ffc7a85d77bb283f65f8105594a759b7c51352c4284c2292b9fa9bf7a5909d
MD5 361b4ad6f421d9904070ce086b75ccb4
SHA1 f4f5e1aa00a5cedcc70724de7ed3caffbf7b6209
SHA512 2fb94267f5ee2c34556a1e57e486c0fe808a0dc2af11b0c64600bad281154260ce91e2160971b084dfc02c2702953634b51ace6f97b0ec3e0f2d3ecd19360da3
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDq:BKgcRKMdRm4wFkVVDGJVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 1.5MB
SHA256 8b26be68c038c61f591be380c61943c26087e25472fc4147c4682dfb8357c495
MD5 4176994d205827a37c6be372953d5fd5
SHA1 9d2d35663e77f2ae644e11409f3acf7a913377b1
SHA512 007c6a1ed554ce83accb01da774ecf6907a426ff6f9a0dfd95b852974a9630a1bf08c8c516a12089f39f9b268f5433000db870912d4036936c232f4dd5746fb7
SSDEEP 24576:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL508qIdXMFVa4iNT6nU4L4IaVJER9EXwOr9:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

vueqjgslwynd.exe

Path C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
Size 1001KB
SHA256 a54834422beb649c62d0d8e2ca0ebbfda081358e5f78831fdc81384082bcad49
MD5 3078015ecd2e4fcdb88a64e67c127b8e
SHA1 22b43838bb59a19fd889ecdc9f4b8049e5c98845
SHA512 45e2194b8f49e2786c4eb83a1b452b16f6b4ffa4bf7be3e20626bc414f34616ece101ad81337e65f6aaf31e653dc1e530bf348c2c08f2ff564d2a632a323a7db
SSDEEP 24576:iT6UqvN4F5+wKxkQiKAlb0SCCWgYXL508qIdXMFVa4iNT6n3:iVkNC5+XxkQKlb0FjgS0+cywn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

1DF7.exe

Path C:\Users\Admin\AppData\Local\Temp\1DF7.exe
Size 245KB
SHA256 63bbcf3cec49075925b723d8f9d169ce663182827498867eb8ecbcf51c5a615d
MD5 3132d45f2bb5ea57a11a18c1012b3747
SHA1 0b13d04c2e4a71d9c69ad65d0cec523085b42275
SHA512 65e91e9531d9fd8698479822ecc8442f93d5459ddb1a8d76eeb398ef483387b06bd53c004dffd615c97f951d44560d6f2a38be38e3822025b9986acada3b2ff5
SSDEEP 3072:Xy2j3aPHjau3ydJoCsCEl3HW2T6JjM66h/ecsHXM9W5JjNNgW:i3R3yToCE8DjMbh/eci3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

25F7.exe

Path C:\Users\Admin\AppData\Local\Temp\25F7.exe
Size 1.2MB
SHA256 7cfac6497e8500a539b1531226c3f9dca7234db9bbc70f28f92da50177c9e65e
MD5 7e0b0057bfa166c42bbcad570322ee7c
SHA1 b57065cebd9402b43e63d6e331905407343b1e0f
SHA512 d8d3fdf7b6809aae33a433f267d53903a1a30729ffab72d7c0f5495ab1345d3eb31751e071c550840f9bae46b32a19cd95749bd0dda5909595ff763fafe343db
SSDEEP 24576:7UvNT9pcsVJYQ7KoOeoVkDG1lFgnRRnXldLCIhOrZc4c:41xZVJYQM6G1DUVXlZCIhkZhc
MD5 SHA1 SHA512 SSDEEP

Submit Download

25F7.exe

Path C:\Users\Admin\AppData\Local\Temp\25F7.exe
Size 1.2MB
SHA256 9be168947aaec1c15d94192efae0f4cdad7999672797bf2039b7e6135f32b1bd
MD5 247c285162337aeaf1c8379228ae9114
SHA1 a62bdae9957a18336b87796bc4d4e3c727b02b78
SHA512 36f3bb027747f68b3005a91fdc95af325bece872326759d350692581424bdb368ab7d8e69f2ed3fe10ff3a1e522e6c042f9e41c414db5a7606d1af81b6ab3f6e
SSDEEP 24576:7UvNT9pcsVJYQ7KoOeoVkDG1lFgnRRnXldLCIhOrk:41xZVJYQM6G1DUVXlZCIhkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

25F7.exe

Path C:\Users\Admin\AppData\Local\Temp\25F7.exe
Size 1.5MB
SHA256 8ad73647939daa9f2a1586e43311b98cf591a5ff41c4b46b8b02b91e33392027
MD5 dfb210d253924c52e423807134f0857e
SHA1 0669b2258ce52a9e293b0a3a746e9bd4742a9e5c
SHA512 307895c911afd4112f2b7847d76cf7575a82777cad840868c733162b41e240953c6b0524fa25814e93a91fde8c1223a709c5ef07c0eb3bb10a7617acd4098ad8
SSDEEP 49152:41xZVJYQM6G1DUVXlZCIhkZhNPlj3DYMtl:gnmDuXWfZPhzDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 3.5MB
SHA256 8393020cfcc1022caced90e7071689fb99bf280651e13cbfcf607b0c2491e75f
MD5 ef1b6a091dc382b08434588aa2a3bcc8
SHA1 2dd8915abc340f17697b7657afb153066c812d9a
SHA512 22774515fb86a429273f49052503b1ffb4a586632467bc13246e26c43768395aa13eacc91669bccd974e48181dbb176bdaa58078d6e57660ae0b71793b65750b
SSDEEP 98304:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSeZHe31O6Y/qi:OB4yzvjmEtMf+wT3Us6Y/qi
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 640KB
SHA256 4d69fa18d7f1fac5f56f9396b65057a21f42a13349b83cbe7291f00fc0b989db
MD5 ab43192ad620e08c545c7f7c4b52802b
SHA1 090a9c43a6be4ead3385a92bb4779865ed10127d
SHA512 1dcb00254d0ad110ebfa0e4cd267e31930f633f6762c3226579e62693401a465a8f9d0094d57354bb545ce5a5c2b15292c555506549b1dbcfae7629d91e0bbe0
SSDEEP 12288:OBug153YaazK+0Hoqilq4t1+VEjCT9yXXZ6ikfmJC33d44vNgIOtS7Xn+ygC2vb:OBF53YaYKBgtdCZyXXZ6ikuozvlJTn+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 2.2MB
SHA256 85d8fa5ebfc3fc150872fd0fb5dd3388dd58af0aea8ce0f6f8408dddd2bb0247
MD5 c0cbbc37afd3038489867a901c78525d
SHA1 45c528c015647624bd72cca399115a4f77a98a2e
SHA512 994e3bc4058cc285cf3439e1611a7365b9a38aa95de924038e9242d100308d3f5d7be51460e5777913daba683714cf53242a06ec9d84576a9fd999a3c56d586f
SSDEEP 49152:Ox3YeaCYntkzvlJT+5G4zfKMSLtAcwjZ0wl0ADmLAGFnwWEr6CfJ8ezdHG:Ox34CiKzvjm7SLtMZTm7LASnwWEuCSe4
MD5 SHA1 SHA512 SSDEEP

Submit Download

2B28.exe

Path C:\Users\Admin\AppData\Local\Temp\2B28.exe
Size 560KB
SHA256 11243641663323721ba21494a394de70ae70d4ea23c23f2e2a397fcc3cfea1a7
MD5 e6dd149f484e5dd78f545b026f4a1691
SHA1 3ea5d0fb2de5bfad3dc6dc1744708ccd31102df6
SHA512 0defb358d59221c56731745a25250dfea49ecbb411f11f31a92ec20fa2123646f4aaf9fd4999898c39e4674f616bc1bed7ef2368b61a29d595dc7b9340dd058b
SSDEEP 12288:wr7T2LrJ8czIXmTukXuiZflcPSAJNoeKj:wr7T2LF86TbuAlcqAJJKj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Size 1.0MB
SHA256 a259b24f685ff6cd61bf688e8047b3a9b297790a064d7556ae679e243344f0e3
MD5 9e5280e877ad1cff90ada058cbae8e07
SHA1 19806849a90f67b29e6f77376d626ffaaa6827d1
SHA512 5b7e5f9ba9c1db2f8f07decb31179ddfbea4dd14f704773286622fd95e8a132a5d55957b1c3a13a8c684d18e7e604e0d63893db624737f700c61f4f3b3e1e06c
SSDEEP 6144:yAAGXQy1+mvpfueX3XHYGNLYpYKxKGWCaxXfxa/jdNCMbTopKJ8uDoCjuyCvvfhe:Rh5u8Uk+el9xmQYLF8rEyq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Size 1.3MB
SHA256 064169804ed113b6b1a8abee6f168ae21c7c35047d39a7555d3e00aa3f56a8fd
MD5 3786fa887841fdcdac322377fa1cf930
SHA1 8d0726fd96acf8e721600edba8071383a98f4b08
SHA512 41570320c68796e7e877e1065675d76a386479a7d469cef2b8f566e45689245cc578b00a78d01b047813d0b7d0e10ef292993745181107f7df5da64109cde31a
SSDEEP 12288:MN0m5oRSiPj7J04v2zQIqtZVsCxOJYvYFX9lg:MTgKTKZ+ChN
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroomSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Size 2.9MB
SHA256 fe6e0cb70f8138296e32102ad135e166bc42e79d800dda84248d1c9f09deb957
MD5 4b854acd065892c59e15a04f6efd9e89
SHA1 66792d39e057556166d73876abf2e5b6d714262e
SHA512 893b4eae5d49bb298d93e37e3e9bdecc29d239934a9aca118e4080d93213d2ce1ab7a58478731fc14492fe36d0fc55e24e604f4c2b30c0a34abdb9e58b48c409
SSDEEP 49152:90oSiZ63YBmS9+rCgpvH8la0ZxRh+caGl:0Ula0cGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CA0.exe

Path C:\Users\Admin\AppData\Local\Temp\CA0.exe
Size 2.8MB
SHA256 97ef2de98d9c49cf4c28ee37021bd94713ef95e1eb0e816ba47fa65a7d6359ef
MD5 1b1eaa896c8f35570b609aaafbdfed36
SHA1 3708eb5cffe900496667471244c3fce8f013aa2a
SHA512 ccdbbbc7dbc5cd28315cc8cea64a928c021345586c277aebf8c5160abf51f44466d33209b32944b46a75b78afff6faf9c89d6e1f64e873da2559c73de1e4237e
SSDEEP 49152:aaw1ty+Qxnzzar9lESkH7CevMS4d7GG3snTTsV8z/yiZYm5Ie6U3Pct1D8L5fbOs:aaw1PQxnParj4OeZ4do/sV8z/7KmGeJV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CA0.exe

Path C:\Users\Admin\AppData\Local\Temp\CA0.exe
Size 2.9MB
SHA256 0559e3b49fb301e7d306663a173e74faebad50f62fc1a978d54f783b733dd913
MD5 99b7a8db86b43f1d79ae520b96085c70
SHA1 647bf934e3384d4a7bb17c39741b332a7bb0383a
SHA512 90443d3dcbf7a9084a33c97c1f8d71dcf338fc89d855171c25a0f5f9c76b19e024af79d2026dbe7633c0289a9822ea1f35121ef56dac6fa03d57e7c13810a942
SSDEEP 49152:aaw1ty+Qxnzzar9lESkH7CevMS4d7GG3snTTsV8z/yiZYm5Ie6U3Pct1D8L5fbOg:aaw1PQxnParj4OeZ4do/sV8z/7KmGeJV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCE5.exe

Path C:\Users\Admin\AppData\Local\Temp\CCE5.exe
Size 5.0MB
SHA256 fca631b3198194fcc0c619b5690dbde2e9f38afb1b978bab8ea3f92b572ce1ef
MD5 0904e849f8483792ef67991619ece915
SHA1 58d04535efa58effb3c5ed53a2462aa96d676b79
SHA512 258fc59050aa455ad56167dd1bbe5e098eefc0f3e950c90d89bac2aa74abb5cfa1710d866c0e28e58dcb2f914736470a4dd9838dd6412b633aee87d71b867cf5
SSDEEP 98304:YpagNGsMccFm+UzQSYGUbVmmu16zerASsze/5CYOAVzSJP9c+:Ypa0GspcIlz9YvJkOekS9CYO0aP9c+
MD5 SHA1 SHA512 SSDEEP

Submit Download

D226.dll

Path C:\Users\Admin\AppData\Local\Temp\D226.dll
Size 2.0MB
SHA256 b4ee4aa0b664fe673986399de8105c600330339971bd8583177fa38dddd13aac
MD5 7aecbe510817ee9636a5bcbff0ee5fdd
SHA1 6a3f27f7789ccf1b19c948774d84c865a9ac6825
SHA512 a681efb97745aed5f73d197730049ff80798d133245d8e8bcb0faf3532a9ef440d1687016c9f666c1f56479c7db003b0388e0a69bb2626f34c86046bc477edae
SSDEEP 49152:1dwMokTj4U7sYzV7sdSE3VTE9fytnGSzvG:1WM1HEBlTK2
MD5 SHA1 SHA512 SSDEEP

Submit Download

D757.exe

Path C:\Users\Admin\AppData\Local\Temp\D757.exe
Size 2.5MB
SHA256 ff0b27a5f69de1453574ebe4416e3446d91b7b372727eb3239970b53cf50f719
MD5 8a5e3986f5d478a533d2388f61236487
SHA1 73e4ed75465bd01dd0f9c3a104620700dd7dcbd0
SHA512 9120cc6a9fd226d109318ef7b479af6ad844d022c52a441d7e2912143086f529d423e8d41b9d62f781ede66d3ba35eec43a7896e675c00a27a5ff0c1029d699e
SSDEEP 49152:1q6KgT4K/n8IE1q8itMe2ixKDcqPPP8f1yCNuEwo32SZwzTsuFkaO9:IbgF/n8JPitMeNF6sPuro3hkfyaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 2.5MB
SHA256 5dfaa8987f5d0476b835140d8a24fb1d9402e390bbe92b8565da09581bd895fc
MD5 b03886cb64c04b828b6ec1b2487df4a4
SHA1 a7b9a99950429611931664950932f0e5525294a4
SHA512 21d1a5a4a218411c2ec29c9ca34ce321f6514e7ca3891eded8c3274aeb230051661a86eda373b9a006554e067de89d816aa1fa864acf0934bbb16a6034930659
SSDEEP 49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPKkv/m63KEll25OcXoZ:iVkYYXc4FUoNeIo2eaZdScKS/mQ/K6
MD5 SHA1 SHA512 SSDEEP

Submit Download

FourthX.exe

Path C:\Users\Admin\AppData\Local\Temp\FourthX.exe
Size 2.2MB
SHA256 ae89e1148b1af4053f3121ef418cede90efd7b9faff95d4892f51d5ea9d9bcbf
MD5 0c3b9f888d0e14143a1cd1bf0831bd3f
SHA1 8a5284412a93e51e2cd3e7aba86c2587f659c3ed
SHA512 988a306c2bd03817b04474388ba44c86968f52946793f3544a75f6e8084106810a7c092180a2a36956081a0bb47aa4da5ffa7a46a7af30d31f7ec0625568df55
SSDEEP 49152:iVkNC5+XxkQKlb0FjgS0+cywnZLIJK2egUmFbcP9ovzmiPKkv/m63KEll25OcXS:iVkYYXc4FUoNeIo2eaZdScKS/mQ/Ks
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
Size 2.0MB
SHA256 460ba492fbc3163b80bc40813d840e50feb84166db7a300392669afd21132d98
MD5 28b72e7425d6d224c060d3cf439c668c
SHA1 a0a14c90e32e1ffd82558f044c351ad785e4dcd8
SHA512 3e0696b4135f3702da054b80d98a8485fb7f3002c4148a327bc790b0d33c62d442c01890cc047af19a17a149c8c8eb84777c4ff313c95ec6af64a8bf0b2d54b6
SSDEEP 49152:ChrF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuw:ChFdFWINS/NF9gpMR5oEfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ctcfptdg.nop.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ctcfptdg.nop.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

D757.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-N6LRR.tmp\D757.tmp
Size 689KB
SHA256 fca7b41b057f667f3cbf74f94708abd127833f4bf4df793775e8e9481574474f
MD5 27d40bc576e651fd20b772b8db7a0251
SHA1 a1b78f2f1ec6de20b637b1d24ffa03ce013a0976
SHA512 199e4ad86344fc149716c2ad1d939261a3a86cd6b09c1ec4925ff3fe07afd7af01160a9a70545ed262282c8354d72b5f3d7abd06701a9940d35c2cbbc1f585a0
SSDEEP 12288:qTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORuoVwRxyF:iPcYn5c/rPx37/zHBA6pDp2mIEioCRx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa11CF.tmp\INetC.dll
Size 17KB
SHA256 5a687aada1a515dfe60336d670e1bf5fda2c773fa4e7bbeb88d8235bc76e6e38
MD5 28582e618d08ce45f2771d37bfc6ad0d
SHA1 5f53138fafb2b00220c0d97d2c8b6d20792df5b8
SHA512 e4171ea1e2d0fc4a409ef2dc2b60240c183c940282a97768cd40444d1774f0b8bd7134f77a68ab7a0f67e7a3d18a4fb1e31007281006027df39d5e03e6f3e67a
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/:dAvE90GuY2tO93oLrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsx970D.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx970D.tmp
Size 137KB
SHA256 a3759a1ac408bdeab7525fb8da0dc6177bcb8c8132186542067e4a00609f7788
MD5 d21e1509dd826242d4c8bd6d91e1f5ff
SHA1 edbad4b982a33181df76d1a3e9376aac4173e2ec
SHA512 cd391d7e43cd33fa162674f0e6f074ba56604bceb0d3d941d07c689cc37a98210df91f593fe20b7acc37f1734bc606ef44c7e47f640521397529dfe929167de0
SSDEEP 1536:yp2xMNERAlbWFAQAXuTjhuMLgivPLkN2XYos+AR0XQenZw7F97JqvfsLQ4eIAz1r:e2T42uAz80XQm0FfUbsUK3Ftw8mdSxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsx970D.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx970D.tmp
Size 75KB
SHA256 ae4df706967cff7bab78072b3e649985b13ff6db9ee7686d739cfb698908b810
MD5 c74fb973f7e445cfe3febaa54df6a26b
SHA1 8fdcb65fa6392bfcf43dfa62ed7f5bd936b537e6
SHA512 4b2d00a3875bbba92e65daa8e63cc729366c7bf691e2a68a5bb9335eed24508cc2642fded3db6505e0e3804b0b37a03f251b8f5b5aa10e1fe05cadffaa183528
SSDEEP 1536:yp2xMNERAlbWFAQAXuTjhuMLgivPLkN2XYos+8:e2T42uAzw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Size 128B
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
MD5 SHA1 SHA512

Submit Download

ubgcihs

Path C:\Users\Admin\AppData\Roaming\ubgcihs
Size 252KB
SHA256 9a4ec7e772c3594d74bae8cb0d4c4b484e2a29812767395a4339cdf9f5f5f11c
MD5 56d4fff8a9409a1892dec625d2a0307a
SHA1 e844eb91497642ae8347d3e759386f4aa15075b6
SHA512 bf1e42f7f519953d88347aa04f29f24a42a33cba16bcd5c08790e34819cbd3d3976376e98fa2493156f82813a4b387b6339cc9e8d1c0004f733a238f073d95c9
SSDEEP 3072:a1Dn5YORgjwstWB0aZsPWwC+gc91tu4gbS58Px2VFplTKFa:wjfgjwPBBZs+1+rJkPIVFbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
MD5 db01a2c1c7e70b2b038edf8ad5ad9826
SHA1 540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA512 c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 8a32f53f825ca4b50c73313fa274ec962dc3cfcf03cce176a8d12a6a6772e3e1
MD5 7ad2bfcca724d18eeb4c98ebe055a10f
SHA1 2ec0ad073ff75cca8ac0ecf465f5f5568e4d32f8
SHA512 9c593c0889268efa19c0717e598229e70443430e4595bac69d28494ad34f80bf43e32443139f6a808ef33c5bc44bdfffd2e0922f9cd46a37cc3e357a4adeca6d
SSDEEP 384:gAbQ7Ei4teIA+pynJsDaH6P44o01zJ7SHcftlodBPJkSk8KRcYL0D8:nQIivP+pBDaa/TSH4HoLJXHKRFY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 05db6a2c78223ea80d76929340bb347f1f1c9ba95a798228893ac00518de8f0d
MD5 0c14d72e771c94f1120bed1733b23f3f
SHA1 bba43c120ca75503fb5f99d87717b8089e455b4d
SHA512 06dd40898309f85f3185e547e11214de0680ba7f73dd4d636d849df76560699beab5b226a612d890ab4614ce32aa4875e4088c1c25c87e92d7148ebf650810b6
SSDEEP 384:82bbxZa7xOgGbml8Ab8cgKAiVRUMBiIOUNJZhiC5MV2GQf8ZOL4GeS2ya:Xn+YBbO8i8cIRMB3dbZM2Vbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 860KB
SHA256 eb1c0fcaca6e902075e20a5889b1f8ebac4cd68a09f4e86a96b03bd3fd8d6376
MD5 099a1ead22a3e75653bd67b67d117374
SHA1 67a46062044f911a0cc5f5158043c09f32b497cb
SHA512 74435d726be478c5d924bf7fa6eddc17dd99d1b6da8c04e0e0ac816562cec6005fb2e2b51b2edbdd422ffaecfe9c770df452f07380eff677f68b2755d15bbb84
SSDEEP 24576:fEggtwf12gyTkHlnKGxJHxIB+y5GNIvxnnt7rczxISEYak3HFOsWYrVvE4C5mxVg:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

D226.dll

Path \Users\Admin\AppData\Local\Temp\D226.dll
Size 715KB
SHA256 13d7197993d2281c873e85aacd0490bdf41605fc2559bbb9141b7008af830f43
MD5 1877a2c34f77b4e41ce71ce302ea89ee
SHA1 3ca4702b33839d12a974c3a1ba59f3d0198f379e
SHA512 a97cb2b22f4956d37efb9f571d90555d956b75bfab66f766e03e3af4a09c379401b6ffabfd127ca436982458ee4cbe9812365f534a3d99d6529fcb17eb66a3ed
SSDEEP 12288:6rDXmduPgmZtGBOOitChe2CAqGuTYlci5Ibujf6QT4jZD6Yzh7:6rCdu4mZtMokCJWbNjyQT4YYN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path \Users\Admin\AppData\Local\Temp\is-2A2EL.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

INetC.dll

Path \Users\Admin\AppData\Local\Temp\nsa11CF.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/520-29-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/520-60-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/928-1-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

Download

memory/928-5-0x0000000000400000-0x0000000002D3E000-memory.dmp

Download

memory/928-3-0x0000000000400000-0x0000000002D3E000-memory.dmp

Download

memory/928-2-0x00000000001E0000-0x00000000001EB000-memory.dmp

Download

memory/1396-210-0x00000000078D0000-0x000000000791B000-memory.dmp

Download

memory/1396-400-0x0000000009850000-0x00000000098F5000-memory.dmp

Download

memory/1396-175-0x00000000043D0000-0x0000000004406000-memory.dmp

Download

memory/1396-177-0x00000000727A0000-0x0000000072E8E000-memory.dmp

Download

memory/1396-191-0x00000000073C0000-0x0000000007426000-memory.dmp

Download

memory/1396-209-0x0000000007250000-0x000000000726C000-memory.dmp

Download

memory/1396-190-0x00000000071A0000-0x0000000007206000-memory.dmp

Download

memory/1396-194-0x0000000007430000-0x0000000007780000-memory.dmp

Download

memory/1396-403-0x0000000009A70000-0x0000000009B04000-memory.dmp

Download

memory/1396-189-0x0000000007290000-0x00000000072B2000-memory.dmp

Download

memory/1396-330-0x0000000008A80000-0x0000000008AF6000-memory.dmp

Download

memory/1396-382-0x0000000009610000-0x0000000009643000-memory.dmp

Download

memory/1396-184-0x0000000004380000-0x0000000004390000-memory.dmp

Download

memory/1396-178-0x0000000006A60000-0x0000000007088000-memory.dmp

Download

memory/1396-402-0x0000000004380000-0x0000000004390000-memory.dmp

Download

memory/1396-246-0x00000000088D0000-0x000000000890C000-memory.dmp

Download

memory/1396-183-0x0000000004380000-0x0000000004390000-memory.dmp

Download

memory/1396-384-0x0000000070610000-0x000000007065B000-memory.dmp

Download

memory/1396-389-0x0000000008960000-0x000000000897E000-memory.dmp

Download

memory/1396-387-0x000000006FFD0000-0x0000000070320000-memory.dmp

Download

memory/1396-386-0x000000007F580000-0x000000007F590000-memory.dmp

Download

memory/1624-141-0x0000000000400000-0x0000000001A2A000-memory.dmp

Download

memory/1624-107-0x0000000000400000-0x0000000001A2A000-memory.dmp

Download

memory/1624-104-0x0000000001C40000-0x0000000001D40000-memory.dmp

Download

memory/1624-105-0x0000000001B20000-0x0000000001B2B000-memory.dmp

Download

memory/1732-122-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1732-36-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1732-61-0x0000000000400000-0x00000000004BC000-memory.dmp

Download

memory/2044-93-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/2044-147-0x0000000000400000-0x00000000008E2000-memory.dmp

Download

memory/2044-151-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/2136-125-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/2136-121-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/2136-116-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/2136-155-0x0000000002E10000-0x0000000002F1E000-memory.dmp

Download

memory/2136-153-0x0000000002CE0000-0x0000000002E09000-memory.dmp

Download

memory/2136-119-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/2136-157-0x0000000002E10000-0x0000000002F1E000-memory.dmp

Download

memory/2136-123-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/2136-124-0x0000000000400000-0x0000000000848000-memory.dmp

Download

memory/2136-133-0x0000000000A00000-0x0000000000A06000-memory.dmp

Download

memory/2220-205-0x0000000001CB0000-0x0000000001DB0000-memory.dmp

Download

memory/2220-207-0x0000000001B60000-0x0000000001B87000-memory.dmp

Download

memory/2220-208-0x0000000000400000-0x0000000001A2B000-memory.dmp

Download

memory/2220-243-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2648-66-0x0000000072DD0000-0x00000000734BE000-memory.dmp

Download

memory/2648-67-0x00000000006C0000-0x0000000000F76000-memory.dmp

Download

memory/2648-91-0x0000000072DD0000-0x00000000734BE000-memory.dmp

Download

memory/2920-566-0x0000000002F00000-0x0000000003000000-memory.dmp

Download

memory/3228-57-0x00000000049D0000-0x0000000004ADE000-memory.dmp

Download

memory/3228-53-0x00000000048A0000-0x00000000049C9000-memory.dmp

Download

memory/3228-55-0x00000000049D0000-0x0000000004ADE000-memory.dmp

Download

memory/3228-54-0x00000000049D0000-0x0000000004ADE000-memory.dmp

Download

memory/3228-59-0x0000000010000000-0x000000001020A000-memory.dmp

Download

memory/3228-22-0x0000000010000000-0x000000001020A000-memory.dmp

Download

memory/3228-24-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/3420-117-0x00000000037B0000-0x000000000396A000-memory.dmp

Download

memory/3420-120-0x0000000003A70000-0x0000000003C27000-memory.dmp

Download

memory/3420-204-0x0000000003A70000-0x0000000003C27000-memory.dmp

Download

memory/3496-4-0x0000000000580000-0x0000000000596000-memory.dmp

Download

memory/3496-139-0x00000000005F0000-0x0000000000606000-memory.dmp

Download

memory/4164-213-0x00000181B56C0000-0x00000181B5736000-memory.dmp

Download

memory/4164-181-0x00000181B54B0000-0x00000181B54C0000-memory.dmp

Download

memory/4164-253-0x00000181B54B0000-0x00000181B54C0000-memory.dmp

Download

memory/4164-380-0x00000181B54B0000-0x00000181B54C0000-memory.dmp

Download

memory/4164-180-0x00007FF8F5D50000-0x00007FF8F673C000-memory.dmp

Download

memory/4164-182-0x00000181B54B0000-0x00000181B54C0000-memory.dmp

Download

memory/4164-188-0x000001819CF00000-0x000001819CF22000-memory.dmp

Download

memory/4408-401-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Download

memory/4408-150-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4408-138-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4408-136-0x00000000049D0000-0x0000000004A3B000-memory.dmp

Download

memory/4408-135-0x0000000002DB0000-0x0000000002EB0000-memory.dmp

Download

memory/4408-383-0x00000000049D0000-0x0000000004A3B000-memory.dmp

Download

memory/4408-137-0x0000000000400000-0x0000000002D8C000-memory.dmp

Download

memory/4748-15-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/4748-16-0x0000000000190000-0x0000000000A3F000-memory.dmp

Download

memory/4748-17-0x0000000000190000-0x0000000000A3F000-memory.dmp

Download

memory/4748-58-0x0000000000190000-0x0000000000A3F000-memory.dmp

Download

memory/4904-146-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4904-152-0x0000000002E60000-0x000000000374B000-memory.dmp

Download

memory/4904-161-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4904-166-0x0000000002960000-0x0000000002D59000-memory.dmp

Download

memory/4904-169-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4904-96-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4904-95-0x0000000002E60000-0x000000000374B000-memory.dmp

Download

memory/4904-94-0x0000000002960000-0x0000000002D59000-memory.dmp

Download

memory/4904-174-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download