glupteba | 8ad20c4b4c312feb468a58d1748c0d7abba3dd2d0fb8e6bfbee837c47a0e8c5a

Analysis

max time kernel
182s
max time network
582s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

288c47bbc1871b439df19ff4df68f07776.exe
Size

4.5MB
MD5

2c7078b90caee9d791dd338c2441ca32
SHA1

56901d99127fd701353ab7c68e66c94c49eb507c
SHA256

8ad20c4b4c312feb468a58d1748c0d7abba3dd2d0fb8e6bfbee837c47a0e8c5a
SHA512

000d81908bc2df1f09fcbf0ac50c72079064923f23fbea2ee0868590eaf693dff4246bb0090083aaec6f031b11353147393b710f72cd1e3630c2ecd071401ef6
SSDEEP

98304:5LGSrOpzjhc9lEoupup/jJ1hPE73PGV6F8bnYFc+x69kDP83i:kdjK9lZuEprhEjC7Y69+Pmi

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit spyware stealer upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 21 IoCs

resource	yara_rule
behavioral2/memory/4956-26-0x0000000003FB0000-0x000000000489B000-memory.dmp	family_glupteba
behavioral2/memory/4956-28-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/4956-111-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/4956-113-0x0000000003FB0000-0x000000000489B000-memory.dmp	family_glupteba
behavioral2/memory/5112-114-0x0000000003AC0000-0x0000000003EC4000-memory.dmp	family_glupteba
behavioral2/memory/5112-115-0x0000000003ED0000-0x00000000047BB000-memory.dmp	family_glupteba
behavioral2/memory/5112-116-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/5112-289-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-408-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-419-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-422-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-425-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-428-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-431-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-434-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-437-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-440-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-443-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-446-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-449-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba
behavioral2/memory/3540-452-0x0000000000400000-0x0000000001E0F000-memory.dmp	family_glupteba

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4412	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	InstallSetup_four.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	288c47bbc1871b439df19ff4df68f07776.exe

Executes dropped EXE 9 IoCs

pid	Process
908	InstallSetup_four.exe
4956	288c47bbc1871b439df19ff4df68f076.exe
4364	up8.0.exe
3192	up8.1.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
3540	csrss.exe
2504	injector.exe
1704	windefender.exe
3904	windefender.exe

Loads dropped DLL 2 IoCs

pid	Process
4364	up8.0.exe
4364	up8.0.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00080000000231f6-51.dat	upx
behavioral2/memory/3192-67-0x0000000000400000-0x0000000000930000-memory.dmp	upx
behavioral2/files/0x00080000000231f6-56.dat	upx
behavioral2/memory/3192-190-0x0000000000400000-0x0000000000930000-memory.dmp	upx
behavioral2/files/0x000a000000023219-411.dat	upx
behavioral2/memory/1704-416-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3904-421-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3904-426-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	288c47bbc1871b439df19ff4df68f076.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	288c47bbc1871b439df19ff4df68f076.exe
File created	C:\Windows\rss\csrss.exe	288c47bbc1871b439df19ff4df68f076.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1036	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
708	908	WerFault.exe	93
2692	5112	WerFault.exe	111
1376	4364	WerFault.exe	96

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	up8.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	up8.0.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3224	schtasks.exe
2972	schtasks.exe
4512	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-292 = "Central European Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	288c47bbc1871b439df19ff4df68f076.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	288c47bbc1871b439df19ff4df68f076.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1548	powershell.exe
1548	powershell.exe
1548	powershell.exe
4956	288c47bbc1871b439df19ff4df68f076.exe
4956	288c47bbc1871b439df19ff4df68f076.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4364	up8.0.exe
4364	up8.0.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
5112	288c47bbc1871b439df19ff4df68f076.exe
4404	powershell.exe
4404	powershell.exe
4404	powershell.exe
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe
2396	powershell.exe
2396	powershell.exe
2396	powershell.exe
4364	up8.0.exe
4364	up8.0.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
3540	csrss.exe
3540	csrss.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
3540	csrss.exe
3540	csrss.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
3540	csrss.exe
3540	csrss.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe
2504	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	4956	288c47bbc1871b439df19ff4df68f076.exe
Token: SeImpersonatePrivilege	4956	288c47bbc1871b439df19ff4df68f076.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeSystemEnvironmentPrivilege	3540	csrss.exe
Token: SeSecurityPrivilege	1036	sc.exe
Token: SeSecurityPrivilege	1036	sc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3192	up8.1.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 908	1408	288c47bbc1871b439df19ff4df68f07776.exe	93
PID 1408 wrote to memory of 908	1408	288c47bbc1871b439df19ff4df68f07776.exe	93
PID 1408 wrote to memory of 908	1408	288c47bbc1871b439df19ff4df68f07776.exe	93
PID 1408 wrote to memory of 4956	1408	288c47bbc1871b439df19ff4df68f07776.exe	94
PID 1408 wrote to memory of 4956	1408	288c47bbc1871b439df19ff4df68f07776.exe	94
PID 1408 wrote to memory of 4956	1408	288c47bbc1871b439df19ff4df68f07776.exe	94
PID 908 wrote to memory of 4364	908	InstallSetup_four.exe	96
PID 908 wrote to memory of 4364	908	InstallSetup_four.exe	96
PID 908 wrote to memory of 4364	908	InstallSetup_four.exe	96
PID 4956 wrote to memory of 1548	4956	288c47bbc1871b439df19ff4df68f076.exe	98
PID 4956 wrote to memory of 1548	4956	288c47bbc1871b439df19ff4df68f076.exe	98
PID 4956 wrote to memory of 1548	4956	288c47bbc1871b439df19ff4df68f076.exe	98
PID 908 wrote to memory of 3192	908	InstallSetup_four.exe	103
PID 908 wrote to memory of 3192	908	InstallSetup_four.exe	103
PID 908 wrote to memory of 3192	908	InstallSetup_four.exe	103
PID 3192 wrote to memory of 1892	3192	up8.1.exe	105
PID 3192 wrote to memory of 1892	3192	up8.1.exe	105
PID 3192 wrote to memory of 1892	3192	up8.1.exe	105
PID 1892 wrote to memory of 5056	1892	cmd.exe	114
PID 1892 wrote to memory of 5056	1892	cmd.exe	114
PID 1892 wrote to memory of 5056	1892	cmd.exe	114
PID 1892 wrote to memory of 3224	1892	cmd.exe	108
PID 1892 wrote to memory of 3224	1892	cmd.exe	108
PID 1892 wrote to memory of 3224	1892	cmd.exe	108
PID 5112 wrote to memory of 4176	5112	288c47bbc1871b439df19ff4df68f076.exe	112
PID 5112 wrote to memory of 4176	5112	288c47bbc1871b439df19ff4df68f076.exe	112
PID 5112 wrote to memory of 4176	5112	288c47bbc1871b439df19ff4df68f076.exe	112
PID 5112 wrote to memory of 3556	5112	288c47bbc1871b439df19ff4df68f076.exe	115
PID 5112 wrote to memory of 3556	5112	288c47bbc1871b439df19ff4df68f076.exe	115
PID 3556 wrote to memory of 4412	3556	cmd.exe	116
PID 3556 wrote to memory of 4412	3556	cmd.exe	116
PID 5112 wrote to memory of 4404	5112	288c47bbc1871b439df19ff4df68f076.exe	117
PID 5112 wrote to memory of 4404	5112	288c47bbc1871b439df19ff4df68f076.exe	117
PID 5112 wrote to memory of 4404	5112	288c47bbc1871b439df19ff4df68f076.exe	117
PID 5112 wrote to memory of 1956	5112	288c47bbc1871b439df19ff4df68f076.exe	120
PID 5112 wrote to memory of 1956	5112	288c47bbc1871b439df19ff4df68f076.exe	120
PID 5112 wrote to memory of 1956	5112	288c47bbc1871b439df19ff4df68f076.exe	120
PID 5112 wrote to memory of 3540	5112	288c47bbc1871b439df19ff4df68f076.exe	121
PID 5112 wrote to memory of 3540	5112	288c47bbc1871b439df19ff4df68f076.exe	121
PID 5112 wrote to memory of 3540	5112	288c47bbc1871b439df19ff4df68f076.exe	121
PID 3540 wrote to memory of 2396	3540	csrss.exe	125
PID 3540 wrote to memory of 2396	3540	csrss.exe	125
PID 3540 wrote to memory of 2396	3540	csrss.exe	125
PID 3540 wrote to memory of 5100	3540	csrss.exe	128
PID 3540 wrote to memory of 5100	3540	csrss.exe	128
PID 3540 wrote to memory of 5100	3540	csrss.exe	128
PID 3540 wrote to memory of 4172	3540	csrss.exe	135
PID 3540 wrote to memory of 4172	3540	csrss.exe	135
PID 3540 wrote to memory of 4172	3540	csrss.exe	135
PID 3540 wrote to memory of 2504	3540	csrss.exe	136
PID 3540 wrote to memory of 2504	3540	csrss.exe	136
PID 1704 wrote to memory of 1744	1704	windefender.exe	143
PID 1704 wrote to memory of 1744	1704	windefender.exe	143
PID 1704 wrote to memory of 1744	1704	windefender.exe	143
PID 1744 wrote to memory of 1036	1744	cmd.exe	144
PID 1744 wrote to memory of 1036	1744	cmd.exe	144
PID 1744 wrote to memory of 1036	1744	cmd.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f07776.exe
"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f07776.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Users\Admin\AppData\Local\Temp\up8.0.exe
    "C:\Users\Admin\AppData\Local\Temp\up8.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2344
      4⤵
      Program crash
      PID:1376
- - C:\Users\Admin\AppData\Local\Temp\up8.1.exe
    "C:\Users\Admin\AppData\Local\Temp\up8.1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:5056
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 1536
    3⤵
    - Program crash
    PID:708
- C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
  "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4176
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4412
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:2972
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:3852
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4512
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 844
      4⤵
      Program crash
      PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 908 -ip 908
1⤵
PID:3864

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5112 -ip 5112
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4364 -ip 4364
1⤵
PID:3788

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
2.1MB

MD5
68d9487b5ee79af84e6ac161c1de94e6

SHA1
7dd64b3445765e2979e50ec88f033914f4ffd5fa

SHA256
bfcdb3ad2551b607f4ee87475700cd65750dfcbef7f8eb802c157ea2afe9aeed

SHA512
8f0cbd77064c66031cfdaf7c76b9406a9765430ae3d9966691f90b563f075eb0e32ecde0f5e8ce27d859bd753641bb87beaa883595741e6cd3d447857e539489

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
448KB

MD5
379ee48a4d4b01503e3584985534015f

SHA1
81ab8822b265051014834c11b2aafe280d690c05

SHA256
0bdd2452de897cc462546bc39aa76582f01f865ba3adf63550784b4724e14fe8

SHA512
40003edfd5029f5b11a45c1e164361520f0ed85eaa00b91db92a482df2006484ba225841574e1397a6e42a5b6048696ede103908098496e396c30fe1b4c0ea41

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
1.1MB

MD5
d435a1d6c92b350c824ace24f94d5b58

SHA1
2de65c5665e7cfbc18e90a58e778d34948a54eca

SHA256
94add31e627e99dfba3c4abd0159c0a6fba7736eb925e0829b185e1d148261be

SHA512
c3689a2a363277d5f57d6cd52de3e03a9add38a863d03f99ffce5769256d09c19bf5d0c10be7f5659b1bf0e95a7a5185dc37958d8e47a3fe04a57a067c037746

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

Filesize
960KB

MD5
46f02883577ec05c278186b4fb44ba14

SHA1
3c531d2845d2a0e958c3f5bcc487eb0fb98b2e73

SHA256
39daf7bd5756b6337b1e3bd1e64384ef574401206b7917fe09a1157f15645e0b

SHA512
83cdbe66c8df76bc0a41976eabfbc3854cdffc57f8e4920b759936038d5c4d08a7d01344f4ee6e0e7b226550d4d2b24164dea50d5bce4f8ae6b177cda67dcf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

Filesize
380KB

MD5
0564a9bf638169a89ccb3820a6b9a58e

SHA1
57373f3b58f7cc2b9ea1808bdabb600d580a9ceb

SHA256
9e4b0556f698c9bc9a07c07bf13d60908d31995e0bd73510d9dd690b20b11058

SHA512
36b81c374529a9ba5fcbc6fcfebf145c27a7c30916814d63612c04372556d47994a8091cdc5f78dab460bb5296466ce0b284659c8b01883f7960ab08a1631ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yic51cif.j2c.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\up8.0.exe

Filesize
192KB

MD5
8eeb76dec31b0ccdfdde0df8ef2e2135

SHA1
96084de222d741a367e7dff543bc055a70d86045

SHA256
df44dd1015c34fa9515af713292777602d572af6b175cd6cc6f5e0b9c40b598b

SHA512
f989d6949ec77542fadc28fa2609d0be30e4e578822a182e41e340f9118ae4a0b6e7961bf19ba1878ac6e20e2765619d57a12a07117067ccb6485fe4d56faf1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\up8.1.exe

Filesize
1.6MB

MD5
06246d5f1675d0680bccaa82ae2b26fd

SHA1
a73d03970a916cfcd6108e042149eadc54b940eb

SHA256
c8a160c92eda31a919466f81f8828eaaa9091f1d66830376e33b32dde7178579

SHA512
57fa90a31f7f7e0cffc3b3e7f0dd23d240c1843cdf98da4e587efb8f0b9ab30649995a7dac4a2d57cac46a918f573402dab61d0d3d7fd89b474535ac8b644ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\up8.1.exe

Filesize
1.7MB

MD5
5b87828ea000c7111084d8beed17175e

SHA1
e8aa3848e39c449051702a333e608fafd2e5330f

SHA256
1a557fae2d39d06392f4bea760fb72c87f0959a7c3ac66865e36f316866f57d3

SHA512
56b0d0e5422b89a4659969f59570962dbb267fde913ed051fbedf3d66653c9c23d15c945a6ae8ce5570af010b3671eb0be085e8afb44c3088def9f423290f385

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
51cb7b24ba2685e54f5dd7f619fc1626

SHA1
e6a470113b684546bf48281f7b157781a74d7366

SHA256
546ede42aa588285b04d0bcdfd3fe470d9322e2383c186b0dd42c667772a151b

SHA512
96eaa619c915dea12e8ad98955fc9b4621353157615f017351dc22f47fbff79b6dbf7e6dbaf8592fb1d588554b79065f3c207b6c6d06bc0585d8bacb7cc34e0b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
7cd13ec2be52e060ba0f57eec3120e9b

SHA1
4edc45c67bb3da3d0951d3b4e1e677b7f4959292

SHA256
8aa95247aaa68fc5b35c0b153849b5975db0b11aae5735e78f1e951b0591fb01

SHA512
54c6f2766b754e654c563809bde0301f1b893502232905bd720fad34747e92864ef8bb49a861c242dd86a2ea8a87b70218f1ff1b0cd11a3e7a59b7010f60e8d7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
e04308071d6290a87b93db2b257e620b

SHA1
4e2ce625faf76cf9b9ff14368731e5121f9fcbf3

SHA256
c31a93af60d06a311ec5c50ef8350b33e2a04426b991c35d65cd2790e93bf22a

SHA512
c419e1d1991143cc792694c433a60dd3ba7d57efbb33de157313ce65132a62f73c7db8684f1a48e22a99436a2f675d1c66fb773137f8163a2f33a9db3e01a2af

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
1600de8352e0ff59773ef4a40b373a41

SHA1
cda75489270604af3910e249e8a4cac53846b26f

SHA256
513a8b074909d3f673c137f51834818f68f2ba663af3bbd0af1daca085d6e627

SHA512
25f2531525db3a7df7e0bfc74498041a3ef83212e20ee74f8023016c60e6a32a18bd38806c45a0f486ce0f847be6cb650880a4a6e608b7f60d653a424ff7e6fb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ea14c246bcd65a20369e5a2245c74a80

SHA1
bf83bc0bd1f1dde45221625e83aff03804ece172

SHA256
1c7e13837bc7d07a4356147f9263780a66f2a09eae3bd959c3e2196d892213ad

SHA512
e029222ef619243e7956ba650d18ea6c3d591fd218ee822e533093203bad6000d93327a20c75d1aab367c1c7e966a99f3926c1e8ae72e8738cd00316ab34ae8a

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
0c7b8daa9b09bcdf947a020bf28c2f19

SHA1
738f89f4da5256d14fe11394cf79e42060a7e98b

SHA256
ff0c709f06a8850794f2501c7dc9ce4ffc75f1ab3039218952cd87a067d3d3ff

SHA512
b069ef6d30a5afafc4b4e2632cb4f9da65e58dcedb66706921d85a6be97a024c1e786ec51299ba52668a65fe948d499609aa2b4978fb20738dd0b643d84cbcf6

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/908-71-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/908-24-0x0000000000400000-0x0000000001A4B000-memory.dmp

Filesize
22.3MB

Download
memory/908-16-0x0000000001CC0000-0x0000000001DC0000-memory.dmp

Filesize
1024KB

Download
memory/908-19-0x0000000003660000-0x00000000036C7000-memory.dmp

Filesize
412KB

Download
memory/1408-23-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1408-1-0x0000000000BE0000-0x000000000106C000-memory.dmp

Filesize
4.5MB

Download
memory/1408-0-0x0000000075340000-0x0000000075AF0000-memory.dmp

Filesize
7.7MB

Download
memory/1548-69-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Filesize
120KB

Download
memory/1548-109-0x0000000073D20000-0x00000000744D0000-memory.dmp

Filesize
7.7MB

Download
memory/1548-72-0x00000000064A0000-0x00000000064E4000-memory.dmp

Filesize
272KB

Download
memory/1548-45-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/1548-76-0x0000000007050000-0x00000000070C6000-memory.dmp

Filesize
472KB

Download
memory/1548-77-0x0000000007750000-0x0000000007DCA000-memory.dmp

Filesize
6.5MB

Download
memory/1548-78-0x00000000070F0000-0x000000000710A000-memory.dmp

Filesize
104KB

Download
memory/1548-80-0x00000000074B0000-0x00000000074E2000-memory.dmp

Filesize
200KB

Download
memory/1548-81-0x000000006FE50000-0x000000006FE9C000-memory.dmp

Filesize
304KB

Download
memory/1548-79-0x000000007F5A0000-0x000000007F5B0000-memory.dmp

Filesize
64KB

Download
memory/1548-92-0x00000000074F0000-0x000000000750E000-memory.dmp

Filesize
120KB

Download
memory/1548-82-0x0000000070140000-0x0000000070494000-memory.dmp

Filesize
3.3MB

Download
memory/1548-93-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/1548-94-0x0000000007510000-0x00000000075B3000-memory.dmp

Filesize
652KB

Download
memory/1548-95-0x0000000007600000-0x000000000760A000-memory.dmp

Filesize
40KB

Download
memory/1548-96-0x0000000007DD0000-0x0000000007E66000-memory.dmp

Filesize
600KB

Download
memory/1548-97-0x0000000007610000-0x0000000007621000-memory.dmp

Filesize
68KB

Download
memory/1548-44-0x0000000004F60000-0x0000000004F82000-memory.dmp

Filesize
136KB

Download
memory/1548-43-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/1548-41-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/1548-102-0x0000000007650000-0x000000000765E000-memory.dmp

Filesize
56KB

Download
memory/1548-42-0x0000000005140000-0x0000000005768000-memory.dmp

Filesize
6.2MB

Download
memory/1548-104-0x0000000007670000-0x0000000007684000-memory.dmp

Filesize
80KB

Download
memory/1548-105-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/1548-106-0x00000000076A0000-0x00000000076A8000-memory.dmp

Filesize
32KB

Download
memory/1548-49-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download
memory/1548-66-0x0000000005940000-0x0000000005C94000-memory.dmp

Filesize
3.3MB

Download
memory/1548-40-0x0000000073D20000-0x00000000744D0000-memory.dmp

Filesize
7.7MB

Download
memory/1548-39-0x0000000002960000-0x0000000002996000-memory.dmp

Filesize
216KB

Download
memory/1548-70-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Filesize
304KB

Download
memory/1704-416-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3192-68-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/3192-67-0x0000000000400000-0x0000000000930000-memory.dmp

Filesize
5.2MB

Download
memory/3192-190-0x0000000000400000-0x0000000000930000-memory.dmp

Filesize
5.2MB

Download
memory/3540-408-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-440-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-419-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-422-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-431-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-434-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-437-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-428-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-443-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-446-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-449-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-452-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3540-425-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/3904-426-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3904-421-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4176-144-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/4176-132-0x0000000074680000-0x00000000746CC000-memory.dmp

Filesize
304KB

Download
memory/4176-117-0x0000000073E10000-0x00000000745C0000-memory.dmp

Filesize
7.7MB

Download
memory/4176-182-0x0000000073E10000-0x00000000745C0000-memory.dmp

Filesize
7.7MB

Download
memory/4176-168-0x0000000007800000-0x0000000007814000-memory.dmp

Filesize
80KB

Download
memory/4176-155-0x00000000077B0000-0x00000000077C1000-memory.dmp

Filesize
68KB

Download
memory/4176-127-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/4176-129-0x0000000004E40000-0x0000000004E50000-memory.dmp

Filesize
64KB

Download
memory/4176-131-0x000000007F5E0000-0x000000007F5F0000-memory.dmp

Filesize
64KB

Download
memory/4176-143-0x0000000007490000-0x0000000007533000-memory.dmp

Filesize
652KB

Download
memory/4176-128-0x0000000005B20000-0x0000000005E74000-memory.dmp

Filesize
3.3MB

Download
memory/4176-130-0x0000000006270000-0x00000000062BC000-memory.dmp

Filesize
304KB

Download
memory/4176-133-0x00000000702E0000-0x0000000070634000-memory.dmp

Filesize
3.3MB

Download
memory/4364-100-0x0000000002470000-0x0000000002570000-memory.dmp

Filesize
1024KB

Download
memory/4364-211-0x0000000000400000-0x00000000022D9000-memory.dmp

Filesize
30.8MB

Download
memory/4364-101-0x0000000003E10000-0x0000000003E37000-memory.dmp

Filesize
156KB

Download
memory/4364-363-0x0000000000400000-0x00000000022D9000-memory.dmp

Filesize
30.8MB

Download
memory/4364-145-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4364-103-0x0000000000400000-0x00000000022D9000-memory.dmp

Filesize
30.8MB

Download
memory/4404-191-0x0000000073E10000-0x00000000745C0000-memory.dmp

Filesize
7.7MB

Download
memory/4956-111-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/4956-113-0x0000000003FB0000-0x000000000489B000-memory.dmp

Filesize
8.9MB

Download
memory/4956-26-0x0000000003FB0000-0x000000000489B000-memory.dmp

Filesize
8.9MB

Download
memory/4956-28-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/4956-25-0x0000000003BA0000-0x0000000003FA3000-memory.dmp

Filesize
4.0MB

Download
memory/4956-99-0x0000000003BA0000-0x0000000003FA3000-memory.dmp

Filesize
4.0MB

Download
memory/5112-116-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download
memory/5112-115-0x0000000003ED0000-0x00000000047BB000-memory.dmp

Filesize
8.9MB

Download
memory/5112-114-0x0000000003AC0000-0x0000000003EC4000-memory.dmp

Filesize
4.0MB

Download
memory/5112-289-0x0000000000400000-0x0000000001E0F000-memory.dmp

Filesize
26.1MB

Download