Analysis

  • max time kernel
    78s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 05:55

General

  • Target

    d6567cc8e6b82d69347065de9fa8c7d2441ee63185ac52fe0e5e4bc6b2642910.exe

  • Size

    261KB

  • MD5

    270d3f441e678ec516527bf25c20023d

  • SHA1

    4664604103288d56244609208fd8de851a5599a0

  • SHA256

    d6567cc8e6b82d69347065de9fa8c7d2441ee63185ac52fe0e5e4bc6b2642910

  • SHA512

    b534d84edfd01c4e926b65ba0ddc6604954ef025a012ef6ae1c33e54ee912fcc9f206fd1b4f82247be2938c38716ee13f643d40da4a18290097d9459532cb8c1

  • SSDEEP

    3072:rHYuRgCFBQh1Sjw67WXFsFk3zXnE20P+UX/Ig5JiT+yx:DFw1SjBWVsGz3E/+QQAiT

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • DcRat 4 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 4 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 3 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 3 IoCs
  • Detects executables Discord URL observed in first stage droppers 3 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 3 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 3 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 3 IoCs
  • UPX dump on OEP (original entry point) 13 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6567cc8e6b82d69347065de9fa8c7d2441ee63185ac52fe0e5e4bc6b2642910.exe
    "C:\Users\Admin\AppData\Local\Temp\d6567cc8e6b82d69347065de9fa8c7d2441ee63185ac52fe0e5e4bc6b2642910.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4396
  • C:\Users\Admin\AppData\Local\Temp\BC2C.exe
    C:\Users\Admin\AppData\Local\Temp\BC2C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\BC2C.exe
      C:\Users\Admin\AppData\Local\Temp\BC2C.exe
      2⤵
      • DcRat
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      PID:4704
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\C303.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\C303.dll
      2⤵
      • Loads dropped DLL
      PID:1460
  • C:\Users\Admin\AppData\Local\Temp\D5EF.exe
    C:\Users\Admin\AppData\Local\Temp\D5EF.exe
    1⤵
    • Executes dropped EXE
    PID:440
  • C:\Users\Admin\AppData\Local\Temp\D8B0.exe
    C:\Users\Admin\AppData\Local\Temp\D8B0.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:3052
  • C:\Users\Admin\AppData\Local\Temp\E311.exe
    C:\Users\Admin\AppData\Local\Temp\E311.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\u12o.0.exe
        "C:\Users\Admin\AppData\Local\Temp\u12o.0.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        PID:4824
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 2148
          4⤵
          • Program crash
          PID:1984
      • C:\Users\Admin\AppData\Local\Temp\u12o.1.exe
        "C:\Users\Admin\AppData\Local\Temp\u12o.1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:452
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Windows\SysWOW64\chcp.com
            chcp 1251
            5⤵
              PID:4084
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
              5⤵
              • DcRat
              • Creates scheduled task(s)
              PID:3852
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1580
          3⤵
          • Program crash
          PID:5044
      • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
        "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4352
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:404
        • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
          "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
          3⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:4760
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            4⤵
              PID:2904
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                5⤵
                • Modifies Windows Firewall
                PID:4592
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
                PID:528
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                  PID:1800
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  4⤵
                    PID:1712
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                        PID:2584
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        5⤵
                        • DcRat
                        • Creates scheduled task(s)
                        PID:792
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        5⤵
                          PID:3372
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                            PID:548
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                              PID:3604
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              5⤵
                                PID:1716
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 752
                              4⤵
                              • Program crash
                              PID:2252
                      • C:\Users\Admin\AppData\Local\Temp\EEBA.exe
                        C:\Users\Admin\AppData\Local\Temp\EEBA.exe
                        1⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:4568
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1392 -ip 1392
                        1⤵
                          PID:528
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4824 -ip 4824
                          1⤵
                            PID:4488
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4848 -ip 4848
                            1⤵
                              PID:4204

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\ProgramData\Are.docx

                              Filesize

                              11KB

                              MD5

                              a33e5b189842c5867f46566bdbf7a095

                              SHA1

                              e1c06359f6a76da90d19e8fd95e79c832edb3196

                              SHA256

                              5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                              SHA512

                              f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                            • C:\ProgramData\mozglue.dll

                              Filesize

                              192KB

                              MD5

                              3034aefffccf930e8cb12578cbd21d63

                              SHA1

                              59005a981ad09abf45a6b0445d1cf6bd3d68b07d

                              SHA256

                              e479913f262e8f78c3cc2d681fc5572ec618e864c1c12859c5b481dd4c8600c9

                              SHA512

                              97dbac6b284851241e0b12f502b4c7b164b91cc2485cb51549d2d7022cc4c9079bcac6452568d5c70e1bfe5ac650558c49231308e74209b443673778d756458d

                            • C:\ProgramData\mozglue.dll

                              Filesize

                              593KB

                              MD5

                              c8fd9be83bc728cc04beffafc2907fe9

                              SHA1

                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                              SHA256

                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                              SHA512

                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                            • C:\ProgramData\nss3.dll

                              Filesize

                              320KB

                              MD5

                              4df2bf0ae4cdb77998d0c70281d3ca12

                              SHA1

                              935d164feabd42243aa34f96e8b6af39c93b6306

                              SHA256

                              e83d04c5b94f9228037452a4d98b9b495e9f0ccae61fd379bc6ca6819ce904d2

                              SHA512

                              bd8c22fbe054da820656e78eb1f00a2da810d99f31100efc47fc1182a24d014890a158fcd606a0beba011194620c4f9153f3be4b6acdd0c59858cd3d4a2c1138

                            • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                              Filesize

                              185KB

                              MD5

                              d37ebc874a255f1f295974ba757650b5

                              SHA1

                              acd897a324ed3d5a881e8acb9950ed0f475051b4

                              SHA256

                              228564164aac87f17e7ef3e4224073501870be47680b8722fdf3a530433fa7b6

                              SHA512

                              fe993d0823097d6ad135cd667d8f7b6db817779fed2b8ddba7a5ac76710bc38decbbe5ff7ffb6c2e5273fc5b9474df3c2b6c73e26016f35af2a03164b9cc88e7

                            • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                              Filesize

                              1.1MB

                              MD5

                              d435a1d6c92b350c824ace24f94d5b58

                              SHA1

                              2de65c5665e7cfbc18e90a58e778d34948a54eca

                              SHA256

                              94add31e627e99dfba3c4abd0159c0a6fba7736eb925e0829b185e1d148261be

                              SHA512

                              c3689a2a363277d5f57d6cd52de3e03a9add38a863d03f99ffce5769256d09c19bf5d0c10be7f5659b1bf0e95a7a5185dc37958d8e47a3fe04a57a067c037746

                            • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                              Filesize

                              832KB

                              MD5

                              a69d289e27bb41f53b03e7385747c0d6

                              SHA1

                              77123493d8b4d4830fda005e853e89b65cafd13f

                              SHA256

                              e03398b001bf897cb52e69d04d13c7ac1b7edbc2745f6ed9140fe3a8c7942357

                              SHA512

                              b600855e1080323aaf0c5ffb7913b8329adde7ef8b2441c6c07565b6d08cd0d6f6976db702aac992ca9ffe17af0a17bfa8ccd031a731557d1f6e8bf888195499

                            • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                              Filesize

                              1.9MB

                              MD5

                              621e14c27db223d3e37d71751c91f0e8

                              SHA1

                              5d89969cfbbf2ce485b14d8fc3bb2699b8139bb9

                              SHA256

                              32dc53571bc0971c09259932c4e53f7b0cd5493a029bc0ea9b1331a5126a6695

                              SHA512

                              e359e612d5ee593e8929992940e5514383ce42493eee923e9cae290d352e2abd696ee5d0cc6a7a702265556c61662562efc7f647542397991a06c17e076334bb

                            • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

                              Filesize

                              2.6MB

                              MD5

                              69272d604bcfc79a6cf9c8a117524e0a

                              SHA1

                              4c79237f6de3a3e0fb770157a83fb77923b43560

                              SHA256

                              40632a2f3dca03b4d56b7e4c8db05c054079c6de44c26579f9f4722270840cdb

                              SHA512

                              8aa579a6e603288afeb757b85f5cf72ea32e88c24100820fd890ff7fb0e6edb7b043c1d9adea0667c7912029293d723fea51fbaea6bb26d6e2170aed4c9d5ee6

                            • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

                              Filesize

                              5.0MB

                              MD5

                              68ebfe26368a940eaef266d56903cb89

                              SHA1

                              4d6c23115cc5e1c80ca6c3fccf65d1caf49993c1

                              SHA256

                              54edfd8a8e37d3dc86818e62f3b5d1b78ec53f02a67942637dbf012a507f8e9a

                              SHA512

                              6a3a539d151695a952bec28a8c847b948259e04f6d89417cbb93b03fc3b1dcc40655cfa063c016f5afec10b60b14aef1f6331159ead268eab0e3e71cc7168041

                            • C:\Users\Admin\AppData\Local\Temp\BC2C.exe

                              Filesize

                              1.9MB

                              MD5

                              398ab69b1cdc624298fbc00526ea8aca

                              SHA1

                              b2c76463ae08bb3a08accfcbf609ec4c2a9c0821

                              SHA256

                              ca827a18753cf8281d57b7dff32488c0701fe85af56b59eab5a619ae45b5f0be

                              SHA512

                              3b222a46a8260b7810e2e6686b7c67b690452db02ed1b1e75990f4ac1421ead9ddc21438a419010169258b1ae4b206fbfa22bb716b83788490b7737234e42739

                            • C:\Users\Admin\AppData\Local\Temp\C303.dll

                              Filesize

                              1.9MB

                              MD5

                              dc1426e7dd017041559c858755cc780d

                              SHA1

                              3a7422e0dfb734a55cbfddef2ab20ad1c20451d2

                              SHA256

                              740a8baa7a93d6a7e1f515318d8f77fbed0606534b6666186da3f5395177461c

                              SHA512

                              05a237a6c3ab06397da8bda1a2eeee4af0bda1ad5083864af6d9b0e1b3a94ba0040561db16acdd78f497166cfe835d7ea32d368f752f58cccd1db7f4241790e4

                            • C:\Users\Admin\AppData\Local\Temp\C303.dll

                              Filesize

                              1.8MB

                              MD5

                              cc1d3fe7bb167fe18d8a40924e63dee9

                              SHA1

                              317495a3d8c1fa6c8424e416327b941e6bf7947f

                              SHA256

                              b48ca9c104c7415f3041524b8261f66dd7914257f1ebf3d80386e69cc79177e3

                              SHA512

                              e3057926ab3d8de6ffc8913c8de92bf1e5edaa16f4931c21b6180e70bfcda24f707cd1852fefb137d677cbba004d25905dfbba892226b1b4a7a1e45a12279d62

                            • C:\Users\Admin\AppData\Local\Temp\C303.dll

                              Filesize

                              2.0MB

                              MD5

                              9b1697d40dfd386fdd7e9327844f301a

                              SHA1

                              e75defb119e2c7b7d3f75ab70a100ec504af5ebf

                              SHA256

                              69e7b08c127dde5fd1f85e1e8107d06aa686e94aef3fd48ff0bb092b38a0cb1d

                              SHA512

                              3e945bf24ed81fdc49e974d086a70f9758a17b8656bb0e460dca0be2a84fa0ba065b62b6dd5d55ca1dbe0b4f19ec4f164df84c115244f1cbfddd79611d013d69

                            • C:\Users\Admin\AppData\Local\Temp\D5EF.exe

                              Filesize

                              1.6MB

                              MD5

                              848b1147d8236710ac109f4d231f46d8

                              SHA1

                              9534ecb534f6eb327c160c203b57bb6b7e6b55ca

                              SHA256

                              791dcd000c5f65ddcf357898a806428d96e0c1a459797bcecea0314c529f7351

                              SHA512

                              624160e20eeca9644e14fd0b107fc12540a37502314187a26bf8b4d3f37c0afbf83bdd0c62ddea3d0cf9f84184cd2ad5407d491247315e0f047d0778aea6d823

                            • C:\Users\Admin\AppData\Local\Temp\D5EF.exe

                              Filesize

                              2.9MB

                              MD5

                              7d6ff218d036991e25d3e4addd1683a4

                              SHA1

                              a550ffc5db9985efbf385454893e8247b3093c6f

                              SHA256

                              bdee967eefcefe7aa09b0b306816701d2c5844bad81eb9c30018c4443803c03b

                              SHA512

                              73c926a58da46807a6da5ffcafdb06c4a067d427cb5276a5f9795eaf8c227104658019b5d047e2c3146e8bf9c92b925f5041de491ad48cbd8d68e77411175216

                            • C:\Users\Admin\AppData\Local\Temp\D8B0.exe

                              Filesize

                              554KB

                              MD5

                              a1b5ee1b9649ab629a7ac257e2392f8d

                              SHA1

                              dc1b14b6d57589440fb3021c9e06a3e3191968dc

                              SHA256

                              2bfd95260a4c52d4474cd51e74469fc3de94caed28937ff0ce99ded66af97e65

                              SHA512

                              50ccbb9fd4ea2da847c6be5988e1e82e28d551b06cc9122b921dbd40eff4b657a81a010cea76f29e88fda06f8c053090b38d04eb89a6d63ec4f42ef68b1cf82b

                            • C:\Users\Admin\AppData\Local\Temp\D8B0.exe

                              Filesize

                              512KB

                              MD5

                              f2d9c4e85e5f9987c9762860e12fd804

                              SHA1

                              16350d9eae3690e40303f60dd508384b049a4150

                              SHA256

                              f101090194e3e95bcca3cef9f25564a40c1dbb950729040ae03fef4a4db38315

                              SHA512

                              71eda687f46e774197fe7fa2d630765b7139104fab348308577bd4cf52adcc56e0ffbc442e7683577aa84a144cc7ec97c28c8f7b43b1dc1881f311fb760157a8

                            • C:\Users\Admin\AppData\Local\Temp\E311.exe

                              Filesize

                              1.7MB

                              MD5

                              dc223f6ce4c1d7ff421701a415e1cc76

                              SHA1

                              2b5c193ad484287fd0a9897a06e4eb04dec6d2d7

                              SHA256

                              e326bae5f103f52cbc175b84b986fb9c3e279b60d1941369a17d7666972f145b

                              SHA512

                              a0edf6527131a567c81d3a5d09d4691c5099126f84bf97727afbf93f733ec4ff7dbba81b3fc44945e097df5e170eaa7088596afb6b4a076a42eccf047548b67e

                            • C:\Users\Admin\AppData\Local\Temp\E311.exe

                              Filesize

                              2.0MB

                              MD5

                              23996f5917e939a08a336ce049b1a842

                              SHA1

                              53b781cdee8a125c779959640a910a6f08908bd2

                              SHA256

                              16815e667fa4115c008ffb57771b63ab2b594b12fb34d631508bfbe4da376f4c

                              SHA512

                              28a67f92bffa4fd4915a279156138e48fb5addbcf30290b13aec29a2cbfd65796760370c134d7a214c0b1191088ab28efc52428074edc97ab004229452a26d3e

                            • C:\Users\Admin\AppData\Local\Temp\EEBA.exe

                              Filesize

                              176KB

                              MD5

                              0c3f7f76be32866fafcf1b1d26b831c3

                              SHA1

                              d7bb7e9437e922de417ce9e9102d2ee6cba7e9e7

                              SHA256

                              454e17045a7dd1a6a36dc0a8dcf5dfeebcd0ea36436c94d793de80bd9f150fe2

                              SHA512

                              a09084ab2dd088b85b2dbce2e4973c91a372898eda91419c1a79058a53742cced45d87b1c67b2e8c5528c333a2bf0e16d005edcdf33da40626c3c7b07933ad1d

                            • C:\Users\Admin\AppData\Local\Temp\InstallSetup_four.exe

                              Filesize

                              380KB

                              MD5

                              0564a9bf638169a89ccb3820a6b9a58e

                              SHA1

                              57373f3b58f7cc2b9ea1808bdabb600d580a9ceb

                              SHA256

                              9e4b0556f698c9bc9a07c07bf13d60908d31995e0bd73510d9dd690b20b11058

                              SHA512

                              36b81c374529a9ba5fcbc6fcfebf145c27a7c30916814d63612c04372556d47994a8091cdc5f78dab460bb5296466ce0b284659c8b01883f7960ab08a1631ea6

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_klbl3ur4.koc.ps1

                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                              Filesize

                              281KB

                              MD5

                              d98e33b66343e7c96158444127a117f6

                              SHA1

                              bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                              SHA256

                              5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                              SHA512

                              705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                            • C:\Users\Admin\AppData\Local\Temp\u12o.0.exe

                              Filesize

                              206KB

                              MD5

                              d0de3ce247b4ebb9b0778563f7bb3a47

                              SHA1

                              20259867152e73d0027da63f8c351c4e911690ca

                              SHA256

                              de333c544b3def02e10b7a8d1c3677efbcbb010ecce2b601573dae1584b9cc1f

                              SHA512

                              3811fe4864c154ee020a6c158557e1d42e8ef954c836192acb19241343ad01a2c21e69960f4780b5e2404bf963de0e51cf01fe0ed2b012c8cbec95b36c21661d

                            • C:\Users\Admin\AppData\Local\Temp\u12o.1.exe

                              Filesize

                              1.2MB

                              MD5

                              c5e7334ac8b8e435fa5b16fe87a8a2a5

                              SHA1

                              4ad9b72f59400fcbb160433e274336a74639c644

                              SHA256

                              9d57dc99061507df3c7bd4081a650cd0dbac6c10c8954f6b17ae97380d939432

                              SHA512

                              f4480e52d0aabdec94d2587acea030921085e2b3d7f2174aac65cf7cfe093a9ce17651303969372235558ff2469b4ba1f8edf736a02a9e75d2086785f8f90fb0

                            • C:\Users\Admin\AppData\Local\Temp\u12o.1.exe

                              Filesize

                              1.7MB

                              MD5

                              5b87828ea000c7111084d8beed17175e

                              SHA1

                              e8aa3848e39c449051702a333e608fafd2e5330f

                              SHA256

                              1a557fae2d39d06392f4bea760fb72c87f0959a7c3ac66865e36f316866f57d3

                              SHA512

                              56b0d0e5422b89a4659969f59570962dbb267fde913ed051fbedf3d66653c9c23d15c945a6ae8ce5570af010b3671eb0be085e8afb44c3088def9f423290f385

                            • C:\Users\Admin\AppData\Local\Temp\u12o.1.exe

                              Filesize

                              1.6MB

                              MD5

                              06246d5f1675d0680bccaa82ae2b26fd

                              SHA1

                              a73d03970a916cfcd6108e042149eadc54b940eb

                              SHA256

                              c8a160c92eda31a919466f81f8828eaaa9091f1d66830376e33b32dde7178579

                              SHA512

                              57fa90a31f7f7e0cffc3b3e7f0dd23d240c1843cdf98da4e587efb8f0b9ab30649995a7dac4a2d57cac46a918f573402dab61d0d3d7fd89b474535ac8b644ad2

                            • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                              Filesize

                              128B

                              MD5

                              11bb3db51f701d4e42d3287f71a6a43e

                              SHA1

                              63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                              SHA256

                              6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                              SHA512

                              907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                              Filesize

                              2KB

                              MD5

                              968cb9309758126772781b83adb8a28f

                              SHA1

                              8da30e71accf186b2ba11da1797cf67f8f78b47c

                              SHA256

                              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                              SHA512

                              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                              Filesize

                              19KB

                              MD5

                              7011eee5aae307248e34b80d8c0f47a8

                              SHA1

                              5cc6e13e9a2673a30bd9547dac413b1586b57e5a

                              SHA256

                              090ec5cf802efbb5e8edc439f5a15d60572c341ae7ec5e03077a4781ebc69423

                              SHA512

                              6a1f0322e1bf3337298fd6ff1591ebb16d935db0708728be30d13951af77b135be15ed43c805f45ee5cb97b98e363c9630c0dd275460e4474480a1d5252c9664

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                              Filesize

                              19KB

                              MD5

                              6c9ba9f7fee02f83092260ba510a6bda

                              SHA1

                              062fb40a0d58e08c902f99b012636138547646c6

                              SHA256

                              01f801f795ad666ddb17faaf36a8a56617b0d797d36479cb9fd5c294e4a0d5dc

                              SHA512

                              b0ee7230ff661da3f850b1371a040d9b14812bf4b67ecde0093ffccd834390258476b6249bc95289f503f772cfff046374d5558af8eb92986a43ec45210b9866

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                              Filesize

                              19KB

                              MD5

                              dc8c2451eaeb60693d67b7c6a4a824eb

                              SHA1

                              e0f5db63b54afe530a858f50550f209ac5d0150b

                              SHA256

                              d06799dc1f60cc359a72462c5332437c9381cbd07e4bb8fa61e1e752d09d7d0d

                              SHA512

                              50b195cfd819a1cdd4d9d5f8962bc466232e9359c51ddb4302c2696d377be9e75d32cb0ec99947cad68e460dacf6081374a612158cee5f55f263940a4e3bc1e0

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                              Filesize

                              19KB

                              MD5

                              31ee428f8ec83113c318a3159fd712a4

                              SHA1

                              19e4ec4235d44a45aa33fab528a9ae19afeab786

                              SHA256

                              3da6f96dfbd08c9c9903bc7cc6c356b06853140ded272cb44177a99b56121994

                              SHA512

                              7cc9999e4091398f537e499cd47e11cc2cac8d014255ae4e56b6ce80ac93177b2632836685c894a6f9a332269d4707953a8c34fb04bea0d7b86e3c9794b94f80

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                              Filesize

                              19KB

                              MD5

                              fcfb3e9117e6aabae05b38a8afd3943a

                              SHA1

                              2d2e95a76f11ba24fd0e88097c98e0a4dfcab0e4

                              SHA256

                              5c915dcf6c56622d43c79aabeb40ecae4e2544312907c367adaa632b1972f21c

                              SHA512

                              12a48a786a9cb3a5fb083e111706abe426500adf0492a9dbfebe1907e4524e1e3dc0cbb82d9036d1f3b5a1e70dcd0ee709f2e9c22b3e15e4ee6f9c143b226f5a

                            • C:\Windows\rss\csrss.exe

                              Filesize

                              4.1MB

                              MD5

                              0c7b8daa9b09bcdf947a020bf28c2f19

                              SHA1

                              738f89f4da5256d14fe11394cf79e42060a7e98b

                              SHA256

                              ff0c709f06a8850794f2501c7dc9ce4ffc75f1ab3039218952cd87a067d3d3ff

                              SHA512

                              b069ef6d30a5afafc4b4e2632cb4f9da65e58dcedb66706921d85a6be97a024c1e786ec51299ba52668a65fe948d499609aa2b4978fb20738dd0b643d84cbcf6

                            • memory/404-204-0x0000000006B60000-0x0000000006BA4000-memory.dmp

                              Filesize

                              272KB

                            • memory/404-230-0x0000000008020000-0x000000000869A000-memory.dmp

                              Filesize

                              6.5MB

                            • memory/404-289-0x0000000007CE0000-0x0000000007CF1000-memory.dmp

                              Filesize

                              68KB

                            • memory/404-280-0x0000000007D60000-0x0000000007DF6000-memory.dmp

                              Filesize

                              600KB

                            • memory/404-276-0x0000000007C90000-0x0000000007C9A000-memory.dmp

                              Filesize

                              40KB

                            • memory/404-274-0x000000007F2B0000-0x000000007F2C0000-memory.dmp

                              Filesize

                              64KB

                            • memory/404-275-0x0000000007BC0000-0x0000000007C63000-memory.dmp

                              Filesize

                              652KB

                            • memory/404-271-0x0000000007B40000-0x0000000007B5E000-memory.dmp

                              Filesize

                              120KB

                            • memory/404-261-0x0000000071410000-0x0000000071764000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/404-260-0x0000000073360000-0x00000000733AC000-memory.dmp

                              Filesize

                              304KB

                            • memory/404-258-0x0000000007B80000-0x0000000007BB2000-memory.dmp

                              Filesize

                              200KB

                            • memory/404-231-0x00000000079C0000-0x00000000079DA000-memory.dmp

                              Filesize

                              104KB

                            • memory/404-226-0x0000000007920000-0x0000000007996000-memory.dmp

                              Filesize

                              472KB

                            • memory/404-225-0x0000000003160000-0x0000000003170000-memory.dmp

                              Filesize

                              64KB

                            • memory/404-181-0x0000000006690000-0x00000000066DC000-memory.dmp

                              Filesize

                              304KB

                            • memory/404-180-0x0000000005370000-0x000000000538E000-memory.dmp

                              Filesize

                              120KB

                            • memory/404-175-0x0000000005FE0000-0x0000000006334000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/404-169-0x0000000005F70000-0x0000000005FD6000-memory.dmp

                              Filesize

                              408KB

                            • memory/404-168-0x0000000005790000-0x00000000057F6000-memory.dmp

                              Filesize

                              408KB

                            • memory/404-167-0x00000000054E0000-0x0000000005502000-memory.dmp

                              Filesize

                              136KB

                            • memory/404-165-0x0000000003160000-0x0000000003170000-memory.dmp

                              Filesize

                              64KB

                            • memory/404-164-0x0000000003160000-0x0000000003170000-memory.dmp

                              Filesize

                              64KB

                            • memory/404-163-0x00000000721D0000-0x0000000072980000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/404-161-0x0000000005840000-0x0000000005E68000-memory.dmp

                              Filesize

                              6.2MB

                            • memory/404-157-0x0000000002FE0000-0x0000000003016000-memory.dmp

                              Filesize

                              216KB

                            • memory/440-138-0x0000000000280000-0x0000000000B71000-memory.dmp

                              Filesize

                              8.9MB

                            • memory/440-49-0x0000000000280000-0x0000000000B71000-memory.dmp

                              Filesize

                              8.9MB

                            • memory/440-52-0x00000000010A0000-0x00000000010A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/440-224-0x00000000010B0000-0x00000000010B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/440-64-0x00000000010B0000-0x00000000010B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/440-65-0x00000000010B0000-0x00000000010B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/440-63-0x00000000010B0000-0x00000000010B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/440-66-0x00000000010B0000-0x00000000010B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/452-166-0x0000000000400000-0x0000000000930000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/452-137-0x0000000000E00000-0x0000000000E01000-memory.dmp

                              Filesize

                              4KB

                            • memory/452-136-0x0000000000400000-0x0000000000930000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/1392-140-0x0000000000400000-0x0000000001A4B000-memory.dmp

                              Filesize

                              22.3MB

                            • memory/1392-94-0x0000000000400000-0x0000000001A4B000-memory.dmp

                              Filesize

                              22.3MB

                            • memory/1392-91-0x0000000001B40000-0x0000000001C40000-memory.dmp

                              Filesize

                              1024KB

                            • memory/1392-92-0x00000000035C0000-0x0000000003627000-memory.dmp

                              Filesize

                              412KB

                            • memory/1400-93-0x0000000074020000-0x00000000747D0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1400-59-0x0000000074020000-0x00000000747D0000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/1400-58-0x0000000000D30000-0x00000000011BC000-memory.dmp

                              Filesize

                              4.5MB

                            • memory/1460-79-0x0000000002350000-0x0000000002478000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/1460-86-0x0000000010000000-0x0000000010202000-memory.dmp

                              Filesize

                              2.0MB

                            • memory/1460-29-0x0000000010000000-0x0000000010202000-memory.dmp

                              Filesize

                              2.0MB

                            • memory/1460-27-0x0000000000710000-0x0000000000716000-memory.dmp

                              Filesize

                              24KB

                            • memory/1460-96-0x0000000002480000-0x000000000258D000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1460-100-0x0000000002480000-0x000000000258D000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/1460-109-0x0000000002480000-0x000000000258D000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/2932-17-0x0000000003AB0000-0x0000000003C67000-memory.dmp

                              Filesize

                              1.7MB

                            • memory/2932-16-0x00000000038E0000-0x0000000003AA3000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/3052-45-0x0000000001AB0000-0x0000000001BB0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/3052-102-0x0000000000400000-0x0000000001A77000-memory.dmp

                              Filesize

                              22.5MB

                            • memory/3052-132-0x0000000001AB0000-0x0000000001BB0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/3052-47-0x0000000000400000-0x0000000001A77000-memory.dmp

                              Filesize

                              22.5MB

                            • memory/3052-48-0x0000000000400000-0x0000000001A77000-memory.dmp

                              Filesize

                              22.5MB

                            • memory/3052-135-0x0000000000400000-0x0000000001A77000-memory.dmp

                              Filesize

                              22.5MB

                            • memory/3052-46-0x00000000036D0000-0x000000000373B000-memory.dmp

                              Filesize

                              428KB

                            • memory/3488-155-0x0000000007F10000-0x0000000007F26000-memory.dmp

                              Filesize

                              88KB

                            • memory/3488-4-0x0000000002990000-0x00000000029A6000-memory.dmp

                              Filesize

                              88KB

                            • memory/4352-216-0x0000000000400000-0x0000000001E0F000-memory.dmp

                              Filesize

                              26.1MB

                            • memory/4352-101-0x0000000004040000-0x000000000492B000-memory.dmp

                              Filesize

                              8.9MB

                            • memory/4352-98-0x0000000003C30000-0x0000000004037000-memory.dmp

                              Filesize

                              4.0MB

                            • memory/4352-110-0x0000000000400000-0x0000000001E0F000-memory.dmp

                              Filesize

                              26.1MB

                            • memory/4352-142-0x0000000000400000-0x0000000001E0F000-memory.dmp

                              Filesize

                              26.1MB

                            • memory/4396-2-0x0000000001C90000-0x0000000001C9B000-memory.dmp

                              Filesize

                              44KB

                            • memory/4396-3-0x0000000000400000-0x0000000001A2E000-memory.dmp

                              Filesize

                              22.2MB

                            • memory/4396-5-0x0000000000400000-0x0000000001A2E000-memory.dmp

                              Filesize

                              22.2MB

                            • memory/4396-1-0x0000000001D20000-0x0000000001E20000-memory.dmp

                              Filesize

                              1024KB

                            • memory/4568-149-0x0000000000400000-0x00000000022D4000-memory.dmp

                              Filesize

                              30.8MB

                            • memory/4568-159-0x0000000000400000-0x00000000022D4000-memory.dmp

                              Filesize

                              30.8MB

                            • memory/4568-147-0x00000000023C0000-0x00000000024C0000-memory.dmp

                              Filesize

                              1024KB

                            • memory/4568-148-0x0000000002360000-0x000000000236B000-memory.dmp

                              Filesize

                              44KB

                            • memory/4704-31-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-23-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-114-0x0000000002FD0000-0x00000000030DD000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4704-153-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-103-0x0000000002EA0000-0x0000000002FC8000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/4704-28-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-33-0x0000000000B60000-0x0000000000B66000-memory.dmp

                              Filesize

                              24KB

                            • memory/4704-111-0x0000000002FD0000-0x00000000030DD000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4704-25-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-117-0x0000000002FD0000-0x00000000030DD000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/4704-21-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-18-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4704-131-0x0000000000400000-0x0000000000848000-memory.dmp

                              Filesize

                              4.3MB

                            • memory/4824-156-0x00000000023F0000-0x0000000002417000-memory.dmp

                              Filesize

                              156KB

                            • memory/4824-182-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                              Filesize

                              972KB

                            • memory/4824-154-0x0000000002480000-0x0000000002580000-memory.dmp

                              Filesize

                              1024KB

                            • memory/4824-152-0x0000000000400000-0x00000000022DC000-memory.dmp

                              Filesize

                              30.9MB

                            • memory/4824-162-0x0000000000400000-0x00000000022DC000-memory.dmp

                              Filesize

                              30.9MB