Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2024 21:43
Static task
static1
Behavioral task
behavioral1
Sample
b32cc9e43da80b1981137666a852e9d1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b32cc9e43da80b1981137666a852e9d1.exe
Resource
win10v2004-20240226-en
General
-
Target
b32cc9e43da80b1981137666a852e9d1.exe
-
Size
3.2MB
-
MD5
b32cc9e43da80b1981137666a852e9d1
-
SHA1
81a2553ccf86657e0930ed64cb2778dbd3c02bf6
-
SHA256
2aafe51ed875d14265117e71337eaf72d2d22f8055ad43356062efbde0eb6f4a
-
SHA512
b73cb96beb320a439bbe46f2bc47ee1d483702ecef59547cf1d58d7cc4cbcaf98dffde1e7476744477decfe016070d62a2ce0b5ce2edce5075f9a9a86fdca4ef
-
SSDEEP
49152:EgmXHsGWTHsqe+UWfjixyAupVgDrlDQ9psVFd6AgcKNJ8b1lcFBCyxeRMshbWtO:J4KH5FVSQ9AHgh8bSCyECEWtO
Malware Config
Extracted
nullmixer
http://motiwa.xyz/
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
pub6
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
redline
Cana
176.111.174.254:56328
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
Detect Fabookie payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_4.exe family_fabookie C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_4.txt family_fabookie -
Processes:
arnatic_5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection arnatic_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" arnatic_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" arnatic_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" arnatic_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" arnatic_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" arnatic_5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" arnatic_5.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2652-129-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral2/memory/1456-153-0x0000000002680000-0x00000000026A0000-memory.dmp family_redline behavioral2/memory/1456-169-0x00000000029D0000-0x00000000029EE000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2652-129-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral2/memory/1456-153-0x0000000002680000-0x00000000026A0000-memory.dmp family_sectoprat behavioral2/memory/1456-169-0x00000000029D0000-0x00000000029EE000-memory.dmp family_sectoprat behavioral2/memory/2652-190-0x0000000005600000-0x0000000005610000-memory.dmp family_sectoprat behavioral2/memory/1456-200-0x0000000005070000-0x0000000005080000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Nirsoft 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3212-114-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral2/memory/4356-168-0x0000000000400000-0x0000000000422000-memory.dmp Nirsoft -
Vidar Stealer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1852-151-0x0000000002570000-0x000000000260D000-memory.dmp family_vidar behavioral2/memory/1852-152-0x0000000000400000-0x000000000094C000-memory.dmp family_vidar behavioral2/memory/1852-182-0x0000000000400000-0x000000000094C000-memory.dmp family_vidar behavioral2/memory/1852-183-0x0000000002570000-0x000000000260D000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libcurl.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
arnatic_3.exeb32cc9e43da80b1981137666a852e9d1.exesetup_installer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation arnatic_3.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation b32cc9e43da80b1981137666a852e9d1.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation setup_installer.exe -
Executes dropped EXE 12 IoCs
Processes:
setup_installer.exesetup_install.exearnatic_1.exearnatic_2.exearnatic_3.exearnatic_5.exearnatic_6.exearnatic_4.exearnatic_7.exejfiag3g_gg.exearnatic_6.exejfiag3g_gg.exepid process 208 setup_installer.exe 3632 setup_install.exe 1852 arnatic_1.exe 1900 arnatic_2.exe 1412 arnatic_3.exe 4220 arnatic_5.exe 3368 arnatic_6.exe 3492 arnatic_4.exe 1456 arnatic_7.exe 3212 jfiag3g_gg.exe 2652 arnatic_6.exe 4356 jfiag3g_gg.exe -
Loads dropped DLL 8 IoCs
Processes:
setup_install.exerUNdlL32.eXearnatic_2.exepid process 3632 setup_install.exe 3632 setup_install.exe 3632 setup_install.exe 3632 setup_install.exe 3632 setup_install.exe 3632 setup_install.exe 1600 rUNdlL32.eXe 1900 arnatic_2.exe -
Processes:
resource yara_rule behavioral2/memory/3212-111-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral2/memory/3212-114-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx behavioral2/memory/4356-168-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/1456-196-0x0000000005070000-0x0000000005080000-memory.dmp upx -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 113 ipinfo.io 21 ip-api.com 112 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
Processes:
arnatic_6.exedescription pid process target process PID 3368 set thread context of 2652 3368 arnatic_6.exe arnatic_6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3100 3632 WerFault.exe setup_install.exe 3980 1600 WerFault.exe rUNdlL32.eXe 2144 1852 WerFault.exe arnatic_1.exe 4528 1900 WerFault.exe arnatic_2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
arnatic_2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe -
Modifies registry class 3 IoCs
Processes:
arnatic_3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ arnatic_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
arnatic_2.exejfiag3g_gg.exepid process 1900 arnatic_2.exe 1900 arnatic_2.exe 4356 jfiag3g_gg.exe 4356 jfiag3g_gg.exe 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 3540 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
arnatic_2.exepid process 1900 arnatic_2.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
arnatic_6.exearnatic_6.exearnatic_7.exedescription pid process Token: SeDebugPrivilege 3368 arnatic_6.exe Token: SeDebugPrivilege 2652 arnatic_6.exe Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeDebugPrivilege 1456 arnatic_7.exe Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 Token: SeShutdownPrivilege 3540 Token: SeCreatePagefilePrivilege 3540 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 3540 3540 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b32cc9e43da80b1981137666a852e9d1.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exearnatic_6.exearnatic_4.exearnatic_3.exedescription pid process target process PID 756 wrote to memory of 208 756 b32cc9e43da80b1981137666a852e9d1.exe setup_installer.exe PID 756 wrote to memory of 208 756 b32cc9e43da80b1981137666a852e9d1.exe setup_installer.exe PID 756 wrote to memory of 208 756 b32cc9e43da80b1981137666a852e9d1.exe setup_installer.exe PID 208 wrote to memory of 3632 208 setup_installer.exe setup_install.exe PID 208 wrote to memory of 3632 208 setup_installer.exe setup_install.exe PID 208 wrote to memory of 3632 208 setup_installer.exe setup_install.exe PID 3632 wrote to memory of 1652 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1652 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1652 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1760 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1760 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1760 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 3348 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 3348 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 3348 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 448 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 448 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 448 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 4420 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 4420 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 4420 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 3708 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 3708 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 3708 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1480 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1480 3632 setup_install.exe cmd.exe PID 3632 wrote to memory of 1480 3632 setup_install.exe cmd.exe PID 1652 wrote to memory of 1852 1652 cmd.exe arnatic_1.exe PID 1652 wrote to memory of 1852 1652 cmd.exe arnatic_1.exe PID 1652 wrote to memory of 1852 1652 cmd.exe arnatic_1.exe PID 1760 wrote to memory of 1900 1760 cmd.exe arnatic_2.exe PID 1760 wrote to memory of 1900 1760 cmd.exe arnatic_2.exe PID 1760 wrote to memory of 1900 1760 cmd.exe arnatic_2.exe PID 3348 wrote to memory of 1412 3348 cmd.exe arnatic_3.exe PID 3348 wrote to memory of 1412 3348 cmd.exe arnatic_3.exe PID 3348 wrote to memory of 1412 3348 cmd.exe arnatic_3.exe PID 4420 wrote to memory of 4220 4420 cmd.exe arnatic_5.exe PID 4420 wrote to memory of 4220 4420 cmd.exe arnatic_5.exe PID 4420 wrote to memory of 4220 4420 cmd.exe arnatic_5.exe PID 448 wrote to memory of 3492 448 cmd.exe arnatic_4.exe PID 448 wrote to memory of 3492 448 cmd.exe arnatic_4.exe PID 448 wrote to memory of 3492 448 cmd.exe arnatic_4.exe PID 3708 wrote to memory of 3368 3708 cmd.exe arnatic_6.exe PID 3708 wrote to memory of 3368 3708 cmd.exe arnatic_6.exe PID 3708 wrote to memory of 3368 3708 cmd.exe arnatic_6.exe PID 1480 wrote to memory of 1456 1480 cmd.exe arnatic_7.exe PID 1480 wrote to memory of 1456 1480 cmd.exe arnatic_7.exe PID 1480 wrote to memory of 1456 1480 cmd.exe arnatic_7.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3492 wrote to memory of 3212 3492 arnatic_4.exe jfiag3g_gg.exe PID 3492 wrote to memory of 3212 3492 arnatic_4.exe jfiag3g_gg.exe PID 3492 wrote to memory of 3212 3492 arnatic_4.exe jfiag3g_gg.exe PID 1412 wrote to memory of 1600 1412 arnatic_3.exe rUNdlL32.eXe PID 1412 wrote to memory of 1600 1412 arnatic_3.exe rUNdlL32.eXe PID 1412 wrote to memory of 1600 1412 arnatic_3.exe rUNdlL32.eXe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3368 wrote to memory of 2652 3368 arnatic_6.exe arnatic_6.exe PID 3492 wrote to memory of 4356 3492 arnatic_4.exe jfiag3g_gg.exe PID 3492 wrote to memory of 4356 3492 arnatic_4.exe jfiag3g_gg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b32cc9e43da80b1981137666a852e9d1.exe"C:\Users\Admin\AppData\Local\Temp\b32cc9e43da80b1981137666a852e9d1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 17726⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 3966⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_3.exearnatic_3.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 6167⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_5.exearnatic_5.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_6.exeC:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_6.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 5444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3632 -ip 36321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1600 -ip 16001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1852 -ip 18521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1900 -ip 19001⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arnatic_6.exe.logFilesize
847B
MD5f8ec7f563d06ccddddf6c96b8957e5c8
SHA173bdc49dcead32f8c29168645a0f080084132252
SHA25638ef57aec780edd2c8dab614a85ce87351188fce5896ffebc9f69328df2056ed
SHA5128830821ac9edb4cdf4d8a3d7bc30433987ae4c158cf81b705654f54aaeba366c5fa3509981aceae21e193dd4483f03b9d449bc0a32545927d3ca94b0f9367684
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_1.exeFilesize
512KB
MD526a327f3122a05961a9fef0629340e8b
SHA1aa499e35d09fe35ed983621dd7f6a2cbfc292dab
SHA256346629f584dfe6f2ccd474c95e42912bc4197c910a861790abeb048c71cb2803
SHA5128b3ad8e149dd838e748d3a38025aeb489a39a228f396ba6496536dc990a40d36815e044d3f6b45acb33066d41abc33b9e1b56362c1518de097c9764401c192b6
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_1.txtFilesize
699KB
MD518fd29a7113a43375058a2788177b0ee
SHA186d2df734704de865027f6cbfbc8e5a329990fb5
SHA256088df39953be8f10f9f92ecc00b2ecb3f21bf987ddbab78b684b7760ac1b9559
SHA512c6d376890e79040b47b86b673b970cbc9606d6f5f8a11fb2ec2e3d370d44ec8d9347852d6273fa051c0f26d73cadc9312818a23a9c998cc5aa3b98dd01877688
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_2.exeFilesize
357KB
MD5a0bfcb8ec26241f757476666ffb75188
SHA1e4b15098749249b0cc5428539f1de363d45c6e2a
SHA256a38993115d134eb6ada769257879b1737f66920e30908c07ce55bf9cdbbb5ba7
SHA512ebd21c2a96ba740105dd1e33e50436829ae94d513d2495fdd550912ff428a4f78d9705ba8f023dd525c850c7a1237a23201f4702c1ce1ebf0f6772ceddb58efd
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_3.exeFilesize
680KB
MD57837314688b7989de1e8d94f598eb2dd
SHA1889ae8ce433d5357f8ea2aff64daaba563dc94e3
SHA256d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
SHA5123df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_4.exeFilesize
448KB
MD55ff5dddd26e60ceb0f250735ed9aaa27
SHA1c75374f2f249a46be93ab19767c4211b15b004c8
SHA256bf7cd85dc58080722fed3d7337c0fd6fb629f3eaeb165147bb9c4a4cde2b50d4
SHA512008ee7e55c6847eca26f41185b8ba7254f0ebe3ef75b286e74b773fa0efe10f377b387d5e5cd343103f4d259a83c1d90eb71cdb6da39097880c861eb3ae10da3
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_4.txtFilesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_5.exeFilesize
765KB
MD533d711ccfe4a4e9cbd37c99e25c13769
SHA1781e0cdc5b1c72f217f54bedd2c2862c73604e89
SHA2565d500524991ad1e6178b097b7ee5e270eef3710115b72a424b7fb2643490f992
SHA5122de7c4e5672f52da356ba80e132d9eb93a51290d43ebbe35471a72c2872ab7648880f0240ea94b0fce27d604c1a45964ab50ebe7256403900b22d7a59e0160c5
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_6.exeFilesize
320KB
MD53512f7ca31cdbd7b295805159436adcc
SHA1d12a299fcb0ecfb47f2e44b02525c97236b12243
SHA256d490a501b8e13976b5e8893bae02d0f379c5ad6b4751c54b521d0b202f6dfc9b
SHA512445a6f6b093c6cff51f41d13b56446de445c03f1c8fd8aa269bae17adc2228750a58f0c512db9ca05cf162282c3eb4ce33af9c50cee08c65b1374b0761b05018
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_6.txtFilesize
392KB
MD5cfb846afa58b9a2fb8018e55ef841f90
SHA18a6bfe762bf3093b1fff0211752a34dc5ee57319
SHA25692f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6
SHA51273344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\arnatic_7.txtFilesize
430KB
MD58c2f0a89bd8bfb029cf02e853ea30d82
SHA1d5d75a26a70a769d04ce977fe8bc774efa9de3be
SHA2566cb493755e621fed7e262241c1dc4a7baf77c08dc5eb18cae912eec57958eb47
SHA51210e2b0cb031119badf8bb1844a64e70e6cfd2034a7887d71a82df045818e41abc45f50c5733fcea0a53bbedd63d0113f4fad95c36f61c43ea71350fc04159623
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0D0CEC27\setup_install.exeFilesize
290KB
MD5b20a433150dff0cfeb1f60b40072b2c5
SHA1785fcf96932dd40388e15721640a177857330a9d
SHA256fc9cbd74b0a4b94c4e2c78acdb0762c773fe79c34b95ebb856141bc8b20174c1
SHA512f1368250cfbfd78c245ea89b0ad90349f8d8a345e7b6597788ebf7ec17622570e7e5ff9f14344ac8e7b8ce28f5a23f071525553f0240963b3c49970fbb7a8933
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Users\Admin\AppData\Local\Temp\axhub.datFilesize
551KB
MD513abe7637d904829fbb37ecda44a1670
SHA1de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f
SHA2567a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6
SHA5126e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllFilesize
48KB
MD589c739ae3bbee8c40a52090ad0641d31
SHA1d0f7dc9a0a3e52af0f9f9736f26e401636c420a1
SHA25610a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d
SHA512cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480
-
C:\Users\Admin\AppData\Local\Temp\axhub.dll.lnkFilesize
794B
MD505e9d1249c99f3a1268f47087b8c413f
SHA1eb505af98ecdec73bd1af8f52ad61cc4e2ca9ff7
SHA256765008a2f071fdf812f4cbc0fada8bdd68abec405237099591295c67742bb9a8
SHA51292706ee9cc7b77d5138a0e1456843bfc67ab3274c0933c0597e68e6ddd4fffac6b9b33ff35b5cd5746bb35c0a758e7a9b814b8a30e31f099e345805940b9c566
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtFilesize
31B
MD5b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtFilesize
1KB
MD55f3fe1f40410948c8fa68c7d97d1da8b
SHA1c67b7e7a2f0962fb10402a7ed8a5035eccd031f2
SHA256eca37a82ffb727746766f6c831afd19212e1e500c2c24dbcd00c796025b60386
SHA5120ce764d49716f70589698f403d976c72ec91d02343d6098ea31c5cc8bc5a3b383df329ee0f6c8ef93024d3b41e75ff4c6be850aa5f18ca3098ea4a702a5e021c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeFilesize
61KB
MD5a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
1.8MB
MD52bc79b3102900318deb99ab0557ceada
SHA14525d4e0f6de667a0dd5cdce07b4527c5ac71695
SHA25651c916784c9c6e6f425eb6a404dcba6fe8247978b4d8bee0bd37c3267777d1cb
SHA512cfef8fc9001ebfe395e0d920a2761ea362879398f0bf27c365516fd1305cf3e83ff76dbbf6e0262fd8e5890136bbe6e378e8c981594a35c848cd5ad5575d90b6
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
2.6MB
MD5619dc602ade0a7fe0673ee1b35e74687
SHA1af08754bae6925a3a9c85fda2f0deeaac02bec56
SHA256a061e68b9312831e367c379bf568a913dc24ab4e7a8aad0f9020260db1f02a4e
SHA5122167860f9383025b8d3eac90ee9d8b633cfec77c101e7e68942ed3d174ae91acab4476313840b7da9742211056488f13508df8a4dcc5437087d25f09532d1ced
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeFilesize
3.2MB
MD585cd8130faf8e25529dce3d52c723522
SHA1e821659f64ee8c3c7c1b08d65f68e232e5cc5fbe
SHA256f9ccc11d6d9d8ab81be4d2c88fd66dd7d59bd93c99a3c084194b7a80b5d1b4b7
SHA5120bc55297ebd588fc54d8b1b5775ec8ca7de854f07116d8d3d98d15e709a5347a0259596ed9fe9fa356163de6a07feffc44a6f427622313ce1c569a8bb07bf0a8
-
memory/1456-154-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-149-0x0000000000C30000-0x0000000000D30000-memory.dmpFilesize
1024KB
-
memory/1456-161-0x0000000005080000-0x0000000005624000-memory.dmpFilesize
5.6MB
-
memory/1456-169-0x00000000029D0000-0x00000000029EE000-memory.dmpFilesize
120KB
-
memory/1456-170-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-150-0x0000000000B80000-0x0000000000BAF000-memory.dmpFilesize
188KB
-
memory/1456-171-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-196-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-195-0x00000000736B0000-0x0000000073E60000-memory.dmpFilesize
7.7MB
-
memory/1456-200-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-194-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-166-0x00000000736B0000-0x0000000073E60000-memory.dmpFilesize
7.7MB
-
memory/1456-153-0x0000000002680000-0x00000000026A0000-memory.dmpFilesize
128KB
-
memory/1456-158-0x0000000000400000-0x0000000000909000-memory.dmpFilesize
5.0MB
-
memory/1456-193-0x0000000000C30000-0x0000000000D30000-memory.dmpFilesize
1024KB
-
memory/1456-201-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/1456-192-0x0000000000B80000-0x0000000000BAF000-memory.dmpFilesize
188KB
-
memory/1852-182-0x0000000000400000-0x000000000094C000-memory.dmpFilesize
5.3MB
-
memory/1852-155-0x0000000000BD0000-0x0000000000CD0000-memory.dmpFilesize
1024KB
-
memory/1852-151-0x0000000002570000-0x000000000260D000-memory.dmpFilesize
628KB
-
memory/1852-152-0x0000000000400000-0x000000000094C000-memory.dmpFilesize
5.3MB
-
memory/1852-183-0x0000000002570000-0x000000000260D000-memory.dmpFilesize
628KB
-
memory/1900-147-0x0000000000940000-0x0000000000949000-memory.dmpFilesize
36KB
-
memory/1900-148-0x0000000000400000-0x00000000008F7000-memory.dmpFilesize
5.0MB
-
memory/1900-142-0x0000000000AD0000-0x0000000000BD0000-memory.dmpFilesize
1024KB
-
memory/1900-187-0x0000000000400000-0x00000000008F7000-memory.dmpFilesize
5.0MB
-
memory/2652-189-0x00000000736B0000-0x0000000073E60000-memory.dmpFilesize
7.7MB
-
memory/2652-140-0x00000000056D0000-0x000000000571C000-memory.dmpFilesize
304KB
-
memory/2652-137-0x0000000005630000-0x0000000005642000-memory.dmpFilesize
72KB
-
memory/2652-136-0x0000000005600000-0x0000000005610000-memory.dmpFilesize
64KB
-
memory/2652-134-0x00000000736B0000-0x0000000073E60000-memory.dmpFilesize
7.7MB
-
memory/2652-133-0x0000000005C30000-0x0000000006248000-memory.dmpFilesize
6.1MB
-
memory/2652-129-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2652-139-0x0000000005690000-0x00000000056CC000-memory.dmpFilesize
240KB
-
memory/2652-190-0x0000000005600000-0x0000000005610000-memory.dmpFilesize
64KB
-
memory/2652-141-0x0000000005920000-0x0000000005A2A000-memory.dmpFilesize
1.0MB
-
memory/3212-111-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3212-114-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3368-135-0x00000000736B0000-0x0000000073E60000-memory.dmpFilesize
7.7MB
-
memory/3368-95-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3368-92-0x00000000736B0000-0x0000000073E60000-memory.dmpFilesize
7.7MB
-
memory/3368-91-0x00000000001D0000-0x0000000000238000-memory.dmpFilesize
416KB
-
memory/3540-184-0x00000000028E0000-0x00000000028F6000-memory.dmpFilesize
88KB
-
memory/3632-71-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-69-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3632-121-0x000000006EB40000-0x000000006EB63000-memory.dmpFilesize
140KB
-
memory/3632-120-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3632-119-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3632-117-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3632-116-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-75-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-44-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-74-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-73-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-72-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-70-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/3632-123-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3632-67-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3632-68-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3632-61-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3632-63-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3632-66-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3632-65-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3632-64-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3632-62-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3632-59-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3632-60-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3632-58-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3632-56-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4356-168-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB