glupteba | b29b6f1b6a2d7f6d8b63ac749bdc991892970c7e7643221cf6087d75e4f17c41

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.9MB
Sample240313-rfc2ssgd78
SHA256 b29b6f1b6a2d7f6d8b63ac749bdc991892970c7e7643221cf6087d75e4f17c41
MD5 a22002306cbbdc52549b8998a7348cfb
SHA1 6396fa71cd6042d915ec3244eb9eea7b11735b65
SHA512 240cb963bfdf51c25b5284daa49f4fb86539dc6b614327fc5f3f5bf3956784974b7beaefe1df67cdf6e414bb86c2581321f44ec9b58eb25735b7d2e4d6cbd6e6
SSDEEP 98304:3bch/RlekYSHAdakJEnHfCVf4Pp1ScWt/cS4HHQTHYuin7owuTALeZN/sa+gGgH9:3Y5u82J8npxWt/cS4nG47n7t/sGgH8rP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba stealc discovery dropper evasion loader persistence rootkit spyware stealer upx

Malware Config

Extracted

Family

stealc

http://185.172.128.145

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 15 IoCs

resource	yara_rule
behavioral2/memory/4976-59-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral2/memory/4976-60-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4976-166-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral2/memory/5108-168-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4976-169-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5108-274-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-374-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-416-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-420-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-425-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-438-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-454-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-458-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-463-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3252-467-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2288	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	EHIJJDGDHD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	syncUpd.exe

Executes dropped EXE 11 IoCs

pid	Process
220	InstallSetup10.exe
4304	syncUpd.exe
4976	453829d01bd822c255d951511849bab8.exe
4472	pub1E.exe
4980	BroomSetup.exe
5108	453829d01bd822c255d951511849bab8.exe
3252	csrss.exe
4420	injector.exe
2632	windefender.exe
924	windefender.exe
4196	EHIJJDGDHD.exe

Loads dropped DLL 4 IoCs

pid	Process
220	InstallSetup10.exe
220	InstallSetup10.exe
4304	syncUpd.exe
4304	syncUpd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000002323e-63.dat	upx
behavioral2/memory/4980-68-0x0000000000400000-0x0000000000930000-memory.dmp	upx
behavioral2/memory/4980-173-0x0000000000400000-0x0000000000930000-memory.dmp	upx
behavioral2/files/0x000a000000023267-410.dat	upx
behavioral2/memory/2632-415-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/924-421-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/924-439-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ledger-Live Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EHIJJDGDHD.exe"	EHIJJDGDHD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	453829d01bd822c255d951511849bab8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	453829d01bd822c255d951511849bab8.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	453829d01bd822c255d951511849bab8.exe
File created	C:\Windows\rss\csrss.exe	453829d01bd822c255d951511849bab8.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
220	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3296	4304	WerFault.exe	86

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023222-8.dat	nsis_installer_2
behavioral2/files/0x0007000000023222-10.dat	nsis_installer_2
behavioral2/files/0x0007000000023222-11.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	syncUpd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	syncUpd.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2436	schtasks.exe
952	schtasks.exe
744	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-492 = "India Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	453829d01bd822c255d951511849bab8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	453829d01bd822c255d951511849bab8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	453829d01bd822c255d951511849bab8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	453829d01bd822c255d951511849bab8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-392 = "Arab Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	453829d01bd822c255d951511849bab8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	453829d01bd822c255d951511849bab8.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	453829d01bd822c255d951511849bab8.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	453829d01bd822c255d951511849bab8.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1240	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4304	syncUpd.exe
4304	syncUpd.exe
4900	powershell.exe
4900	powershell.exe
4976	453829d01bd822c255d951511849bab8.exe
4976	453829d01bd822c255d951511849bab8.exe
1812	powershell.exe
1812	powershell.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
5108	453829d01bd822c255d951511849bab8.exe
2260	powershell.exe
2260	powershell.exe
5000	powershell.exe
5000	powershell.exe
2088	powershell.exe
2088	powershell.exe
2392	powershell.exe
2392	powershell.exe
3664	powershell.exe
3664	powershell.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
3252	csrss.exe
3252	csrss.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
3252	csrss.exe
3252	csrss.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
3252	csrss.exe
3252	csrss.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe
4420	injector.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	file.exe
Token: SeDebugPrivilege	4472	pub1E.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4976	453829d01bd822c255d951511849bab8.exe
Token: SeImpersonatePrivilege	4976	453829d01bd822c255d951511849bab8.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeSystemEnvironmentPrivilege	3252	csrss.exe
Token: SeSecurityPrivilege	220	sc.exe
Token: SeSecurityPrivilege	220	sc.exe
Token: SeDebugPrivilege	4196	EHIJJDGDHD.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4980	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 220	3760	file.exe	85
PID 3760 wrote to memory of 220	3760	file.exe	85
PID 3760 wrote to memory of 220	3760	file.exe	85
PID 220 wrote to memory of 4304	220	InstallSetup10.exe	86
PID 220 wrote to memory of 4304	220	InstallSetup10.exe	86
PID 220 wrote to memory of 4304	220	InstallSetup10.exe	86
PID 3760 wrote to memory of 4976	3760	file.exe	87
PID 3760 wrote to memory of 4976	3760	file.exe	87
PID 3760 wrote to memory of 4976	3760	file.exe	87
PID 3760 wrote to memory of 4472	3760	file.exe	88
PID 3760 wrote to memory of 4472	3760	file.exe	88
PID 220 wrote to memory of 4980	220	InstallSetup10.exe	89
PID 220 wrote to memory of 4980	220	InstallSetup10.exe	89
PID 220 wrote to memory of 4980	220	InstallSetup10.exe	89
PID 4976 wrote to memory of 4900	4976	453829d01bd822c255d951511849bab8.exe	90
PID 4976 wrote to memory of 4900	4976	453829d01bd822c255d951511849bab8.exe	90
PID 4976 wrote to memory of 4900	4976	453829d01bd822c255d951511849bab8.exe	90
PID 4980 wrote to memory of 1724	4980	BroomSetup.exe	94
PID 4980 wrote to memory of 1724	4980	BroomSetup.exe	94
PID 4980 wrote to memory of 1724	4980	BroomSetup.exe	94
PID 1724 wrote to memory of 2224	1724	cmd.exe	96
PID 1724 wrote to memory of 2224	1724	cmd.exe	96
PID 1724 wrote to memory of 2224	1724	cmd.exe	96
PID 1724 wrote to memory of 2436	1724	cmd.exe	97
PID 1724 wrote to memory of 2436	1724	cmd.exe	97
PID 1724 wrote to memory of 2436	1724	cmd.exe	97
PID 5108 wrote to memory of 1812	5108	453829d01bd822c255d951511849bab8.exe	104
PID 5108 wrote to memory of 1812	5108	453829d01bd822c255d951511849bab8.exe	104
PID 5108 wrote to memory of 1812	5108	453829d01bd822c255d951511849bab8.exe	104
PID 5108 wrote to memory of 4448	5108	453829d01bd822c255d951511849bab8.exe	106
PID 5108 wrote to memory of 4448	5108	453829d01bd822c255d951511849bab8.exe	106
PID 4448 wrote to memory of 2288	4448	cmd.exe	108
PID 4448 wrote to memory of 2288	4448	cmd.exe	108
PID 5108 wrote to memory of 2260	5108	453829d01bd822c255d951511849bab8.exe	109
PID 5108 wrote to memory of 2260	5108	453829d01bd822c255d951511849bab8.exe	109
PID 5108 wrote to memory of 2260	5108	453829d01bd822c255d951511849bab8.exe	109
PID 5108 wrote to memory of 5000	5108	453829d01bd822c255d951511849bab8.exe	111
PID 5108 wrote to memory of 5000	5108	453829d01bd822c255d951511849bab8.exe	111
PID 5108 wrote to memory of 5000	5108	453829d01bd822c255d951511849bab8.exe	111
PID 5108 wrote to memory of 3252	5108	453829d01bd822c255d951511849bab8.exe	113
PID 5108 wrote to memory of 3252	5108	453829d01bd822c255d951511849bab8.exe	113
PID 5108 wrote to memory of 3252	5108	453829d01bd822c255d951511849bab8.exe	113
PID 3252 wrote to memory of 2088	3252	csrss.exe	114
PID 3252 wrote to memory of 2088	3252	csrss.exe	114
PID 3252 wrote to memory of 2088	3252	csrss.exe	114
PID 3252 wrote to memory of 2392	3252	csrss.exe	121
PID 3252 wrote to memory of 2392	3252	csrss.exe	121
PID 3252 wrote to memory of 2392	3252	csrss.exe	121
PID 3252 wrote to memory of 3664	3252	csrss.exe	123
PID 3252 wrote to memory of 3664	3252	csrss.exe	123
PID 3252 wrote to memory of 3664	3252	csrss.exe	123
PID 3252 wrote to memory of 4420	3252	csrss.exe	125
PID 3252 wrote to memory of 4420	3252	csrss.exe	125
PID 2632 wrote to memory of 1348	2632	windefender.exe	131
PID 2632 wrote to memory of 1348	2632	windefender.exe	131
PID 2632 wrote to memory of 1348	2632	windefender.exe	131
PID 1348 wrote to memory of 220	1348	cmd.exe	132
PID 1348 wrote to memory of 220	1348	cmd.exe	132
PID 1348 wrote to memory of 220	1348	cmd.exe	132
PID 4304 wrote to memory of 4568	4304	syncUpd.exe	134
PID 4304 wrote to memory of 4568	4304	syncUpd.exe	134
PID 4304 wrote to memory of 4568	4304	syncUpd.exe	134
PID 4568 wrote to memory of 4196	4568	cmd.exe	138
PID 4568 wrote to memory of 4196	4568	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
    C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe
        6⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:1240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 2100
      4⤵
      Program crash
      PID:3296
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2224
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:2436
- C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
  "C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
    "C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2288
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2260
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:952
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:2144
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4420
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:744
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
- C:\Users\Admin\AppData\Local\Temp\pub1E.exe
  "C:\Users\Admin\AppData\Local\Temp\pub1E.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4472

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4304 -ip 4304
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

453829d01bd822c255d951511849bab8.exe

Path C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
Size 1.7MB
SHA256 e29ca40b07e6425f0caaabebd5a9d32977e9cd380a4f6c55e113db540172f8d2
MD5 6c60e916776678ce27b554313a2dc92d
SHA1 a68a3ed1a558bdf8a6d317a470271e13f8dfa0b7
SHA512 c1b558265e1645b41cc0129810a228e94ae5e4ee466740bcc95bbc167325891e19db0029bbbb96c8a7f4ba20e7655a2526acb1c77d94d51894f4b8fc7ee6c9f8
SSDEEP 49152:/GstRDHmrAphfw+8T672RgOSORxInfb4XchzjoZr:usttmrsh2T67GGf0XcZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

453829d01bd822c255d951511849bab8.exe

Path C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
Size 320KB
SHA256 833f18937d051f7b01bc1e33439c5fb0f27eb15534e6a90ac2722a2de6f19a2b
MD5 e1f5b4fd06ad2d3574b34d76bc2a8243
SHA1 bdb1c952752d053f5be142a2b006c048f0e4f6e0
SHA512 5ce43dc7d82cbdab04b0a9d65323db43ffda659f9c88e2866fb0ccdbe4ce35ddc33118ad6f9fcb47e4d61583e159d0917ad5a9a412b05e2d0384ccb45eb2510b
SSDEEP 6144:GbNY3ZPt28AYrOFzmOgfKWZ5FP7MsI1yHn/IaK:CNw1txAYixgfKw7Ms5Ha
MD5 SHA1 SHA512 SSDEEP

Submit Download

453829d01bd822c255d951511849bab8.exe

Path C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
Size 189KB
SHA256 2df60cafacd05d55ff7856304d2c93b6615a4a94bf9b0104ed677d3fc0e48985
MD5 cdba5069aa970f1eef4706f07f565ae9
SHA1 2c105f25c63d2d176d74a97d0ba08dd7c0936ce0
SHA512 9aa35493622666e847023368d87487921aba8d4a4b5d7a517239508dcfdcf54f79459e9d9d2e996bec86b523c90377d26aa25b69e39fe31fd31f947d3e794fe8
SSDEEP 3072:GbNY3Z8st2V8AY9XyBHjK1NLRSkRoGSagSbsq1TRsgq2:GbNY3ZPt28AYrOFzmOgV
MD5 SHA1 SHA512 SSDEEP

Submit Download

453829d01bd822c255d951511849bab8.exe

Path C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
Size 171KB
SHA256 e7ff81d4e3aea16918c649e47b333767c65ea2c8563ef8d805581839e2a7a627
MD5 733c2b5f3e756c4cf9ac761fed7c2a50
SHA1 26e0af645104ea0f2e9493abec21b6e495221d01
SHA512 c36356e211cc40d5cbf9d2ee1a804403ae5d01f5e1e2d304a0d1b2cea6294bda62e23578537eed961efb0d2cb2ce8ac7d514954cf72fabbd25b74ad89465f1f8
SSDEEP 3072:GbNY3Z8st2V8AY9XyBHjK1NLRSkRoGSagSbsq1Tv:GbNY3ZPt28AYrOFzmb
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroomSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Size 1.6MB
SHA256 96bb97f6479a7c4ef897e01a8b0bdbac53c76e730c717793fe50389fe3a1550e
MD5 ae037bac6d5341e842df3756751a3319
SHA1 01e48a827dc1f6812143879924eb27002b1c2229
SHA512 550f889a4978b8c98c6bebc265999eaf9bb58f81742e10bf625a24239a5a8257f665033bc7faa26c2824b20afa8ade0dde0841ed6d2c74f184a07ae5aa1b4bdb
SSDEEP 49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
MD5 SHA1 SHA512 SSDEEP

Submit Download

EHIJJDGDHD.exe

Path C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe
Size 101KB
SHA256 0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d
MD5 42b838cf8bdf67400525e128d917f6e0
SHA1 a578f6faec738912dba8c41e7abe1502c46d0cae
SHA512 f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0
SSDEEP 1536:iyhXGdtNbMAxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+9hQ9xKOcuS11PhbiW:i8XG/NbMAsISnRGPJkGt74DsISnRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup10.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
Size 1.2MB
SHA256 6e565e3753b76dba168af3c32e342c3950c99449ba946010ba64c8e0dd3d637e
MD5 401bd40396a317989b6b57529fe4fd54
SHA1 6eba5a67c6681cfec6ec355ae5f6e2fdfcaec795
SHA512 be86fef86ece29178e44bda7914f2027cdb3e373327ab5916d38ddd091faef2b27f55c4845ea26f5ab517d884361d78d5d198215665ea1d068546fbeba15b8bd
SSDEEP 24576:tIiiK2SUDopCWWagI8yC0eMGmhc43MZ5/NCDEE/rZrizRnhAxF:tIiiK2SvVXhT45/SEE/r4RnhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup10.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
Size 1.1MB
SHA256 30fe71bd799fccf952a86eccbec8d479c359f2b384f01da6d493b282aacd93d9
MD5 01a40bc9d287bd8a5b601564427f3e42
SHA1 9d85c49212ec4af318b6157118aa97e8e517c39d
SHA512 3f3c17656e756a1c0e275dd563c879821ae5d5e5099dcb4c51ee56be50d978bd0c8a3801bbc7e57137c7d5067771e0ad960ba6582a2810f02dda01b3053eb5a2
SSDEEP 24576:tIiiK2SUDopCWWagI8yC0eMGmhc43MZ5/NCDEE/rZrizRnhk:tIiiK2SvVXhT45/SEE/r4Rnhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup10.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
Size 1.8MB
SHA256 6c528e4baf911f75d235717225e5c4197ad0178bf731e3702fc3c41edcbd72a0
MD5 12cfd4de0b77729cba35acd6ab559dad
SHA1 7ee89792a8e7efe3961417f439ece1d5051a106e
SHA512 6d2bdc67668330d4eac0e7e79e7057b97913215372a14bf3d6db2db5fb3346a2dfaa9719243cf3d3b81cec06187a53fdcb05b3edc146bbb79ff965add7113967
SSDEEP 49152:tIiiK2SvVXhT45/SEE/r4RnhVp/+iE/2WE9:qiiK2WXF45/f8r4dJ/EOWE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_hspljtan.5ng.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hspljtan.5ng.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd8167.tmp\INetC.dll
Size 21KB
SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
MD5 2b342079303895c50af8040a91f30f71
SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5 SHA1 SHA512 SSDEEP

Submit Download

pub1E.exe

Path C:\Users\Admin\AppData\Local\Temp\pub1E.exe
Size 8KB
SHA256 da737c0d2b3e011e362325b5c531f8c456f788121221a795990ce85c4fb1ab43
MD5 08bf7dfea9919ac71d97889b2bee673c
SHA1 e48b2bcebe43b9477f377a2d70f3cb75cd583813
SHA512 71d5596783d5b1dd2f84bf9f508da514734c47d9575f81399ddb4a7e71015fcb7107957f63a6f024024ca76d5b3b9b183a91deb9590cd8e46b2d630bbb9b5680
SSDEEP 96:GJOuj5RHyNKEfTa4szTkdkKozt1tMfAaRT7zNt:0iFmP3Gk3yYEd
MD5 SHA1 SHA512 SSDEEP

Submit Download

syncUpd.exe

Path C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
Size 200KB
SHA256 421f8d69e9d99d7e447bae84e0574e19c9210c6f6121944408be0669aa63c56e
MD5 4daa194c9f29f77b6a97afcc50793020
SHA1 fa03fe3b16bc39ca17366c7b22bd71d0693cbf6f
SHA512 0638935945b3c181b59bda9dc13e53fc88cbbabe046af0460049f6e89688a9cd4e67783b93002330aa94cd25a04db492e1791bad4cc6c634ab6975affd63ba05
SSDEEP 3072:zFv/h3s33RqbWE+N8TjxT79q9FlxCVikUY+XZLr:zFv/h830aTaJT7gDriikeXZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

syncUpd.exe

Path C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
Size 195KB
SHA256 d46f2e1669ade02bafd86c33bc23d188bbc6d58b0a688fab6ec4adad9d8ed810
MD5 f0b50ef573e91f7e3ed17bcda78bcb26
SHA1 2c1f97e2ccd48dbdb4f5b993377fb415d06e13a3
SHA512 2961d71964f0165714adedd08f8b61cff775cf6a178ec2af4a46df1b5a7c2b779d9bf602502fa57885d9be5cf9da0d1c32a076618334ebead6f2dab1849b85a5
SSDEEP 3072:zFv/h3s33RqbWE+N8TjxT79q9FlxCVikUY+XZL5:zFv/h830aTaJT7gDriikeXZL5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Task.bat

Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
Size 128B
SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
MD5 11bb3db51f701d4e42d3287f71a6a43e
SHA1 63a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA512 907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download