redline | c24ff96b950f3bff58f53396fe1aae0764209db72ee6489abffeba8855a7bd3f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34d9359a2a6b15423c74298520282b9b.exe
Size 7.5MB
Sample240315-pl66qagc5t
SHA256 c24ff96b950f3bff58f53396fe1aae0764209db72ee6489abffeba8855a7bd3f
MD5 34d9359a2a6b15423c74298520282b9b
SHA1 994219595e6e352add2e70188f5ff8cce111fb63
SHA512 880a831cadeaddb040523b21724949b3cb444bb823421b4a5b0f0be8cc8255108a57547b5c18a0877121a8cd4e7c7857afae4e952e4dadf200de10546bb95950
SSDEEP 196608:VKFPXI1QmlVDuauMb5EVFOUIjKlEPCw0517qAZiP:VW41v9uMt5RKSPy17qws
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline xmrig zgrat discovery evasion infostealer miner persistence rat spyware stealer themida trojan upx

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/3212-192-0x0000000004DF0000-0x0000000004E3C000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3212-192-0x0000000004DF0000-0x0000000004E3C000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sfasfafs.exe

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/4004-347-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-348-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-350-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-351-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-352-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-353-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-354-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-356-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4004-357-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Installer.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sfasfafs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sfasfafs.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	34d9359a2a6b15423c74298520282b9b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	38.exe

Executes dropped EXE 10 IoCs

pid	Process
4476	38.exe
3212	crypt.exe
2928	sfasfafs.exe
4544	7z.exe
1408	7z.exe
2504	7z.exe
3544	7z.exe
3308	7z.exe
432	Installer.exe
1632	updater.exe

Loads dropped DLL 5 IoCs

pid	Process
4544	7z.exe
1408	7z.exe
2504	7z.exe
3544	7z.exe
3308	7z.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023235-126.dat	themida
behavioral2/files/0x0007000000023235-184.dat	themida
behavioral2/memory/2928-197-0x0000000000370000-0x00000000008A4000-memory.dmp	themida
behavioral2/memory/2928-195-0x0000000000370000-0x00000000008A4000-memory.dmp	themida
behavioral2/files/0x0007000000023235-181.dat	themida
behavioral2/memory/2928-285-0x0000000000370000-0x00000000008A4000-memory.dmp	themida

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4004-343-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-342-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-345-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-346-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-344-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-347-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-348-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-350-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-351-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-352-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-353-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-354-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-356-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4004-357-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sfasfafs.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	Installer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2928	sfasfafs.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 3392	1632	updater.exe	163
PID 1632 set thread context of 4004	1632	updater.exe	168

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4076	sc.exe
3796	sc.exe
1232	sc.exe
4948	sc.exe
4368	sc.exe
4188	sc.exe
2700	sc.exe
860	sc.exe
1616	sc.exe
3408	sc.exe
1416	sc.exe
3684	sc.exe
4004	sc.exe
4708	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	sfasfafs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	sfasfafs.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	34d9359a2a6b15423c74298520282b9b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
2928	sfasfafs.exe
3212	crypt.exe
3212	crypt.exe
432	Installer.exe
400	powershell.exe
400	powershell.exe
400	powershell.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
432	Installer.exe
1632	updater.exe
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe
1632	updater.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	crypt.exe
Token: SeDebugPrivilege	2928	sfasfafs.exe
Token: SeRestorePrivilege	4544	7z.exe
Token: 35	4544	7z.exe
Token: SeSecurityPrivilege	4544	7z.exe
Token: SeSecurityPrivilege	4544	7z.exe
Token: SeRestorePrivilege	1408	7z.exe
Token: 35	1408	7z.exe
Token: SeSecurityPrivilege	1408	7z.exe
Token: SeSecurityPrivilege	1408	7z.exe
Token: SeRestorePrivilege	2504	7z.exe
Token: 35	2504	7z.exe
Token: SeSecurityPrivilege	2504	7z.exe
Token: SeSecurityPrivilege	2504	7z.exe
Token: SeRestorePrivilege	3544	7z.exe
Token: 35	3544	7z.exe
Token: SeSecurityPrivilege	3544	7z.exe
Token: SeSecurityPrivilege	3544	7z.exe
Token: SeRestorePrivilege	3308	7z.exe
Token: 35	3308	7z.exe
Token: SeSecurityPrivilege	3308	7z.exe
Token: SeSecurityPrivilege	3308	7z.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeShutdownPrivilege	4752	powercfg.exe
Token: SeCreatePagefilePrivilege	4752	powercfg.exe
Token: SeShutdownPrivilege	4696	powercfg.exe
Token: SeCreatePagefilePrivilege	4696	powercfg.exe
Token: SeShutdownPrivilege	1660	powercfg.exe
Token: SeCreatePagefilePrivilege	1660	powercfg.exe
Token: SeShutdownPrivilege	4388	powercfg.exe
Token: SeCreatePagefilePrivilege	4388	powercfg.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeShutdownPrivilege	376	powercfg.exe
Token: SeCreatePagefilePrivilege	376	powercfg.exe
Token: SeShutdownPrivilege	220	powercfg.exe
Token: SeCreatePagefilePrivilege	220	powercfg.exe
Token: SeShutdownPrivilege	4440	powercfg.exe
Token: SeCreatePagefilePrivilege	4440	powercfg.exe
Token: SeShutdownPrivilege	4684	powercfg.exe
Token: SeCreatePagefilePrivilege	4684	powercfg.exe
Token: SeLockMemoryPrivilege	4004	explorer.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4476	1104	34d9359a2a6b15423c74298520282b9b.exe	91
PID 1104 wrote to memory of 4476	1104	34d9359a2a6b15423c74298520282b9b.exe	91
PID 1104 wrote to memory of 4476	1104	34d9359a2a6b15423c74298520282b9b.exe	91
PID 1104 wrote to memory of 3212	1104	34d9359a2a6b15423c74298520282b9b.exe	92
PID 1104 wrote to memory of 3212	1104	34d9359a2a6b15423c74298520282b9b.exe	92
PID 1104 wrote to memory of 3212	1104	34d9359a2a6b15423c74298520282b9b.exe	92
PID 1104 wrote to memory of 2928	1104	34d9359a2a6b15423c74298520282b9b.exe	94
PID 1104 wrote to memory of 2928	1104	34d9359a2a6b15423c74298520282b9b.exe	94
PID 1104 wrote to memory of 2928	1104	34d9359a2a6b15423c74298520282b9b.exe	94
PID 4476 wrote to memory of 1500	4476	38.exe	96
PID 4476 wrote to memory of 1500	4476	38.exe	96
PID 1500 wrote to memory of 4944	1500	cmd.exe	98
PID 1500 wrote to memory of 4944	1500	cmd.exe	98
PID 1500 wrote to memory of 4544	1500	cmd.exe	99
PID 1500 wrote to memory of 4544	1500	cmd.exe	99
PID 1500 wrote to memory of 1408	1500	cmd.exe	100
PID 1500 wrote to memory of 1408	1500	cmd.exe	100
PID 1500 wrote to memory of 2504	1500	cmd.exe	101
PID 1500 wrote to memory of 2504	1500	cmd.exe	101
PID 1500 wrote to memory of 3544	1500	cmd.exe	102
PID 1500 wrote to memory of 3544	1500	cmd.exe	102
PID 1500 wrote to memory of 3308	1500	cmd.exe	103
PID 1500 wrote to memory of 3308	1500	cmd.exe	103
PID 1500 wrote to memory of 3000	1500	cmd.exe	104
PID 1500 wrote to memory of 3000	1500	cmd.exe	104
PID 1500 wrote to memory of 432	1500	cmd.exe	105
PID 1500 wrote to memory of 432	1500	cmd.exe	105
PID 2552 wrote to memory of 2616	2552	cmd.exe	118
PID 2552 wrote to memory of 2616	2552	cmd.exe	118
PID 760 wrote to memory of 5100	760	cmd.exe	150
PID 760 wrote to memory of 5100	760	cmd.exe	150
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 3392	1632	updater.exe	163
PID 1632 wrote to memory of 4004	1632	updater.exe	168
PID 1632 wrote to memory of 4004	1632	updater.exe	168
PID 1632 wrote to memory of 4004	1632	updater.exe	168
PID 1632 wrote to memory of 4004	1632	updater.exe	168
PID 1632 wrote to memory of 4004	1632	updater.exe	168

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3000	attrib.exe

C:\Users\Admin\AppData\Local\Temp\34d9359a2a6b15423c74298520282b9b.exe
"C:\Users\Admin\AppData\Local\Temp\34d9359a2a6b15423c74298520282b9b.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Roaming\38.exe
  "C:\Users\Admin\AppData\Roaming\38.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\mode.com
      mode 65,10
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e file.zip -p26489142026493027755422784 -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_4.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_3.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_2.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_1.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:3308
  - - C:\Windows\system32\attrib.exe
      attrib +H "Installer.exe"
      4⤵
      Views/modifies file attributes
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
      "Installer.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:432
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:2616
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:860
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:1616
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:3684
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:4076
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:3408
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4388
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:4004
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:4188
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:4708
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:1416
- C:\Users\Admin\AppData\Roaming\crypt.exe
  "C:\Users\Admin\AppData\Roaming\crypt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Users\Admin\AppData\Roaming\sfasfafs.exe
  "C:\Users\Admin\AppData\Roaming\sfasfafs.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5100
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3796
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1232
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4948
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2700
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:376
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3392
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\ProgramData\Google\Chrome\updater.exe
Size 2.1MB
SHA256 5ddb6f1d59e749c0805e2a12ce2ccee0479704959e0baeb1932c9a0019fa0455
MD5 83e686f40accd7204aaf58bb44fec5b0
SHA1 dd451ca5fdc7e984ffb01516f48d3d07856c85ee
SHA512 f3368c20f987098da70ba7d293fd4871e2f2a453925a3b540434c8948a7662fa41e30db271785953a6e772e26dd30dc0a96841c5657283fc0740d04ae6f45138
SSDEEP 24576:g8ti4f6hvZwfvsHbdkw9Kzd8x3JjkoC/8+O1TzeHLDGiXG32BQscom7lWl:g89OCfEHyVSxrC/Gzer5G36U76
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\ProgramData\Google\Chrome\updater.exe
Size 2.2MB
SHA256 96b52c56b4e3d6dd978082069752130c3930cf920e6149e2f405b477ba7d220c
MD5 843504aa2e3db671235a399028334ba8
SHA1 c0efaa821e192ac168a1027ddf3118dd649f4751
SHA512 41254911c1d73fd1576b066e803d6d44336601efdfa1d2d7a0db34cab620c9a3a92e50f995ffed9a272bb78e9e7f113252c74a53bf9985d157c42339e0568a18
SSDEEP 24576:g8ti4f6hvZwfvsHbdkw9Kzd8x3JjkoC/8+O1TzeHLDGiXG32BQscom7lW/Y/OJ:g89OCfEHyVSxrC/Gzer5G36U7HOJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_fbe255hr.igf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbe255hr.igf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 148KB
SHA256 e5c54de48ba253e8919cc8f9a88c01d2db8013ebf6a4518de7a88a429d7b1152
MD5 2ac9bb3a05f73e6ef2fb88629798053e
SHA1 cbdebad51a29df43b3c23d3046edcbe4579d3c4e
SHA512 029cf0ae1544acb8cca969d946faec3cf6b68ae8e107e98f2e5e9a0928cb153d2026c7b35c8b6741ae9f086c8b7bb7544cd393ac83c38c674202967789edc833
SSDEEP 3072:SGPyovjpnLtp5axfbGHS5VSIVym09cx9ZMRXw2avJUsLtQMwKdtjhhohuQQ:SGKovFnLkfJdVxU/aSsStKdtv5QQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 183KB
SHA256 e7284601b4228a9c0e60039141e39eca44e0dde9dcbc9e78fff6950f3729b26f
MD5 5f5053b6904cca7363451b99572a1d42
SHA1 1c42e8d8390210039761b4a6473ac937b695d04a
SHA512 a0586025586a122b685f311ca1d413ae4b88d2b4b72c4f6abe07db83a09c6062e21bb4646108f67284550ae4da11597d18084a8228ee2974be2a9629ca854b91
SSDEEP 3072:SGPyovjpnLtp5axfbGHS5VSIVym09cx9ZMRXw2avJUsLtQMwKdtjhhohuQJvEJjT:SGKovFnLkfJdVxU/aSsStKdtv5QJfNIV
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 152KB
SHA256 0a3adaa28eb2385cab71dc57c0b947892f76a47c0b310bd678a17fc2d2185fdc
MD5 9cac2a6b39d5c00b9e08a7a36f9d9bff
SHA1 98cc518dc29784518a5bc79d4facb0130e18a3b9
SHA512 a137f120f7524ca621171958b057083d74d6770ce9df0ef0d5b0155a2ed4417aa464c3cfb9c329ab028c1babae0cbaad33934e1253f950f11c77b34005f07ff1
SSDEEP 3072:SGPyovjpnLtp5axfbGHS5VSIVym09cx9ZMRXw2avJUsLtQMwKdtjhhohuQJvEa:SGKovFnLkfJdVxU/aSsStKdtv5QJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 1020KB
SHA256 0ce06f92720274a0bfee10640406cf895190ede53c0a240d79830bfe51157a0c
MD5 151fe4de45d19a7b7fda593667fbc76e
SHA1 e7a2da2d843f02fdd5f428cc8280bcb0f9ad91b6
SHA512 e49b672d6f0d4554740409e2a3b56f878508c7efdd155f3498edff29c32ef20d3190e1ddc6778249cf40a45858d71c7a66b97489d65a30a0084bd8c0a1a7e203
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYg/:jclmJSVARa86xzW3x/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 721KB
SHA256 c1c148955b4c7cf99f4ae058b753d239c88ce9da72006b1941535188ecdd9b41
MD5 6696607584bafe13b8392de6edcd651a
SHA1 9146f7e9d916ad96e40a92d0b44e0c528046aeb1
SHA512 4bdf631632d0149d563ccfe73eed5f2d46c2b7d4895f7b6f344f06942215e55b2509d103e97ebf1396add55101a37e74264d2b12584f51326a503f4008b8e258
SSDEEP 12288:SnovFnQfJ7xm9ztKdtv5QJSB2CAFjaL+Ri/RwTGJQmztH+ZFUvoi9++f/gS1dk12:S+clx4tCQJSVAFja8i/RwQQmzgO6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\main\7z.dll
Size 888KB
SHA256 842354539889427c32548cada9f6e492ad330309e6218797de1eb5f61615750e
MD5 1a1e1c0a87a3746a790a8dc25d13f360
SHA1 1c9c90d06c9b73f3afdd7c9e8d3f2148d683ff8a
SHA512 7810ccb91408c03e329560b169f72adcdb9b723210f2e2977e6abf69d4dab1c2b30fe3d76fd07b877c11c44cbe151dd20ce384d38ff4af0fd2af52ae421fbaf2
SSDEEP 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYm:jclmJSVARa86xzW3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 212KB
SHA256 94a1bdf1f895eb7a639d4c72f5f998486f3b3d3e836ce39094cda6598f5113e5
MD5 61ec05c7e33281c29a8e30f19ba0dacb
SHA1 24f0bb35523d2508e3d3cb21610b46e631126747
SHA512 22e1ef6bb4c837db83bafa6fb53a8121c1f4012d3c0eea611c7524cf97e4aa13866836edaf7f5ac6290b2c69b6bf3bc4e7fd3166d081c77a289463417a9a9f6f
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRak6:r1gL5pRTcAkS/3O
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 166KB
SHA256 6553b7ad4a58ece7c245ee5afb269479b688c1b04d0c91c98e8609cf2de921eb
MD5 eddf6ab0614bfc03bd21ec36554660fc
SHA1 1188e2f5c6a4e412b7250d36a724439efa160f36
SHA512 e8829b26522dfb3e79f8646edfba48c3b9caa99f4b273371b669857fb5f8f0d4970043bad2398cf986d31359402553be56cb89bd764958971d7436fdbd55140e
SSDEEP 3072:fz1jm/RL5pCyZ+Y/OS4CxaQTM4hATJ3JWxkqRd/8GrSTeenH:fz1gL5pRTMTTjMkId/BynH
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 220KB
SHA256 ed4acbbe3c5b996372094deeb77d094077f60f69fce5051160de14ce976ab5cf
MD5 4766880d67d804c3ce066d22c1136724
SHA1 1bd85d083a604bf080a9f261acb465f94e6912f6
SHA512 099d9dd4f45b5e843ad2cd6b85bafc14a6691ece78bf622725bedab8867c57d95c05e0a2b2cbd8fd37f4d5c54915c6e33fcd349e1678e2cc70f21e220474195a
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktN5:r1gL5pRTcAkS/3hf
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 122KB
SHA256 c84ff9d1a8609b25d9a87b005f124c1650c5069052d3c5f8de8420665c0398dd
MD5 81f2efb79c34d92dae25bc3177d07b11
SHA1 ada1e268f3a8826247cccab47bd60da48f467e89
SHA512 f2bd4ca91f2c5285636f82e4968785adae5bdfc37ea07b57239aa0279fe17146a93469842ca61ed76fa246ebc9b90c2f86c15e8e38f291273283567fa876b029
SSDEEP 3072:fz1jm/RL5pCyZ+Y/OS4CxaQTM4hATJ3JWxQ:fz1gL5pRTMTTjMQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Size 458KB
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
SSDEEP 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
Size 797KB
SHA256 c7d518eee5a6b3aa7af1d566b8d68cefb857da58e3f4f6712344f1e44fc43322
MD5 6bcdbec6e3888f58aeeabe5b077fa147
SHA1 00b1cfbb3663dac17fd4664c87da845104e468d5
SHA512 830904a8f920109ed1b23c6d55cf3451f27ad363d033eb4c1d4aac09b1cd1d37462d37a0cb45b7d12b9dccd9caafa64a09f5ad06b04f48a991a0c31832ea5c19
SSDEEP 12288:c98tlcd0llJf6deBC5ODaq80bLW7Hk+hwfnsUwko6aHR2B22ADCG2Dio:g8ti4f6hvZwfvsHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ANTIAV~1.DAT

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
Size 1006KB
SHA256 67e3e020db886f02a405bef9968092acf8cd47f3f0a1fa316660861e014a8d4f
MD5 6ea7e01abbfbafec0b7798cceafc7382
SHA1 fbd0e8015559280dff2493a86cba5ddb2fda6b04
SHA512 39f441093cf7c42dc89d466265ad0f315330e3b8a5d029173b59dd405e379070bfbb1ac03ead2e649efd7dbf0df7e902de44c097124029efcd8e68eec8a74d72
SSDEEP 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGW:R9kqGu7okP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe
Size 1002KB
SHA256 a3680c09301bad7ada31b3de7e1265ac395f4e096c475a6b721bf838463e0825
MD5 1572ec9775f28e493bf4739e60daa5d8
SHA1 c6d8c8fc023976e876051d06e8d6dcc25b418b57
SHA512 507dba84e62994359f8a380bea20641aa66004593ad7d4823f8cf7be4a2ccc8fa50925229f6fc7265b8a3dca4ba405eb761cbfee14bcddd3e1f573cd7eee1f45
SSDEEP 12288:c98tlcd0llJf6deBC5ODaq80bLW7Hk+hwfnsUwko6aHR2B22ADCG2DigB/MmW8RZ:g8ti4f6hvZwfvsHbdkw9KT
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_1.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
Size 646KB
SHA256 0e7a03097161990e79dda8b34bc38fab7dc446906853d9ec5313270c9cdb27d5
MD5 e6f1473367fecd85c09ec0a9d5a98689
SHA1 6db6458ac202dc570f2440d45c651c7dedbacc75
SHA512 2e5d24c57e0e2b655f5bd58ad8aff18c8a7c3c709eb5ee21e8643189eb30836bfb9ae43946684b986b7c175bed530e0b3eb99d588250fa93e71a9a21200824e0
SSDEEP 12288:DKa7Zh9ifVh3mvpQ9e4RPf53UBhuc9aKbCcsUNbhTDyXNKPaq5W74uDQ:26Doreme4Zf+7ucFbdssNGXUSR7FQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_2.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
Size 1.2MB
SHA256 a91dcc966e57bb28d1b5a7991b80d4a8070bf283aaf094392336d4e9a89103d2
MD5 c654356106ff73d22ba1e6ff7fd748aa
SHA1 52c99a120c5e90ec3a27a0184e1afe24a7bc07d5
SHA512 91ee68d0fbf1a4ea7fa6d86137edc6fa24f759f49b5021eb4eddc284ebb7ae411cb5b82ddfde79bb41bc96ad4279b40ef0c9b6580673a311f19e035f548406e0
SSDEEP 24576:w6Doreme4Zf+7ucFbdssNGXUSR7FVUz4pZ2xAXIRw6K4blfZSYRhsQvl:YeK6hpssN6blA43IRwslfJRial
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_3.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
Size 1004KB
SHA256 829658ca8fef9877e403f6b970baa0c9952e97a54d3b8716f81269b56b2d23a8
MD5 68b17c4ef6b5b9a5d12092c49b7a818f
SHA1 9dbcbd950810bfa33ea61b8b94583079a9c4d217
SHA512 daf82744c87bc636cf0ea9ef2e3a3e8cf08ef97490bcd36862438a6434f61f79e89d8a18e32dabe9e497f097a548abf0e5578dfb5434743c5a1d1e8fdf877368
SSDEEP 24576:M6Doreme4Zf+7ucFbdssNGXUSR7FVUz4pZ2xAXIRw6K4blo:EeK6hpssN6blA43IRwslo
MD5 SHA1 SHA512 SSDEEP

Submit Download

file_4.zip

Path C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
Size 166KB
SHA256 173e2ca0e5d39192ed3894840ab31665f2a265aef1699809abb19d70893fe244
MD5 f3ecbd785d72deaebc19dd000ea19079
SHA1 0ed467105e92f9110e05937121cc38a132260ddc
SHA512 295faa48b3a5e490dc9bb1b108e22f1d506ce1e42d89d54e7cb8577928c1edaf6b4b600e793252761087370a7c94ceb5d97d00ae0d9cae75bde83bbb41220664
SSDEEP 3072:BFXelaCvj8G73wWsrzgepIxVL/3Ay3eUtCy8fsSK3rmM+zYRb6RmfnzhQnV6:BteTvIjzgeuL/QzFfsrrmmTzSn8
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.bin

Path C:\Users\Admin\AppData\Local\Temp\main\file.bin
Size 421KB
SHA256 c28f3d705f266154b42ae73b1d784880343c3188f51552196f0329ddfa99c7db
MD5 eeab42042cd291ae7edcabf3a9b8e218
SHA1 1c5c4ad917bbc07fd403cd453798daab8278b652
SHA512 0cd9a744fa8d7579b3f5181981385727118dbdd5cdbbf6c95258692e08c3cdc4d841f157465b9574d9760718c8f02fe51306996b9fdc875cf16896ff399e8db2
SSDEEP 6144:WEOIPvHnU8ek4HdCgZCvm9tYsRlMxEedZg7u+/4imSYugQ3JhjNI/A/1bAAms/Rb:xOInuH9CvGdUDimxnWhj9CGjkhm
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.bat

Path C:\Users\Admin\AppData\Local\Temp\main\main.bat
Size 472B
SHA256 a1ee8b438847fda0acc1a668cd891ab6bb7e015855e954aec19c09cf8c05f16b
MD5 6856047982ae63d85c7b104fce33d72a
SHA1 3d98e93f3c48707e2096a13f23871298e837f754
SHA512 79c06d28d135b3dc9687979378a85a741659241002de77d9a45a53e802f271f78377a13749c6fe849cb53ff2bc9d273579c0cf8ab3124a7b7639f98b018750b7
MD5 SHA1 SHA512

Submit Download

38.exe

Path C:\Users\Admin\AppData\Roaming\38.exe
Size 4.5MB
SHA256 477712f48e356d8c77224a1264dd765b1420fc8c0c318b295744a68316b3f055
MD5 40ecc726bee273961d09301c0316af6e
SHA1 0a1122398641375babcf28a7feb24d1935011a7f
SHA512 130911be930bd0911735de6eeae637843ab7c68b48a8213aa9b4dabee9cbfcacdb5d1eb927e14c5bec133bedf6a3c30d0a105d1c2e41aeea3338b9f431ef807d
SSDEEP 98304:ZR5VLB+g2pSMqgZmqK0scjW0nOs992v6QeoLqELeUpDGxK9jwwLPk4S7cdz5:ZRzLBt2jXkwj3lz2vAouELeU1Gogb
MD5 SHA1 SHA512 SSDEEP

Submit Download

38.exe

Path C:\Users\Admin\AppData\Roaming\38.exe
Size 4.1MB
SHA256 b57f5f68d8b45aa081063cc6902b4c672c6136ad9e88da601c4b615d2c5b61fe
MD5 cbf1e41bd63e24e7a7b7728e0d60d51d
SHA1 5324b13c1a52f077f2356167332423b1a844ec84
SHA512 60235cd9fd8d6bec344e1faebe024e06d498a5e6ed166c080d7a7867b95dde53e94a4933abe32041035cda796fa9d63beb9063dc02b84abf8c14cce67d22d475
SSDEEP 98304:ZR5VLB+g2pSMqgZmqK0scjW0nOs992v6QeoLqELeUpDGxK9jwwLPkq:ZRzLBt2jXkwj3lz2vAouELeU1Gogq
MD5 SHA1 SHA512 SSDEEP

Submit Download

38.exe

Path C:\Users\Admin\AppData\Roaming\38.exe
Size 2.1MB
SHA256 2f679aff8efc100db92398a5341709a3332f773e989d8167fe5c53f4f117b778
MD5 66b5418ee99e96de1c802d0735947453
SHA1 c9a9046b49271a388ee66e777d22f425bb11df1a
SHA512 a07aec476f1724a15b261ee217460d56c37fe7d43f311d825fa1211d7ed8acf24a1d93ed92f5ab81810fa35c23c18ed60bff01746eb59194a2d942ba3aef79fc
SSDEEP 49152:ZR5dI/4KaLB+gjky2fpphSMqgZIrf1bwXK0sup48cnohS:ZR5VLB+g2pSMqgZmqK0scjW0S
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypt.exe

Path C:\Users\Admin\AppData\Roaming\crypt.exe
Size 412KB
SHA256 49e3c6738e6d99770ac69d75adde05379910f67bd988c378a7ab53e146510de4
MD5 084787a02d925fecd0821303aab375ad
SHA1 d620d2d42a3ee9bb40672d25f93b23fb6f3bbd51
SHA512 d6e05094e6c1f407996ed3dcdf82ad1dceddb3f9768d59c9b86d573aeb13af7f13d65d806ff6e925197e9ff8f7ff50efaf32da45fcd514df83aec25043f7de68
SSDEEP 12288:99pVcO+InqVT9zfIyAasfsm5p58TViC18j/i3DsD:XncO+bJgD3+pR8riT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfasfafs.exe

Path C:\Users\Admin\AppData\Roaming\sfasfafs.exe
Size 704KB
SHA256 27460926febbfd0f55601e84b238cd9e58a3ee91c7265a02cec3d9a6ab2a981b
MD5 1efa890ef13ba45f3215a914eb209c61
SHA1 5185c707636c106646d6c18e37bff1162a67d56c
SHA512 17b58082f4f3d7a538edcf928e7bfaba8cf740ae889d9667cf6ac36daba4406acd2fd7c807f345e8e9d8d37fadbe1ab8dd9a9b8892a934a2916bc240dd861875
SSDEEP 12288:lZlHqYXnPkHmyYOGrpKtVrCu6eHW7SgAnbkqiQe:UrHmylGIF1gNd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfasfafs.exe

Path C:\Users\Admin\AppData\Roaming\sfasfafs.exe
Size 1.6MB
SHA256 ab76041b908ec034293f606bb4d27f9e6449d48a843dfd1827cc8ef98c99d8a3
MD5 09cf425dc89ca9a090fddccb419bb2fe
SHA1 d338e8701b5260a20db5d7a13ecfa53f4ca04ca8
SHA512 ec15bb3bc06428936103dd425bcf68e8477b8a1e1945c1a5bfc1a3feb1aa619724486e34307249b6ed6eb03c2c98e7097af2d61d8b649b2d41604ff7162a0aa1
SSDEEP 24576:UrHmylGIF1gN9vGQwcbNkwsZaY2CjaQgyqyRB:UDrwGQJNkbEKtgny7
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfasfafs.exe

Path C:\Users\Admin\AppData\Roaming\sfasfafs.exe
Size 128KB
SHA256 4ea6f1b131e0be6679617c9b10cdab9a69d354594896cddc7e4407a73c4bc02c
MD5 068033dc799b6c42d1ac45df7ba41fe3
SHA1 9810378e6066bb0eed9c004d283c305ce4020fcb
SHA512 c4051391fb48767177ffee62233050b1d8e3758c387198981e95f7381f7e33100d120785b757461fceba058a3841352a42f0f06364bf56d2b01526b6e1125bd2
SSDEEP 3072:8bRTe0Mx7mZ11+sERbuel/qGwAb35M7FgT4O5nhBEYCIY6mz6yQR71VGPT:8bfibuel/qG9bEgT4O5nPlCHmyM1APT
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 3KB
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
MD5 SHA1 SHA512

Submit Download

memory/400-287-0x000001BACD8A0000-0x000001BACD8B0000-memory.dmp

Download

memory/400-278-0x000001BACD840000-0x000001BACD862000-memory.dmp

Download

memory/400-291-0x00007FFDE5570000-0x00007FFDE6031000-memory.dmp

Download

memory/400-288-0x000001BACD8A0000-0x000001BACD8B0000-memory.dmp

Download

memory/400-286-0x00007FFDE5570000-0x00007FFDE6031000-memory.dmp

Download

memory/2012-322-0x000002719D140000-0x000002719D15C000-memory.dmp

Download

memory/2012-325-0x000002719D130000-0x000002719D138000-memory.dmp

Download

memory/2012-307-0x0000027183D60000-0x0000027183D70000-memory.dmp

Download

memory/2012-306-0x0000027183D60000-0x0000027183D70000-memory.dmp

Download

memory/2012-305-0x00007FFDE5910000-0x00007FFDE63D1000-memory.dmp

Download

memory/2012-323-0x000002719D120000-0x000002719D12A000-memory.dmp

Download

memory/2012-317-0x000002719CF00000-0x000002719CF1C000-memory.dmp

Download

memory/2012-318-0x00007FF4D0A80000-0x00007FF4D0A90000-memory.dmp

Download

memory/2012-321-0x000002719CEF0000-0x000002719CEFA000-memory.dmp

Download

memory/2012-326-0x000002719D160000-0x000002719D166000-memory.dmp

Download

memory/2012-320-0x0000027183D60000-0x0000027183D70000-memory.dmp

Download

memory/2012-327-0x000002719D170000-0x000002719D17A000-memory.dmp

Download

memory/2012-319-0x000002719CF20000-0x000002719CFD5000-memory.dmp

Download

memory/2012-324-0x000002719D180000-0x000002719D19A000-memory.dmp

Download

memory/2012-328-0x0000027183D60000-0x0000027183D70000-memory.dmp

Download

memory/2012-331-0x00007FFDE5910000-0x00007FFDE63D1000-memory.dmp

Download

memory/2928-197-0x0000000000370000-0x00000000008A4000-memory.dmp

Download

memory/2928-258-0x0000000006DE0000-0x0000000006DF2000-memory.dmp

Download

memory/2928-257-0x0000000006EA0000-0x0000000006F3C000-memory.dmp

Download

memory/2928-207-0x00000000074C0000-0x0000000007526000-memory.dmp

Download

memory/2928-183-0x0000000000370000-0x00000000008A4000-memory.dmp

Download

memory/2928-185-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-189-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-195-0x0000000000370000-0x00000000008A4000-memory.dmp

Download

memory/2928-198-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-268-0x0000000000370000-0x00000000008A4000-memory.dmp

Download

memory/2928-270-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-269-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-200-0x0000000077144000-0x0000000077146000-memory.dmp

Download

memory/2928-282-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-196-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-284-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-285-0x0000000000370000-0x00000000008A4000-memory.dmp

Download

memory/2928-193-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-194-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-190-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/2928-187-0x0000000075520000-0x0000000075610000-memory.dmp

Download

memory/3212-204-0x00000000087B0000-0x00000000087C2000-memory.dmp

Download

memory/3212-266-0x00000000726B0000-0x0000000072E60000-memory.dmp

Download

memory/3212-261-0x000000000B220000-0x000000000B3E2000-memory.dmp

Download

memory/3212-263-0x0000000006BA0000-0x00000000070CC000-memory.dmp

Download

memory/3212-262-0x0000000005530000-0x0000000005540000-memory.dmp

Download

memory/3212-260-0x0000000009C30000-0x0000000009C4E000-memory.dmp

Download

memory/3212-259-0x0000000009C70000-0x0000000009CE6000-memory.dmp

Download

memory/3212-206-0x0000000008850000-0x000000000889C000-memory.dmp

Download

memory/3212-205-0x0000000008810000-0x000000000884C000-memory.dmp

Download

memory/3212-203-0x00000000088C0000-0x00000000089CA000-memory.dmp

Download

memory/3212-202-0x0000000008C50000-0x0000000009268000-memory.dmp

Download

memory/3212-201-0x0000000005530000-0x0000000005540000-memory.dmp

Download

memory/3212-199-0x0000000005350000-0x000000000535A000-memory.dmp

Download

memory/3212-192-0x0000000004DF0000-0x0000000004E3C000-memory.dmp

Download

memory/3212-188-0x00000000078C0000-0x0000000007952000-memory.dmp

Download

memory/3212-186-0x0000000007E70000-0x0000000008414000-memory.dmp

Download

memory/3212-182-0x0000000001470000-0x0000000001482000-memory.dmp

Download

memory/3212-124-0x0000000000A80000-0x0000000000A90000-memory.dmp

Download

memory/3212-120-0x00000000726B0000-0x0000000072E60000-memory.dmp

Download

memory/3392-334-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3392-338-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3392-335-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3392-337-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3392-341-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3392-336-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/4004-347-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-351-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-345-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-346-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-344-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-343-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-348-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-349-0x0000000001300000-0x0000000001320000-memory.dmp

Download

memory/4004-350-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-342-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-352-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-353-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-354-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-355-0x0000000002120000-0x0000000002140000-memory.dmp

Download

memory/4004-356-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-357-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4004-358-0x00000000021C0000-0x00000000021E0000-memory.dmp

Download

memory/4004-359-0x00000000021C0000-0x00000000021E0000-memory.dmp

Download