dcdd4aaad5178efc26cbff22432e0a327622aed85bc74e323f07156014fcdae8

Analysis

max time kernel
152s
max time network
162s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4e094a5fafc8ab2c37a32137b1df21a.exe
Size 375.2MB
Sample240326-ee111sff3t
SHA256 dcdd4aaad5178efc26cbff22432e0a327622aed85bc74e323f07156014fcdae8
MD5 b4e094a5fafc8ab2c37a32137b1df21a
SHA1 6016a767b776132b73c59dd5a0213fbb0bce0f72
SHA512 9d02fe151be395a789b0c9d6c3ff793252d16268c7d69ae8dd8d67b17eefc04c94f97f20771da4bec9130edf13e17f5edd7156b38096ec9723e175bdf8108987
SSDEEP 98304:EB2pC6XG4HNkq5UKPhc24Y1/QPldHVTgPNhV0ADXqQgpkWDRIZVMnu0jjD8ueJU:tcUG4raKu24YY7HVT4hV0AD6QgqKRgX
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

agilenet evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b4e094a5fafc8ab2c37a32137b1df21a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	OneDrive.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	OneDrive.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b4e094a5fafc8ab2c37a32137b1df21a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b4e094a5fafc8ab2c37a32137b1df21a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	OneDrive.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	b4e094a5fafc8ab2c37a32137b1df21a.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk	b4e094a5fafc8ab2c37a32137b1df21a.exe

Executes dropped EXE 2 IoCs

pid	Process
2808	OneDrive.exe
1488	OneDrive.exe

Loads dropped DLL 3 IoCs

pid	Process
2772	b4e094a5fafc8ab2c37a32137b1df21a.exe
2808	OneDrive.exe
1488	OneDrive.exe

Obfuscated with Agile.Net obfuscator 6 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2772-0-0x00000000002F0000-0x00000000009F8000-memory.dmp	agile_net
behavioral1/memory/2772-44-0x000000001B580000-0x000000001B600000-memory.dmp	agile_net
behavioral1/files/0x00030000000180e5-82.dat	agile_net
behavioral1/files/0x00030000000180e5-83.dat	agile_net
behavioral1/memory/2808-85-0x0000000000D60000-0x0000000001468000-memory.dmp	agile_net
behavioral1/files/0x00030000000180e5-113.dat	agile_net

Themida packer 24 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000f000000015c7c-8.dat	themida
behavioral1/files/0x000f000000015c7c-6.dat	themida
behavioral1/memory/2772-9-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-12-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-23-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-45-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-57-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-76-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-81-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/files/0x000f000000015c7c-87.dat	themida
behavioral1/files/0x000f000000015c7c-88.dat	themida
behavioral1/memory/2808-89-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2808-91-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2808-103-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-106-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-107-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-108-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/files/0x000f000000015c7c-116.dat	themida
behavioral1/memory/1488-117-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/1488-119-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/1488-130-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-133-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-134-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida
behavioral1/memory/2772-136-0x000007FEED680000-0x000007FEEE204000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\OneDrive.exe"	b4e094a5fafc8ab2c37a32137b1df21a.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b4e094a5fafc8ab2c37a32137b1df21a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OneDrive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	7.tcp.ngrok.io
21	7.tcp.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2772	b4e094a5fafc8ab2c37a32137b1df21a.exe
2808	OneDrive.exe
1488	OneDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2744	powershell.exe
572	powershell.exe
2644	powershell.exe
1676	powershell.exe
2772	b4e094a5fafc8ab2c37a32137b1df21a.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe
Token: SeDebugPrivilege	2808	OneDrive.exe
Token: SeDebugPrivilege	1488	OneDrive.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	b4e094a5fafc8ab2c37a32137b1df21a.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2744	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	29
PID 2772 wrote to memory of 2744	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	29
PID 2772 wrote to memory of 2744	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	29
PID 2772 wrote to memory of 572	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	33
PID 2772 wrote to memory of 572	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	33
PID 2772 wrote to memory of 572	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	33
PID 2772 wrote to memory of 2644	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	35
PID 2772 wrote to memory of 2644	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	35
PID 2772 wrote to memory of 2644	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	35
PID 2772 wrote to memory of 1676	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	37
PID 2772 wrote to memory of 1676	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	37
PID 2772 wrote to memory of 1676	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	37
PID 2772 wrote to memory of 1772	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	39
PID 2772 wrote to memory of 1772	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	39
PID 2772 wrote to memory of 1772	2772	b4e094a5fafc8ab2c37a32137b1df21a.exe	39
PID 1512 wrote to memory of 2808	1512	taskeng.exe	42
PID 1512 wrote to memory of 2808	1512	taskeng.exe	42
PID 1512 wrote to memory of 2808	1512	taskeng.exe	42
PID 1512 wrote to memory of 1488	1512	taskeng.exe	43
PID 1512 wrote to memory of 1488	1512	taskeng.exe	43
PID 1512 wrote to memory of 1488	1512	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b4e094a5fafc8ab2c37a32137b1df21a.exe
"C:\Users\Admin\AppData\Local\Temp\b4e094a5fafc8ab2c37a32137b1df21a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b4e094a5fafc8ab2c37a32137b1df21a.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'b4e094a5fafc8ab2c37a32137b1df21a.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1772

C:\Windows\system32\taskeng.exe
taskeng.exe {29E9D254-5446-41F3-818E-94651C9C2147} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Users\Admin\AppData\Roaming\OneDrive.exe
  C:\Users\Admin\AppData\Roaming\OneDrive.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 4a8f8a2772d1a610878edf77e44ef8ad11088a5e12a5f841cc55025d5934e7a9
MD5 dab592209a48ea86be8ad26344a9e591
SHA1 a4202f45838bbbae927520d51c1ff0e43528064a
SHA512 672ec23be9914ffe4d96f92b5fe2968ce95aa4392e9d443f874939733ed14b1ec89f629db855c75370a476af031222abec9697515ce0fada2ee7acc3dd99b267
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Size 242B
SHA256 347581d992dfdbdb167c900e618ee494ee4d6f1b205447900884e76c5d308d10
MD5 161666af4b5d86c7ff0b29bc61a9d869
SHA1 eff3dc2acae5864bcc2cd7abb9faab7062463836
SHA512 0a26f7312def5fa4f1f26c2a7732b2274a7cf63d0db1a56859e8271262c9123ee722f8776418907a3fe93235a32ebb3596999697e160b097087b75c263a13d04
MD5 SHA1 SHA512

Submit Download

Cab5522.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab5522.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar3AD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar3AD0.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgileDotNetRT64.dll

Path C:\Users\Admin\AppData\Local\Temp\cc944bda-b387-4ef1-9cd0-0e21246370e2\AgileDotNetRT64.dll
Size 1.6MB
SHA256 e7fcee64cba42c231651fcb855a72583ff703a5f467fcf8b01e3830cd59f5a0e
MD5 f4f459c334375f2e353cc2372a7f853a
SHA1 3509e9efef1e3f06f1e4e464f9ac3ef6156f0954
SHA512 38c4d3dd109520799d8468d324213e11efa0f67b55e2118daf4309e857fb2828891826d574afc30439fc719116d199c7328cf7050ce629f2a53b0d8f443969f8
SSDEEP 49152:0uO+jf7PZ0K7ahwR3jxbfN/xuDPMG5iAhjR:0ujahex4d5iAhV
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgileDotNetRT64.dll

Path C:\Users\Admin\AppData\Local\Temp\cc944bda-b387-4ef1-9cd0-0e21246370e2\AgileDotNetRT64.dll
Size 1.6MB
SHA256 4a23a7894bc85fd73fe12664c5c8ac88a943a9fcd062aa066a83c0e116be36dd
MD5 c038cdb25afd5765ec4dcc683d87735d
SHA1 a800126d785e10e1947664b50d581fd8b6111ad0
SHA512 3bcbe4aeb45942e8212a562a3bcbe0c45220c6381be716b4ef9cbbc8a5385ff48b21e3c901388d7aa9004ce936dcf0441ee7eb66cb722239bc7cdcaefbaf9352
SSDEEP 49152:0uO+jf7PZ0K7ahwR3jxbfN/xuDPMG5iAhjtcnK:0ujahex4d5iAhxd
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 7c3581444050ad964008b58f90352cc7e41061335dace8869f95fd51c12b0134
MD5 67f0637ed7ef0152d73bd655a4e425f1
SHA1 15b3715c939acfb00396d0ab45f00b8cefb9eb74
SHA512 d20534055019f39cbf0944cd7fe8ce4cc577605250cf62bf7002e989b25377a69fa76807bd5310e18e2abbeb0b053b0434fda0fb168a10135ca8385bb689d1f2
SSDEEP 96:oVuCpM81nqvsqvJCwoXVuCpM81nqvsEHyqvJCwor2tD8QHqj7uLXlUVu:MHBUoFHBAHnor2Grj7uLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Roaming\OneDrive.exe
Size 2.9MB
SHA256 d2d968e18c508c3dadcc5acb7f5568910216bf4a7eaad00c0e756fc96980bbd7
MD5 e427d8f20b4e3188a9173ac0b0cc40c3
SHA1 817a0c55c6751fe6c75d7fbca4165d58adf0bde0
SHA512 2fc81bd80b0445f26881e897803431c71c9348c18517eb75f6f975ba8ae96baa0394a93d8a090c12c52a604e88dedfaa684eb7d8fc1f25509c3a65900f63fdcb
SSDEEP 49152:uPB2isr3e6KeX7+JTCNus2GhLl0qDCeUwTOBKPhgX7X/7aOZo4Y1A0QPvNWPxmHp:EB2pC6XG4HNkq5UKPhc24Y1/QPldHVTz
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Roaming\OneDrive.exe
Size 3.6MB
SHA256 c4cdd4dbb55ae19ab503ee5e35a86763ae044a759ccb45c4df0074e343ca8349
MD5 8f43e227c6f47245d77b746457688513
SHA1 6dba614cbbda134ff9903c6601c398bd48423421
SHA512 860253429f05e8365e301fc8ddf453be81b2c29d8e5e612393547dbdd7121ce4f03b9cd1cdf9d24b103c340bae332b3cc6602fa51a37db51026fb761b21b6492
SSDEEP 98304:EB2pC6XG4HNkq5UKPhc24Y1/QPldHVTgPNhJ:tcUG4raKu24YY7HVT4hJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Roaming\OneDrive.exe
Size 3.2MB
SHA256 2cf04970154f6a87706c1551e2d492720c189f939754f89013b09607638299ce
MD5 45900bc834a12118e9c668234fdd9e0f
SHA1 bd7183777f1aadec74a5f539482b89ed9343a6da
SHA512 c33d53e4b2d461fd672ca4847be04eea75d2547342962706c8c5488a09101c57bad8b26b42df3e89425983b4762e41a5fadfe15b56be802bb746a3da823ea7d7
SSDEEP 98304:EB2pC6XG4HNkq5UKPhc24Y1/QPldHVTgY:tcUG4raKu24YY7HVTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgileDotNetRT64.dll

Path \Users\Admin\AppData\Local\Temp\cc944bda-b387-4ef1-9cd0-0e21246370e2\AgileDotNetRT64.dll
Size 1.7MB
SHA256 61fc7d7ec8a6554612b3707c9e71b18d563398bbd0bec0e9e3c102f4651a164c
MD5 738a1a51601e634c9c4bd0a4e7ab9499
SHA1 9f71583514b1ca4f652c41e266c5d49089d4c54f
SHA512 fcd5e5c9a6800cc71ecae8c33125d6cfe04f018c1dce8c7a98d589f26d2815e4e73fa2eb18388e7b9386e884cafe6dc83c9acf04520e4639035d14f1e7d9f7a4
SSDEEP 49152:0uO+jf7PZ0K7ahwR3jxbfN/xuDPMG5iAhjtcnevPs:0ujahex4d5iAhxns
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgileDotNetRT64.dll

Path \Users\Admin\AppData\Local\Temp\cc944bda-b387-4ef1-9cd0-0e21246370e2\AgileDotNetRT64.dll
Size 1.1MB
SHA256 26c8ed30239ffc96c351f173e32fbfa4bdd3e7d191898aba0f2081fac718d945
MD5 770dc71e499a864423f9679b6797a753
SHA1 596c8743e2f3d9efa73c0a0c435544b05dc8a825
SHA512 891b041bf8e0857e6bb5741fba17ab041e4fb7a3d8d96d1b570fe4e2b9325dcb431670356b8f9b879a47ba2de73221c6f8e4e5c2bc101979e326bdf4606e6970
SSDEEP 24576:0jisT+wkLoP+7PE80UQXPah5N0h3AKFo30SSkQo6AYs/cs5X/iy:0uO+jf7PZ0K7ahwR3jxbfN/1
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgileDotNetRT64.dll

Path \Users\Admin\AppData\Local\Temp\cc944bda-b387-4ef1-9cd0-0e21246370e2\AgileDotNetRT64.dll
Size 1.8MB
SHA256 4d38fdf054e5e9e4dd6b98a7f31b535eabf25f48df24a96970f8c987ad1ee7a8
MD5 2bf5f40e7db4e7c6f9bedda50eb49c72
SHA1 4c0733261ab5d07e4f8409e8215841c39b5fdf84
SHA512 fe535919bfadc0bc4d72a701226b73d8abbac0d81c0db3354163b74d85158e34a4b3e84d86072e8aba6875ca02393aa7983b1d425712d190b55ef59ec102ab1d
SSDEEP 49152:0uO+jf7PZ0K7ahwR3jxbfN/xuDPMG5iAhjtcnevPzLP:0ujahex4d5iAhxnXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/572-43-0x000007FEEC340000-0x000007FEECCDD000-memory.dmp

Download

memory/572-46-0x0000000002390000-0x0000000002410000-memory.dmp

Download

memory/572-51-0x000007FEEC340000-0x000007FEECCDD000-memory.dmp

Download

memory/572-50-0x0000000002390000-0x0000000002410000-memory.dmp

Download

memory/572-48-0x0000000002390000-0x0000000002410000-memory.dmp

Download

memory/572-41-0x000000001B340000-0x000000001B622000-memory.dmp

Download

memory/572-42-0x0000000001D90000-0x0000000001D98000-memory.dmp

Download

memory/572-47-0x000007FEEC340000-0x000007FEECCDD000-memory.dmp

Download

memory/1488-130-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/1488-114-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Download

memory/1488-129-0x000007FEF4580000-0x000007FEF46AC000-memory.dmp

Download

memory/1488-119-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/1488-118-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/1488-131-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Download

memory/1488-117-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/1488-115-0x00000000002F0000-0x0000000000370000-memory.dmp

Download

memory/1488-132-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/1676-72-0x000007FEEC340000-0x000007FEECCDD000-memory.dmp

Download

memory/1676-69-0x000007FEEC340000-0x000007FEECCDD000-memory.dmp

Download

memory/1676-70-0x0000000002550000-0x00000000025D0000-memory.dmp

Download

memory/1676-71-0x0000000002550000-0x00000000025D0000-memory.dmp

Download

memory/1676-73-0x0000000002550000-0x00000000025D0000-memory.dmp

Download

memory/1676-74-0x000007FEEC340000-0x000007FEECCDD000-memory.dmp

Download

memory/2644-58-0x000007FEECCE0000-0x000007FEED67D000-memory.dmp

Download

memory/2644-60-0x000007FEECCE0000-0x000007FEED67D000-memory.dmp

Download

memory/2644-61-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/2644-62-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/2644-63-0x000007FEECCE0000-0x000007FEED67D000-memory.dmp

Download

memory/2644-59-0x00000000029A0000-0x0000000002A20000-memory.dmp

Download

memory/2744-30-0x000007FEECCE0000-0x000007FEED67D000-memory.dmp

Download

memory/2744-35-0x000007FEECCE0000-0x000007FEED67D000-memory.dmp

Download

memory/2744-28-0x000000001B170000-0x000000001B452000-memory.dmp

Download

memory/2744-29-0x00000000025E0000-0x00000000025E8000-memory.dmp

Download

memory/2744-31-0x0000000002790000-0x0000000002810000-memory.dmp

Download

memory/2744-32-0x0000000002790000-0x0000000002810000-memory.dmp

Download

memory/2744-33-0x000007FEECCE0000-0x000007FEED67D000-memory.dmp

Download

memory/2772-23-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-106-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-136-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-134-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-133-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-44-0x000000001B580000-0x000000001B600000-memory.dmp

Download

memory/2772-49-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/2772-1-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Download

memory/2772-45-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-2-0x000000001B580000-0x000000001B600000-memory.dmp

Download

memory/2772-9-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-81-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-107-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-108-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-34-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Download

memory/2772-10-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/2772-12-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-22-0x000007FEF4580000-0x000007FEF46AC000-memory.dmp

Download

memory/2772-0-0x00000000002F0000-0x00000000009F8000-memory.dmp

Download

memory/2772-57-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2772-76-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2808-103-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2808-84-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Download

memory/2808-85-0x0000000000D60000-0x0000000001468000-memory.dmp

Download

memory/2808-86-0x00000000005B0000-0x0000000000630000-memory.dmp

Download

memory/2808-105-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/2808-104-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Download

memory/2808-102-0x000007FEF4580000-0x000007FEF46AC000-memory.dmp

Download

memory/2808-91-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download

memory/2808-90-0x0000000077830000-0x00000000779D9000-memory.dmp

Download

memory/2808-89-0x000007FEED680000-0x000007FEEE204000-memory.dmp

Download