purelogstealer | 6a69e0ebb331aa21614ccc0c4028b5cde242f0710300fe7b441b2017c71a8e16

Analysis

max time kernel
232s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LoaderVNC.exe
Size 5.2MB
Sample240328-ldevqafa83
SHA256 6a69e0ebb331aa21614ccc0c4028b5cde242f0710300fe7b441b2017c71a8e16
MD5 6108c4dfc40c5059db5851144367ada3
SHA1 adad70901e50be0d5bae17f493bf4b1565cb6113
SHA512 0bc0efa44b86f7db0aa2c074236a30e35241c48bf4e55839322107b1b3dca2867a05a910cf79a5384e7511ef82bb937a0ec291489f0e768e8d111f97ced97671
SSDEEP 98304:YOH2X7UhdU65D7zYQC4nBGddClR5qGyz9kw4lJMyYqw1ce4ARg9XV6ZEwXbTGD:jWoh75D7vHl7qGyz9kw4lCqwWX9l6ZF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogstealer zgrat persistence rat stealer

Malware Config

Signatures

Detect ZGRat V1 37 IoCs

resource	yara_rule
behavioral4/memory/1656-4-0x0000000006900000-0x0000000006DF0000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-5-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-6-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-8-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-10-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-12-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-14-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-16-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-18-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-20-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-22-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-24-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-26-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-28-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-30-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-32-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-34-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-36-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-38-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-40-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-42-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-44-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-46-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-48-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-50-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-52-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-54-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-56-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-58-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-60-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-62-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-64-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-66-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/1656-68-0x0000000006900000-0x0000000006DEA000-memory.dmp	family_zgrat_v1
behavioral4/memory/3472-4804-0x0000000005550000-0x00000000057A4000-memory.dmp	family_zgrat_v1
behavioral4/memory/3512-4810-0x00000000055E0000-0x00000000056C8000-memory.dmp	family_zgrat_v1
behavioral4/memory/948-13489-0x0000000005220000-0x00000000052FC000-memory.dmp	family_zgrat_v1

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 4 IoCs

resource	yara_rule
behavioral4/files/0x0002000000029e08-4791.dat	family_purelog_stealer
behavioral4/files/0x0002000000029e08-4796.dat	family_purelog_stealer
behavioral4/memory/3472-4797-0x00000000005A0000-0x0000000000840000-memory.dmp	family_purelog_stealer
behavioral4/files/0x0002000000029e08-13472.dat	family_purelog_stealer

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
3472	vncKript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idyahb = "C:\\Users\\Admin\\AppData\\Roaming\\Idyahb.exe"	LoaderVNC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 3512	1656	LoaderVNC.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	LoaderVNC.exe
Token: SeDebugPrivilege	3472	vncKript.exe
Token: SeDebugPrivilege	3512	LoaderVNC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3500	firefox.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3500	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3500	firefox.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3472	1656	LoaderVNC.exe	80
PID 1656 wrote to memory of 3472	1656	LoaderVNC.exe	80
PID 1656 wrote to memory of 3472	1656	LoaderVNC.exe	80
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 1656 wrote to memory of 3512	1656	LoaderVNC.exe	81
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3212 wrote to memory of 3500	3212	firefox.exe	86
PID 3500 wrote to memory of 2784	3500	firefox.exe	87
PID 3500 wrote to memory of 2784	3500	firefox.exe	87

C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
"C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\vncKript.exe
  "C:\Users\Admin\AppData\Local\Temp\vncKript.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\vncKript.exe
    C:\Users\Admin\AppData\Local\Temp\vncKript.exe
    3⤵
    PID:948
- C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
  C:\Users\Admin\AppData\Local\Temp\LoaderVNC.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.0.1509051231\1557568801" -parentBuildID 20221007134813 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abde5cbc-af3a-4d43-b256-7c061cff0bf9} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 1868 1f6286d9558 gpu
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.1.1526113827\573322604" -parentBuildID 20221007134813 -prefsHandle 2252 -prefMapHandle 2248 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5dd09e8-f88d-4696-8d8d-8211412f047b} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 2264 1f61c8e4e58 socket
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.2.1546085559\1526883242" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2748 -prefsLen 20886 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3910154-b191-441e-aeb4-75bbce599385} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 2756 1f62daa7758 tab
    3⤵
    PID:336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.3.623075620\1912588684" -childID 2 -isForBrowser -prefsHandle 3376 -prefMapHandle 3372 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b80a8217-2b8c-46fb-ab42-b3d4e691cbac} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 3388 1f61c862858 tab
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.4.342244946\772685497" -childID 3 -isForBrowser -prefsHandle 4684 -prefMapHandle 4680 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb693c56-cdbd-4520-8ba0-eb264109dc8f} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 4696 1f62fbd5458 tab
    3⤵
    PID:1164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.5.207932751\1022862608" -childID 4 -isForBrowser -prefsHandle 5052 -prefMapHandle 4684 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c1f130e-5ee2-4c9f-84c7-f3a75b7e82c7} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 4936 1f6285f8d58 tab
    3⤵
    PID:468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.6.1803719521\918732092" -childID 5 -isForBrowser -prefsHandle 5180 -prefMapHandle 5184 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {105ab938-bc4d-42e6-9e7f-cebc300c33ee} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 5172 1f62b077f58 tab
    3⤵
    PID:4608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.7.1138055045\968189932" -childID 6 -isForBrowser -prefsHandle 5372 -prefMapHandle 5376 -prefsLen 26204 -prefMapSize 233444 -jsInitHandle 1236 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17e859cb-6605-4839-a17c-5ca4258e4e46} 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 5364 1f62b0dae58 tab
    3⤵
    PID:2484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDAHUAcgByAGUAbgB0AC4AZQB4AGUAOwA=
1⤵
PID:876

C:\Users\Admin\AppData\Local\Keywords\tefyrgca\Current.exe
C:\Users\Admin\AppData\Local\Keywords\tefyrgca\Current.exe
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Current.exe

Path C:\Users\Admin\AppData\Local\Keywords\tefyrgca\Current.exe
Size 128KB
SHA256 56a17a7499e4cf96d9a669db18ce1c4c239f739dd9c8e4587435b3013846a585
MD5 bd3df8ec0be505d4bb91b3ee082a510d
SHA1 3b59078c1cffbc26c07e5d3f1d7e23e7b6823ce1
SHA512 ed5bbc45d8012b0aec117e4db6496d9984332eebffb99b77aa6a250062689b29fbd6539d22dab22f64d1a7a3718ceae2028755f937e7c64c82fe39b9c7e821d1
SSDEEP 3072:QWFRKQgbN5PYWdrWdlJCHTdfqYxfcqukodOKJA:LDKYWkdOz9UzdfG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Current.exe

Path C:\Users\Admin\AppData\Local\Keywords\tefyrgca\Current.exe
Size 2.4MB
SHA256 357f21470c4d90efcdbb011caf681ff1e595b93af6a37aa77b8db2e6b308a8b5
MD5 33458bd11a635565bab58bc16c7eb1a3
SHA1 d5d20f831f8e0cd349463640428eb1937e883588
SHA512 f72f6f3c8effc53a032bda1bd8471e081feedf0bec7f0d4fef074fa91a8ef64d09da08619175d167fcb8e7ff8dbfde7ccb1a442de4830ab0bbbec842ae8dfd55
SSDEEP 49152:V2OXt1mXpJ7H0hdJp0654yWu7c6/Y8T81Pwoyqz9MMwejq19gXg+:YOH2X7UhdU65D7zYQC4nBGT
MD5 SHA1 SHA512 SSDEEP

Submit Download

LoaderVNC.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LoaderVNC.exe.log
Size 927B
SHA256 fb16f684b333e4a2b20cec2d9e4597fa822aeb8ba652a1880e90b9cb6cebfcd1
MD5 d6c84cd043778ad362694d8bf17ca0dc
SHA1 1c44843f4e3706137c5d5d4f5eea0270d33fef08
SHA512 7ee6bd15d91c4a0e251005d63a6f83cf418871dc241d0f6924512af4684d04558095955e84c9ecb5c6bf11d0b393c0a4028f80e3f6f690b1caf02ea066c495ea
MD5 SHA1 SHA512

Submit Download

A72798DEF4F924983D5A0DB82D383C613B515FF2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\er0iywxg.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2
Size 13KB
SHA256 fab9d0006840e8e49ff9d95be60420c8ba264ebc3f44cd0d9a926a390dc9cdcf
MD5 c0ca8210b4ac0c48e884a41b5819806c
SHA1 8caae541fda6b6fc8a6a4a460cf09716831dac68
SHA512 276ffde354d61443f276ed7c1f175124fcfb905fa83fc7fdc7da87c043bccc6eb63a62b0ba8a359fc6c828557c38d10c946ae85fccfaa13973da7a5b1e3f4c9f
SSDEEP 384:HNru9fiGLm4pUuKkBWcL6GY4FkODH9LO4O0lpDIIGsmsO:4Bi8mCUuKPc9Y4FkOpLOwD8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 3.5MB
SHA256 02ea09f9b03eb483210df02dca27c92cdd0db44d9719c0de4213707d9a34146a
MD5 85e6db416c5b70330eadd89650c16cca
SHA1 84a399caf9ec6430269f0c512220ff0aff6d1c77
SHA512 f3eb9b54b7b5a1ac9b3fa1061f8b4c0bab1309e2bbf6c22fd5ea8bbc67a7c8228cfd476fc206cfa4aa14ca7dda261c1750ca298a3a12f759fd85ece2f749db31
SSDEEP 98304:H1U8Z456mfLrmvnit0n7G6cvflASpotRV0LxtNtL/CwB:945hXmP7/cvflwtf0FzVC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

vncKript.exe

Path C:\Users\Admin\AppData\Local\Temp\vncKript.exe
Size 1.2MB
SHA256 80d4ada6cae2b82f3fd732e9f8f9d392997c6600db81c86e1dc7be98c5022351
MD5 ce9e4e06b794c8dee0fa1da7765a8cc5
SHA1 7901013daa07f0fa8d9cf2707025d710ddf8f558
SHA512 8089e31b753c8907794e53cdd947aba4d71f93cc4ea2c7c61d17d44e084fe583050ef718e75b1f7ae706428b7608d39ed13bf8b9259751e8dd622b5440f7a38a
SSDEEP 24576:AiiNGSGLb3uWP5mbd1LZsaj/xgu/cPr2t+0DD4nPCDcPf/eQxTgZ:PCcb3XPMd1Lqaj/pkauqsLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vncKript.exe

Path C:\Users\Admin\AppData\Local\Temp\vncKript.exe
Size 2.6MB
SHA256 e4a91db9e43655931fd3926ec00dbe8a063fbe0d3f0af7d902fd3b9d8281fb3d
MD5 0496ec9393b9228f1cf3439046309cf0
SHA1 c3f51e15b43b521d2e68efd353849ebd03e937ee
SHA512 837b8dbcfa80d43750ffda475afd033349a8c66f588344ceee73f7514645a3f51666a5da67239107b0d6478cad49ddf3064573ff188f419cce7dafc54171a9b2
SSDEEP 49152:PCcb3XPMd1Lqaj/pkauqsL2GNX4TeXymmyQTPmsCLzIvkmdZG2iP:qJ1LqaTptuLL2GasmKzY5
MD5 SHA1 SHA512 SSDEEP

Submit Download

vncKript.exe

Path C:\Users\Admin\AppData\Local\Temp\vncKript.exe
Size 1.6MB
SHA256 ef7c0806383a91e8ad17638e872dabd0360e878092f1547d3eab7c44c6caa529
MD5 c941506147df0769f9b85d0cbfc54756
SHA1 8ebfcfebc7b8c0622d6fe23ee66c6bd4bfb9f836
SHA512 b38f2ff8c30bed531a75e4466c515e0ab02ad0af444fc83031632093d0e839fb2d118df903360062df75c73e6d78577a2db7c4f891f237815f72c6aabc720f4a
SSDEEP 24576:AiiNGSGLb3uWP5mbd1LZsaj/xgu/cPr2t+0DD4nPCDcPf/eQxTgHqeGNX4TeqGlu:PCcb3XPMd1Lqaj/pkauqsL2GNX4TeXu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 3KB
SHA256 badb5be752bf79fdc12b838a7fb95ddddc460aebcd821dad19b06d93119a89dd
MD5 7892c4da60890c3f36411dc575af7986
SHA1 a18a93b9ea76fe5220777cf73048de7af95aff74
SHA512 0562011433415386cfbd777c609cb9f9de8acaad960bd6a4463caddc3a7b66784e4995d7d07af456ca364a6b2d8ab23d3f10a20e9ed281be9350a94c67b41d72
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 d288535f5a8e6bf13c44c91f577e530c28fa8afd4647401000dff7558d8d72f9
MD5 bf92fba90b71a76ef9accddbd63c5a41
SHA1 49f2fe5225b9b32115c726719bf133b5b0ecfd53
SHA512 023561a142fec0265b861a85514f04d0db90e08666b00ae254cf090dd3ba2f82a32a96e09a78e23fa612aa93042c6baeefe18e09b4a85a2586eda670b2f4e3b9
MD5 SHA1 SHA512

Submit Download

bb722388-6cde-4959-b536-7add40ed5aaa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\bb722388-6cde-4959-b536-7add40ed5aaa
Size 746B
SHA256 691fdc135284b1f99d40d78e856d888f216eefd6f1875348e646240d8d102569
MD5 169bbb417dbef9b10073f30a15cea1f1
SHA1 913e97d0e68be293df94a9472581a5bcbecb69f2
SHA512 0ff7c4896147ff970b84ca389cea1ec9baed90e14144090de9a9fe94256a6260d45a37359a79970f6563ac2caea543ca0ed5dbee0376088a45f3a06cfca1c608
MD5 SHA1 SHA512

Submit Download

ea9367db-2906-41c6-a0dd-38e61b0284e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\datareporting\glean\pending_pings\ea9367db-2906-41c6-a0dd-38e61b0284e2
Size 12KB
SHA256 9de8a9ebd541beed6b9b1048c3aada7e7f8cd79ac7cccf6897ecdcc460effae5
MD5 732254329f0671039fd6615416db6c97
SHA1 1556a617d9e21198553b56a91848ec62d57b39d2
SHA512 ae884031d613e8ffcbf5694f6d61e62781b4e2bf465f475019bc73952af202c36efaa28a822f375a7802cd1e1ae816775fc51cd66f3580388d09f349636b0d34
SSDEEP 192:NZIl6/TDDU1/HoG+I+OjEzhdlQQCLpSfmMKa1p2yRJDFivAM4IgO8WRJ+qIlUkEd:J01/fGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 3.2MB
SHA256 fbb8330cccdeff90b15481f10b14b50ee4eeade1ea2adb658d1d986085703318
MD5 08e4867c24635157560ff5ded6c21353
SHA1 86a4a325e848b770d3e7632d04c7e3d280844896
SHA512 bfe9a3e8ee2bd65fab28a56afebe71a6a4d9b5619d9db269db9c3d9592a791e7efb2be30e1f182213f71faac4654fffb19927028011710c95d59f9edcc925df3
SSDEEP 49152:5Xs+8h2DPalVFeauwvez+Wgo5xRY/+Ca1CxPkAgMwBkzRifx0rkpa1TTpfNsIAkr:lP4WQvez+WLvb1CKAFw6Rq4ytQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs-1.js
Size 9KB
SHA256 0fa3bec94f68155f84a899e0b5e034b32baed534685adc437fcc05be95ee226b
MD5 c04acc88dde54091f5e721cd4b022a35
SHA1 46779ccc70c2bdd1900fcf531517b7cfdf89b232
SHA512 bd7b2ac7119a53717c198c01a452dac487409159c078898beadffe8c8c00ada027680969a8203e05c840fed16d6cd54ec6577f2191a4a14610d3792416a7a5d1
SSDEEP 96:xHPjriynUTeqGqoFTdC+xeOTzSNPXAnpj/7yHnkIUIv0ERBw8HfIe8r:16ynIRYTdC+xe/PXy89qERBw8HE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 d2d002711b49f87b48c0e02c1923528abfdf576769d8da86ee8f11b849af4f0b
MD5 67e6b28ac0d7b9103326cdad4e29d708
SHA1 5e16d29e6520b8dac7f765e6d87058848b2ed70f
SHA512 61c33ae7a61c96aa65975b7644480377ccfa38101566ff342976d44cc5f43155a6095921fc8770ebca54e6621cc3b2ed05e8d8adba458d286d227d30f663c4c2
SSDEEP 96:xHPjri5nUTeqGqoFTdC+xeOTzSNPXAnpj/7yHnkIUIv0+Bw8Hfnc:165nIRYTdC+xe/PXy89q+Bw8HE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 acc57807c0dfdd2a52d1c27e1238a782909628364b502ea5fcea428ed46a6971
MD5 16f518d4d1820bdb613a646cbda0e33b
SHA1 934c3858c3ec9f015263faec16f25348fa4fd52a
SHA512 65891ac294f4a41fb79298a0e60c117ccceca381b960d51132c876d7d275029b90b00e95cec46bda55662c7a0c195296763855aed0b598c4cd805ec340a3474e
SSDEEP 96:xHoi5nUTeqGqoFTdCCCeOTzS5PXAnpjIaHnkIUIv0CBw8Vf2c:/5nIRYTdCCCe/PX49qCBw8VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\prefs.js
Size 6KB
SHA256 6ca10cdec0ad1508e52ee33fdde59c0572fd1fc5c910448b07ef4b72396fe3bd
MD5 3ac8c90dfe11314b656463ee2e41240e
SHA1 a834de175a7da5bf8d583225627ddee6a7946442
SHA512 fd687bbb40fece8c11f25a093427b247933cd4c7821196b93b064fa6a64efc949fb89b201c25ff15602e8b717aa3c0711c8b28a5bc019a19549989072971475b
SSDEEP 96:xHoi5nUTeqGqoFTdC+xeOTzSNPXAnpj/7yHnkIUIv0CBw8Hf2c:/5nIRYTdC+xe/PXy89qCBw8HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\er0iywxg.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 26fafbac2f94ed87ff46d27c772fe406ae0ce39815313e292e384525f6939283
MD5 0a6937d9fbc5f90db0b60d7a93064e52
SHA1 e6ad833ebea501ce62aa64046f27cac5e3b1c921
SHA512 a12240d68403ece1667333095f720f53ffd713f0833faa7c120ef420ba947ba5e0827ab87659cf8e2753f2d530d7eda739d92aa9f1cc5e8771fa2f13d3c730cb
MD5 SHA1 SHA512

Submit Download

memory/876-14093-0x00007FF8391D0000-0x00007FF839C92000-memory.dmp

Download

memory/876-14161-0x0000020DA06A0000-0x0000020DA06B0000-memory.dmp

Download

memory/876-14165-0x0000020DA06A0000-0x0000020DA06B0000-memory.dmp

Download

memory/876-18356-0x00007FF8391D0000-0x00007FF839C92000-memory.dmp

Download

memory/876-18851-0x0000020DA06A0000-0x0000020DA06B0000-memory.dmp

Download

memory/948-13477-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/948-13496-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/948-13505-0x0000000005210000-0x0000000005220000-memory.dmp

Download

memory/948-13489-0x0000000005220000-0x00000000052FC000-memory.dmp

Download

memory/948-16834-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/948-17791-0x0000000005210000-0x0000000005220000-memory.dmp

Download

memory/1656-44-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-18-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-1328-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/1656-1473-0x0000000005250000-0x0000000005260000-memory.dmp

Download

memory/1656-4783-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/1656-4784-0x0000000006FA0000-0x00000000072D8000-memory.dmp

Download

memory/1656-4785-0x0000000000EA0000-0x0000000000EEC000-memory.dmp

Download

memory/1656-66-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-64-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-4798-0x0000000009400000-0x00000000099A6000-memory.dmp

Download

memory/1656-1-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/1656-2-0x0000000005250000-0x0000000005260000-memory.dmp

Download

memory/1656-3-0x0000000005260000-0x0000000005756000-memory.dmp

Download

memory/1656-4-0x0000000006900000-0x0000000006DF0000-memory.dmp

Download

memory/1656-5-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-62-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-6-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-8-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-4811-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/1656-10-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-12-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-14-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-16-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-68-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-20-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-22-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-60-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-58-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-56-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-54-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-52-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-50-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-48-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-46-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-0-0x00000000001A0000-0x00000000006DC000-memory.dmp

Download

memory/1656-42-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-40-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-38-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-36-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-34-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-32-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-30-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-28-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-26-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/1656-24-0x0000000006900000-0x0000000006DEA000-memory.dmp

Download

memory/3472-13486-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/3472-13404-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/3472-13429-0x00000000057A0000-0x000000000583A000-memory.dmp

Download

memory/3472-4802-0x0000000005280000-0x00000000054DA000-memory.dmp

Download

memory/3472-4799-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/3472-4801-0x0000000005270000-0x0000000005280000-memory.dmp

Download

memory/3472-4804-0x0000000005550000-0x00000000057A4000-memory.dmp

Download

memory/3472-6601-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/3472-4797-0x00000000005A0000-0x0000000000840000-memory.dmp

Download

memory/3512-4808-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/3512-9445-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/3512-4810-0x00000000055E0000-0x00000000056C8000-memory.dmp

Download

memory/3512-4807-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/3512-7502-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/3512-9280-0x00000000014C0000-0x0000000001516000-memory.dmp

Download

memory/3512-9293-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Download

memory/3512-9419-0x0000000005DD0000-0x0000000005E24000-memory.dmp

Download

memory/4200-13467-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/4200-16831-0x0000000074D00000-0x00000000754B1000-memory.dmp

Download

memory/4200-14492-0x0000000005610000-0x0000000005620000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads