Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/03/2024, 00:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    198c9b20feddedfddb616676b4d100996d583b29314f8046de476e47b6a98201.exe
  • Size 267KB
  • Sample240329-akjlpscd31
  • SHA256 198c9b20feddedfddb616676b4d100996d583b29314f8046de476e47b6a98201
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdjvugluptebaredlinesmokeloaderlogsdiller cloud (tg: @logsdillabot)pub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

  • smokeloader

Botnet

  • pub1

Extracted

Family

  • smokeloader

Version

  • 2022

C2

  • http://trad-einmyus.com/index.php

  • http://tradein-myus.com/index.php

  • http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

  • djvu

C2

  • http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

  • redline

Botnet

  • LogsDiller Cloud (TG: @logsdillabot)

C2

  • 5.42.65.0:29587

Signatures

  • DcRat 4 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 61 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\198c9b20feddedfddb616676b4d100996d583b29314f8046de476e47b6a98201.exe
    "C:\Users\Admin\AppData\Local\Temp\198c9b20feddedfddb616676b4d100996d583b29314f8046de476e47b6a98201.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4932
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A345.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:4860
    • C:\Users\Admin\AppData\Local\Temp\C814.exe
      C:\Users\Admin\AppData\Local\Temp\C814.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Users\Admin\AppData\Local\Temp\C814.exe
        C:\Users\Admin\AppData\Local\Temp\C814.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\e367c115-ab1a-4f7f-8772-20f0036eea57" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:4872
        • C:\Users\Admin\AppData\Local\Temp\C814.exe
          "C:\Users\Admin\AppData\Local\Temp\C814.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Users\Admin\AppData\Local\Temp\C814.exe
            "C:\Users\Admin\AppData\Local\Temp\C814.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            PID:3448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 600
              5⤵
              • Program crash
              PID:1964
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448
      1⤵
        PID:3136
      • C:\Users\Admin\AppData\Local\Temp\D94B.exe
        C:\Users\Admin\AppData\Local\Temp\D94B.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 840
          2⤵
          • Program crash
          PID:4916
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2988 -ip 2988
        1⤵
          PID:2936
        • C:\Users\Admin\AppData\Local\Temp\F715.exe
          C:\Users\Admin\AppData\Local\Temp\F715.exe
          1⤵
          • Executes dropped EXE
          PID:5020
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F90A.bat" "
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4420
          • C:\Windows\system32\reg.exe
            reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
            2⤵
              PID:3972
          • C:\Users\Admin\AppData\Local\Temp\22AB.exe
            C:\Users\Admin\AppData\Local\Temp\22AB.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:4668
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              2⤵
                PID:3468
            • C:\Users\Admin\AppData\Local\Temp\2E74.exe
              C:\Users\Admin\AppData\Local\Temp\2E74.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1564
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3676
              • C:\Users\Admin\AppData\Local\Temp\2E74.exe
                "C:\Users\Admin\AppData\Local\Temp\2E74.exe"
                2⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:3604
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                  • Drops file in System32 directory
                  PID:4416
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  3⤵
                    PID:3632
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      4⤵
                      • Modifies Windows Firewall
                      PID:2152
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    3⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:3676
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    3⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:4848
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    3⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Manipulates WinMonFS driver.
                    • Drops file in Windows directory
                    PID:5056
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:5052
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • DcRat
                      • Creates scheduled task(s)
                      PID:4696
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      4⤵
                        PID:4164
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:4952
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:4784
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        4⤵
                        • Executes dropped EXE
                        PID:3920
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        4⤵
                        • DcRat
                        • Creates scheduled task(s)
                        PID:3104
                      • C:\Windows\windefender.exe
                        "C:\Windows\windefender.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:3680
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          5⤵
                            PID:3092
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              6⤵
                              • Launches sc.exe
                              PID:4564
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:2448
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:2324
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3084
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:932
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:4600
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:4520
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3216
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:3988
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:3352

                  Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        File and Directory Permissions Modification

                        1
                        T1222

                        Impair Defenses

                        1
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Modify Registry

                        3
                        T1112

                        Credential Access

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        5
                        T1012

                        System Information Discovery

                        5
                        T1082

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        DiscoverCacheData.dat
                        • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                        • Size 1022B
                        • SHA256 13a1b057046110fb3f24d017430d516b85497bfc265e085b93cf7c853e96f238
                        • MD5 SHA1 SHA512
                        Submit Download

                        22AB.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\22AB.exe
                        • Size 30.6MB
                        • SHA256 2f625ea35f82332c639049c4a849f39cd2b74acb013880d156a2f647497c2512
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        2E74.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\2E74.exe
                        • Size 4.2MB
                        • SHA256 bd63d276dd1c49db677a5e32cf36f11c4140fe66840baf18e6bf3f960f0ce3da
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        A345.bat
                        • Path C:\Users\Admin\AppData\Local\Temp\A345.bat
                        • Size 77B
                        • SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
                        • MD5 SHA1 SHA512
                        Submit Download

                        C814.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\C814.exe
                        • Size 765KB
                        • SHA256 f8f078090823e52e8ddff7b987ba9723fb9f5d450c65785c18d5e9c9c19f7df5
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        D94B.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\D94B.exe
                        • Size 392KB
                        • SHA256 da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        F715.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\F715.exe
                        • Size 6.5MB
                        • SHA256 4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        __PSScriptPolicyTest_hbybdt2m.k2q.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbybdt2m.k2q.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512
                        Submit Download

                        injector.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        • Size 281KB
                        • SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        powershell.exe.log
                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                        • Size 2KB
                        • SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-Interactive
                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        • Size 19KB
                        • SHA256 ebe306f833f6604f2a25c79865a56cdfe54d12a61ad10efde9dd785948f92561
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        StartupProfileData-Interactive
                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        • Size 19KB
                        • SHA256 ae20b625e46081c8ed3c1e19aac2383015d4f5bb6f016cc8473e90cc4d3197cb
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        StartupProfileData-Interactive
                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        • Size 19KB
                        • SHA256 bb1cad8a26b0dacd70d6823a6fbb70cf921eaeaaaddfae5c0da9195969e7f865
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        StartupProfileData-Interactive
                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        • Size 19KB
                        • SHA256 1b5851cf0a5b33a21334379f48a5de746b7e70ae3720144e8194f9293f5dbfbf
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        StartupProfileData-Interactive
                        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        • Size 19KB
                        • SHA256 ba956c8919a520246c9e02fb0ff98014ef82e3f7ac12ebc7d143b2c2275e408d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        windefender.exe
                        • Path C:\Windows\windefender.exe
                        • Size 2.0MB
                        • SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        memory/1564-272-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/1880-38-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/1880-26-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/1880-25-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/1880-24-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/1880-22-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/2772-41-0x00000000027D0000-0x000000000286B000-memory.dmp
                        Download

                        memory/2988-70-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
                        Download

                        memory/2988-81-0x0000000074B90000-0x0000000075341000-memory.dmp
                        Download

                        memory/2988-68-0x0000000074B90000-0x0000000075341000-memory.dmp
                        Download

                        memory/2988-77-0x0000000002C50000-0x0000000004C50000-memory.dmp
                        Download

                        memory/2988-67-0x0000000000690000-0x00000000006F4000-memory.dmp
                        Download

                        memory/2988-69-0x00000000051F0000-0x0000000005200000-memory.dmp
                        Download

                        memory/3272-4-0x00000000027E0000-0x00000000027F6000-memory.dmp
                        Download

                        memory/3272-224-0x0000000002810000-0x0000000002811000-memory.dmp
                        Download

                        memory/3352-656-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Download

                        memory/3352-651-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Download

                        memory/3448-47-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/3448-45-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/3448-44-0x0000000000400000-0x0000000000537000-memory.dmp
                        Download

                        memory/3468-403-0x0000000000F50000-0x0000000000F9B000-memory.dmp
                        Download

                        memory/3468-399-0x0000000000F50000-0x0000000000F9B000-memory.dmp
                        Download

                        memory/3604-431-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/3604-407-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/3680-648-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Download

                        memory/4440-20-0x0000000002870000-0x0000000002905000-memory.dmp
                        Download

                        memory/4440-21-0x0000000002950000-0x0000000002A6B000-memory.dmp
                        Download

                        memory/4600-365-0x00000283FB540000-0x00000283FB560000-memory.dmp
                        Download

                        memory/4668-295-0x00007FF649F10000-0x00007FF64BE5C000-memory.dmp
                        Download

                        memory/4668-404-0x00007FF649F10000-0x00007FF64BE5C000-memory.dmp
                        Download

                        memory/4732-80-0x00000000053C0000-0x00000000053D0000-memory.dmp
                        Download

                        memory/4732-79-0x0000000005360000-0x000000000536A000-memory.dmp
                        Download

                        memory/4732-86-0x0000000005D00000-0x0000000005D4C000-memory.dmp
                        Download

                        memory/4732-85-0x0000000005590000-0x00000000055CC000-memory.dmp
                        Download

                        memory/4732-84-0x0000000005530000-0x0000000005542000-memory.dmp
                        Download

                        memory/4732-73-0x0000000000400000-0x0000000000450000-memory.dmp
                        Download

                        memory/4732-75-0x0000000005750000-0x0000000005CF6000-memory.dmp
                        Download

                        memory/4732-76-0x00000000052A0000-0x0000000005332000-memory.dmp
                        Download

                        memory/4732-78-0x0000000074B90000-0x0000000075341000-memory.dmp
                        Download

                        memory/4732-83-0x0000000005600000-0x000000000570A000-memory.dmp
                        Download

                        memory/4732-87-0x0000000005E40000-0x0000000005EA6000-memory.dmp
                        Download

                        memory/4732-82-0x0000000006320000-0x0000000006938000-memory.dmp
                        Download

                        memory/4932-1-0x0000000000E50000-0x0000000000F50000-memory.dmp
                        Download

                        memory/4932-5-0x0000000000400000-0x0000000000AEC000-memory.dmp
                        Download

                        memory/4932-3-0x0000000000400000-0x0000000000AEC000-memory.dmp
                        Download

                        memory/4932-2-0x0000000000CC0000-0x0000000000CCB000-memory.dmp
                        Download

                        memory/5020-126-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-103-0x0000000003220000-0x0000000003221000-memory.dmp
                        Download

                        memory/5020-110-0x0000000003270000-0x00000000032B0000-memory.dmp
                        Download

                        memory/5020-129-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-128-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-131-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-130-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-132-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-133-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-134-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-135-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-136-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-137-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-139-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-138-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-141-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-140-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-142-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-143-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-144-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-145-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-146-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-147-0x00000000040D0000-0x00000000040D1000-memory.dmp
                        Download

                        memory/5020-109-0x00000000003F0000-0x00000000010D5000-memory.dmp
                        Download

                        memory/5020-107-0x0000000003260000-0x0000000003261000-memory.dmp
                        Download

                        memory/5020-106-0x0000000003240000-0x0000000003241000-memory.dmp
                        Download

                        memory/5020-105-0x00000000003F0000-0x00000000010D5000-memory.dmp
                        Download

                        memory/5020-127-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-104-0x0000000003230000-0x0000000003231000-memory.dmp
                        Download

                        memory/5020-102-0x00000000031F0000-0x00000000031F1000-memory.dmp
                        Download

                        memory/5020-101-0x00000000031E0000-0x00000000031E1000-memory.dmp
                        Download

                        memory/5020-95-0x00000000003F0000-0x00000000010D5000-memory.dmp
                        Download

                        memory/5020-125-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-124-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-122-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-123-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-121-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-120-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-118-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-119-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-117-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-116-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-115-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-111-0x0000000003270000-0x00000000032B0000-memory.dmp
                        Download

                        memory/5020-114-0x0000000003FD0000-0x00000000040D0000-memory.dmp
                        Download

                        memory/5020-113-0x0000000003270000-0x00000000032B0000-memory.dmp
                        Download

                        memory/5020-112-0x0000000003270000-0x00000000032B0000-memory.dmp
                        Download

                        memory/5056-650-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/5056-649-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/5056-652-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/5056-638-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/5056-655-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/5056-657-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download

                        memory/5056-659-0x0000000000400000-0x0000000000ECF000-memory.dmp
                        Download