glupteba | fe2935e40bda3256ba7ea354b8cb475afa56c2812d7f6cca96f6b19ce7c27450

Analysis

max time kernel
14s
max time network
52s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
30/03/2024, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe2935e40bda3256ba7ea354b8cb475afa56c2812d7f6cca96f6b19ce7c27450.exe
Size 383KB
Sample240330-xza97sdd43
SHA256 fe2935e40bda3256ba7ea354b8cb475afa56c2812d7f6cca96f6b19ce7c27450
MD5 0ccc10acad4df5146549b6dcefb6233d
SHA1 30e4761cda52ce6bf7a17cc25a0e8c239ac78b5d
SHA512 b5ef07e40c67c93587ed78d3c1bbd18f223c287a3f399d58f2f768be5dfebfccc4044b8c2deb9575dd368dc8aaf9ccd87ac7bc98711483fa3183441631f150da
SSDEEP 6144:H4uq6acCpaNVmOIvBoXam8uKPPi0MAvWKDXWVFQjJn3gKnByrOvF22qOvrv/JLHY:W672aNVauXN10MkqEdn3ZByrON2AX/qd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba stealc dropper loader stealer themida

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

resource	yara_rule
behavioral2/memory/4788-69-0x0000000003140000-0x0000000003A2B000-memory.dmp	family_glupteba
behavioral2/memory/4788-70-0x0000000000400000-0x0000000000EDB000-memory.dmp	family_glupteba
behavioral2/memory/2000-83-0x0000000003190000-0x0000000003A7B000-memory.dmp	family_glupteba
behavioral2/memory/2000-95-0x0000000000400000-0x0000000000EDB000-memory.dmp	family_glupteba
behavioral2/memory/4492-119-0x0000000000400000-0x0000000000EDB000-memory.dmp	family_glupteba
behavioral2/memory/4788-179-0x0000000000400000-0x0000000000EDB000-memory.dmp	family_glupteba
behavioral2/memory/2000-191-0x0000000000400000-0x0000000000EDB000-memory.dmp	family_glupteba
behavioral2/memory/4492-200-0x0000000000400000-0x0000000000EDB000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0002000000025cc7-365.dat	themida
behavioral2/files/0x0002000000025cc7-369.dat	themida
behavioral2/memory/1844-378-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida
behavioral2/memory/1844-384-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida
behavioral2/memory/1844-388-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida
behavioral2/memory/1844-389-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida
behavioral2/memory/1844-390-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida
behavioral2/memory/1844-391-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida
behavioral2/memory/1844-392-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
4	pastebin.com

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4620	1164	WerFault.exe
3032	4792	WerFault.exe	84
3156	2372	WerFault.exe	91
1492	2372	WerFault.exe	91

C:\Users\Admin\AppData\Local\Temp\fe2935e40bda3256ba7ea354b8cb475afa56c2812d7f6cca96f6b19ce7c27450.exe
"C:\Users\Admin\AppData\Local\Temp\fe2935e40bda3256ba7ea354b8cb475afa56c2812d7f6cca96f6b19ce7c27450.exe"
1⤵
PID:3328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:4544
- - C:\Users\Admin\Pictures\F7BfYPegyISjr6J9QF1Ym2ed.exe
    "C:\Users\Admin\Pictures\F7BfYPegyISjr6J9QF1Ym2ed.exe"
    3⤵
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe"
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe"
      4⤵
      PID:2524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1272
      4⤵
      Program crash
      PID:3032
- - C:\Users\Admin\Pictures\TcvpIPPcO7VtDMYUn0htJcCE.exe
    "C:\Users\Admin\Pictures\TcvpIPPcO7VtDMYUn0htJcCE.exe"
    3⤵
    PID:4788
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5020
- - C:\Users\Admin\Pictures\wUb4Xn1SzzwRfCyWJ7GjeqYV.exe
    "C:\Users\Admin\Pictures\wUb4Xn1SzzwRfCyWJ7GjeqYV.exe"
    3⤵
    PID:2000
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1940
- - C:\Users\Admin\Pictures\dStYIaL41oMkvx2R1JXdVUqQ.exe
    "C:\Users\Admin\Pictures\dStYIaL41oMkvx2R1JXdVUqQ.exe"
    3⤵
    PID:4492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4540
- - C:\Users\Admin\Pictures\L2jRCN4RLhuTYYb1Mz1T2yat.exe
    "C:\Users\Admin\Pictures\L2jRCN4RLhuTYYb1Mz1T2yat.exe"
    3⤵
    PID:1164
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 536
        5⤵
        Program crash
        
        PID:1492
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 532
        5⤵
        Program crash
        
        PID:3156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 880
      4⤵
      Program crash
      PID:4620
- - C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
    "C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe" --silent --allusers=0
    3⤵
    PID:4468
  - - C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
      C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6e37e1d0,0x6e37e1dc,0x6e37e1e8
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\tcuK13TkzojN08TdaFy5lZCY.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\tcuK13TkzojN08TdaFy5lZCY.exe" --version
      4⤵
      PID:4520
  - - C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
      "C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4468 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240330191717" --session-guid=09e2f7c9-57f7-4100-9bea-524b3eef3eac --server-tracking-blob=OTRkZWIwMmQ0OGNmNjI5YWJjYzU5Yzk2YzVjNmExNTEzNmMyZjNjOGFkMzVmNzgyMWQ2MzFhNDg5NDBiNDhlMDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE4MjYyMjguODY1MiIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImVmYjE5MTdlLTYzNDMtNGY0Ny04NDE3LWYyOTcxMjcwMjA1NyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7004000000000000
      4⤵
      PID:3156
    - - C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
        
        C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6d78e1d0,0x6d78e1dc,0x6d78e1e8
        5⤵
        
        PID:4432
- - C:\Users\Admin\Pictures\jPZljUxx2Y6TRZnOe7oG5Jos.exe
    "C:\Users\Admin\Pictures\jPZljUxx2Y6TRZnOe7oG5Jos.exe"
    3⤵
    PID:1844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1164 -ip 1164
1⤵
PID:3260

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2372 -ip 2372
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4792 -ip 4792
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2372 -ip 2372
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 c3fe355f20220327540582575ae48cdd7ae2a5f20284344b3d984dee5ece446e
MD5 8ef2d219235351008a31b1d52bb8a457
SHA1 a9632561d813db70cb41bb8e23cafcb4468f5526
SHA512 b34bcd19a66b7e773297d77f99e37de5ecb066240bfd660eb704ab47c80be9154866851271dbee0f767948a28e4c5373032b36a087b737f577b84f0c1eb51144
SSDEEP 384:zL3HhwwjS1U7JwucFRHEMEqHnICNNDjQGIZKLj5rsUjuNey6ID7iJkLOj9tFy:nxJjSCKpRPE6IoNDjfIZKL9rxuNtvD7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 a5a22e75a8f07d729d4aa423c178d50a43f226d84712f5771ce180ac99bc949d
MD5 4817ae6823c0f78187d9e2866a65f809
SHA1 819fae798ea910922d5f080fef48af99fff7e8e1
SHA512 9788c7ad45bbf5ae4b5485d72add8b66e80c749406d586ddc01e94a47f734c5cc643a278ef9cc1ad37df2cb15fc7d3402682f6e4557796ccbbf79bffa5541d4f
SSDEEP 384:LTHhwhSS1UpR0AuFRHEMEWHGtnNmjQGIq1Lj5bsUjuNay6vDbiJ82Oj9tF+:RgSSC/+RPEmGjmjfIq1L9bxuNx4Dbiqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcuK13TkzojN08TdaFy5lZCY.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\tcuK13TkzojN08TdaFy5lZCY.exe
Size 1.8MB
SHA256 4ed8410e6228594e5c8d4321bd03f3eef61d4d0e484660417df359bfbf87dafc
MD5 c6a5415e563ea5e7fbc5d8543d4cdfc3
SHA1 9746cd919c339c71761f149afccf208fc7344cb2
SHA512 0238178acef36af56fcd2ef03196a05c6c52a05950508def6d5fc55c4d18ad332385085a5cc2069a1f840edf8224332c767886937eaf8b5b8a9655d615673001
SSDEEP 49152:g0NFN2zCC6666666666666666666666666666666x666666666666666fwwwwwwZ:g0NFA66666666666666666666666666r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2403301917174494468.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403301917174494468.dll
Size 2.4MB
SHA256 193e98da2bbcd94590d3cf5b3dc3f8903077aa0c7898f6d9a4aadfdf4a98fbc0
MD5 3ebabcbfa019d460117da035cf9ea6e7
SHA1 b8c2da7e5bfd5dd275035e846a951fceeea64428
SHA512 187b99331db2cd28187f1f5d462832681b8e16c2c55557d253a3082aa2ff102994544d4020c69f6385bbd93570a41ded401b643985a43541544786ec3b871995
SSDEEP 49152:D6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwq:D666666666666666666666666666666E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2403301917175273560.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403301917175273560.dll
Size 2.2MB
SHA256 31a80f41c3cf5632f452c640d931530b86da83071c4ee795ec787916df84d2a6
MD5 1efc229a65041979a082f4569094b114
SHA1 66ba01b476f039f9b60259c8a7f61fde7a603642
SHA512 17a50fc0ab810acfac66667c5905cb95202de4a5c34787da60b871c34e565fb4af1ead21b4236a7d2ca5e6bb599fb98147a4ebb66d5848c0ef33f7045fe02495
SSDEEP 49152:D6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwE:D666666666666666666666666666666+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2403301917176684520.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403301917176684520.dll
Size 2.3MB
SHA256 25d325f194e7ab929c2abb7e7c4b6ae1aa6f45ea2ee7695f5f54ddffdcfff5a8
MD5 9b02e620f8c67bef014a0247cfae32b7
SHA1 98f8918b3c344bc21c1c16647d4374fad37ef4d9
SHA512 5e4b5cf08a62b8d7d23a307e2fd7c858bbe37a20c72240abb86194478f8198294c323f6251346550c5b1133c49e7320e624b2adf5a474d5a7bc838fadb6232fc
SSDEEP 49152:D6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwH:D666666666666666666666666666666B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2403301917177773156.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403301917177773156.dll
Size 2.1MB
SHA256 84a0654d5d9a55572ee6d430a48072a9fdac55aa9fb832407188fd6656b68f7f
MD5 f505237412c2d2581f2efd59ff12bbde
SHA1 6017ea2ab9f5ecfd05181ceadae3d97d9acd7430
SHA512 159ba7a4b938192497e9638ad8a9f14f420d4b312b983e17ebfd21bb8316bf9818e0eb7194e25ce283da88b4c8aa3ed34540f0761a21ad9769155e41d1bc416d
SSDEEP 49152:D6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwd:D666666666666666666666666666666D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2403301917178714432.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2403301917178714432.dll
Size 1.8MB
SHA256 cc1a51bebf3aaade432dfad031f5a36085a8a4b21a1d31a768ece4b8bdb0ba3e
MD5 7a859882b26e588989d2ed7a8d1f7cf0
SHA1 0ac28ddbda697c5475a0f5936bba5f4b39ea39d1
SHA512 fd5cf9a2096f88d4f4acc3416ea6855ded649ed1f0979dda76041beb4b48b84655b1041c7fda5267626f3edd8796a6a286502941115068ff47afb42a24264667
SSDEEP 49152:D6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwA:D666666666666666666666666666666m
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_djguujtz.bsx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_djguujtz.bsx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

u3p4.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u3p4.0.exe
Size 314KB
SHA256 9b48a241ba616a59394b82a9ddee64973c9d9dd91d0445333718e655a3f92798
MD5 3dfa453901a142aad80b39a6f0bf8343
SHA1 40c81f170e986b6330dc7569694b3126fd754e57
SHA512 7535e55b961aebbd0da9b23a9a239695efccccffdcfa589552aec8a5b5b238b0040119b7176836e355101009e599ed3739346528d1849385af31e8ce8ae2bdf5
SSDEEP 6144:goE5MUvjULEfF9+A2kgjJYMp+SLpvzZZT:QMi4LEt9+tk6p++zr
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3p4.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u3p4.1.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 3162ba0a04aa109fcb5afce7c186ca2fd873c7da52fba8217a315fb8b13bd42d
MD5 c3d16705a3427e1c804e45f428965e38
SHA1 1521cffd0d94676f7e8f0548f0e6234ecf340595
SHA512 119318737adcd18dc80337bd72cd3649bb6d44a943c6a19fb6952ef51d46a91276fffabebde95a3c2ccd084a39684b34f20a220a1c1a8e6d818a266fafb187a0
MD5 SHA1 SHA512

Submit Download

F7BfYPegyISjr6J9QF1Ym2ed.exe

Path C:\Users\Admin\Pictures\F7BfYPegyISjr6J9QF1Ym2ed.exe
Size 461KB
SHA256 f31f0726a5522e52130e02ffd961183e994366420f36fa8aebc3dec0a47a4e0b
MD5 888e56c27b392164491243c581c3edde
SHA1 faeaa5127b26fbd4d8021397eece654f837fbc93
SHA512 b3ed247f4a73d86c400698dda07745ab9bed292db7eb18730f04f502dc5401d2f46727a2eb7319dea62f5475f60e6e9948f482dae04a4d22128d568e1b92e4ca
SSDEEP 6144:EoTWHUEjNV+s9bgazf+Ond5qtmF7m0qDwhJWOghkLf404Yz8jARvUcI67TLd9ysA:sHRpV+s9bgaz8yeheg0tdBh9fMmI
MD5 SHA1 SHA512 SSDEEP

Submit Download

L2jRCN4RLhuTYYb1Mz1T2yat.exe

Path C:\Users\Admin\Pictures\L2jRCN4RLhuTYYb1Mz1T2yat.exe
Size 437KB
SHA256 f6e476e8ccb571b9d7a76234953ad428e883ff4712b0062498ba3275d9749b84
MD5 7960d8afbbac06f216cceeb1531093bb
SHA1 008221bf66a0749447cffcb86f2d1ec80e23fc76
SHA512 35d12e81eb892aeb2237049beca61a81469dea5b1c9b7a0b9f49fbf95a95c756509d9e76c732fb10b504f9f9692e1fbe83ea2fd09d791f793a928c01974b8147
SSDEEP 6144:fgY0pFLSksU7U6LdDXkQrrfEwPxu7Jf1r4zZr/CS9Qn5xgabMhaQsptC/E:YY21NNLdDXk2sE6JfN4zZrlQn5PSaH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MoQ3QFERn90XqdV5Qg0COCAK.exe

Path C:\Users\Admin\Pictures\MoQ3QFERn90XqdV5Qg0COCAK.exe
Size 3KB
SHA256 57f13479a90cb11cdc9beeb083ffce3bf8a596c166d74acffd9f0d768fd2affb
MD5 648585144aad03a3bc6c41f2208bd11b
SHA1 489c6bce20a6b3446906f43a9994370a5e598534
SHA512 0a6b4d3cea62c3e32cc449ceccc4e62592af93a39aaaac84b844d513cfaece5fe32caf228990f1cef7add73aa8c47190f251cd0ecc3165ad4ca7c10926af1dca
MD5 SHA1 SHA512

Submit Download

OwRYphQUf7Fa53mc0gZ7lhyM.exe

Path C:\Users\Admin\Pictures\OwRYphQUf7Fa53mc0gZ7lhyM.exe
Size 3KB
SHA256 7be4b79b90ca0934aa222bde6811ab320b82c0613e2c4b8595c78728d990d4fc
MD5 84cdb2e986cf9136d1113f3d0fd4361d
SHA1 aa25f8a4376219ddcc0713da05ba08e4d9e00f3d
SHA512 03a5a67726f8144e42cf08485ea405f4f1b202f94f9b0390e75a02f04ff5c464d13f01614397e97d2b0ea5e379c8b9888901a0c79538976c867d7063e21f98d6
MD5 SHA1 SHA512

Submit Download

TcvpIPPcO7VtDMYUn0htJcCE.exe

Path C:\Users\Admin\Pictures\TcvpIPPcO7VtDMYUn0htJcCE.exe
Size 4.2MB
SHA256 935bfc275fd5ae0cd0f10590da932df25de14d89817438ff0874e81ba2d481db
MD5 6a0b95f57dc02ded8ea15f9b698c24d4
SHA1 4cb9a923123f74804e99d3bd02f98bd04483691a
SHA512 e1e87690245fb834638b0e4866e93e4a4051d047d289ae14060a31c3eba4aa19e7cb161f16efd5162b873bd84a8f7a8ca0c41bc5c218ac96e0ac6de867234f24
SSDEEP 98304:XUXTyVWTswnwCRTBRCXz2eDRSEreCyeCvf1Ozw0:kjyVWwSlPCjR9rvKvAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

jPZljUxx2Y6TRZnOe7oG5Jos.exe

Path C:\Users\Admin\Pictures\jPZljUxx2Y6TRZnOe7oG5Jos.exe
Size 1.7MB
SHA256 309b3ac4f8fe77359203ac00d668d7e5d26cd163acb379333c39bad81a7b8386
MD5 55fa44a0c66bfc4014edade923ce14a0
SHA1 64690aae9ae98ef0e3f2c60f9a9308741981d0f1
SHA512 7f1c732e7e8b0beb4063f0bdbbfee363fae0086659a88cef2509221f416f4b1eed0758aa9c26ebf8579c829925c2c3bf4ecc4eb0f1168b1404da7e3e42842d36
SSDEEP 24576:yZn1Ix+Qh5mvneJ03S9Cp03ajPjHFddKKB2jKloBSOxaWTesw3H/XAPjSLNgNapq:Yq+SsvneJPCjrFddKKg+pOxZxPOLJwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

jPZljUxx2Y6TRZnOe7oG5Jos.exe

Path C:\Users\Admin\Pictures\jPZljUxx2Y6TRZnOe7oG5Jos.exe
Size 1007KB
SHA256 9504833ac27908f2fa1ec979b0909d3961244c1dbe6b00b9d5b0cf8212ac939b
MD5 174c22ad16fbe71d6ca1fd1221a71295
SHA1 df5041c9672a3cf95457b18a848821b77e376c46
SHA512 bef31155f8b273c44117234d5df6276a8b1c68025d72b38ba7d706e99c450d1d9294d09c058beb53c3203f5ccc2fae06be5394dd37e123d3a8e1dfdc6fae4c3b
SSDEEP 24576:yZn1Ix+Qh5mvneJ03S9Cp03ajPjHFddKKB2a:Yq+SsvneJPCjrFddKKga
MD5 SHA1 SHA512 SSDEEP

Submit Download

qTefTiVYbAv8kcRoPjRqTsAh.exe

Path C:\Users\Admin\Pictures\qTefTiVYbAv8kcRoPjRqTsAh.exe
Size 7KB
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
SSDEEP 192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcuK13TkzojN08TdaFy5lZCY.exe

Path C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
Size 3.1MB
SHA256 43aa39738c5408872e06bbfe3b26840c5780228fc61cf5812a86311c729a378b
MD5 2ec1c31273f5c3b80c67ca12faf641f3
SHA1 85926c11d2a2339a1ac77bd5e2db6c5221de24b4
SHA512 574b56321e4715f73dcf51047b53dd8d5317e8b0ed3497ac582edd6c82718893744d4dde18173c363a965120341392509bb05a4bdf7afa39c01bd855d08631d6
SSDEEP 98304:g0NFA6666666666666666666666666666666x666666666666666fwwwwwwwwww9:4PMki6zio75L3pf3dedO4keCIwkoYbgd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcuK13TkzojN08TdaFy5lZCY.exe

Path C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
Size 2.9MB
SHA256 8993c5ff7fb0fed23fa1f2f2fb4ce6f39c72e0e5bbeea9f6e99e7072f7fa6216
MD5 0d88f98239dbceb6aca4a9357b851699
SHA1 4427b69e6aa89cfb4bd0f95f763d1a17ebe93ffa
SHA512 bb732008337448c92ea2faa4222ac347d753a66a9f71f3aaca20a3aefc3074bf0448c96fcbadf345d48772485c2d2761aca5fe5e7ea5c01eaadfe3505036d001
SSDEEP 49152:g0NFN2zCC6666666666666666666666666666666x666666666666666fwwwwwwd:g0NFA66666666666666666666666666z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcuK13TkzojN08TdaFy5lZCY.exe

Path C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
Size 3.0MB
SHA256 30b5fc2ffcef563c9c1ddb7e2a9ff1c62cc7d8985511840f38c4da39b5f30f57
MD5 5850075df1c79edd35c394f821ca7017
SHA1 88ce25fefe7630b8bcf3f5f5f3f9d5033925e480
SHA512 6282b1eeadf55754bf59040b31bc46f48b34895f3cb8ccc824a471749de7ea5cec76eb8c3ea01f956645913fdce1920a01539d011a5c1a703cdb86510ce2de51
SSDEEP 49152:g0NFN2zCC6666666666666666666666666666666x666666666666666fwwwwwwL:g0NFA66666666666666666666666666t
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcuK13TkzojN08TdaFy5lZCY.exe

Path C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
Size 2.4MB
SHA256 d002e33e1a8dd2da4c291d14d36d93673a097d628840026e6e3e00ec9b3e3623
MD5 d17c0fefd23c5202bd16a828a3eed002
SHA1 d61e4954fb3c4d847957b0dc8c2707c5c60af1cc
SHA512 8b3e0d6e3c3001b1442fcf71fbba292558324dafd8c698e5c4a150dbe9421305dd8b3cbcde85d1b345fc78a480d14ad9e02d660660660be035feedc663fcd8b0
SSDEEP 49152:g0NFN2zCC6666666666666666666666666666666x666666666666666fwwwwww5:g0NFA66666666666666666666666666r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcuK13TkzojN08TdaFy5lZCY.exe

Path C:\Users\Admin\Pictures\tcuK13TkzojN08TdaFy5lZCY.exe
Size 2.6MB
SHA256 8c71fb28b4db819d0a375444933bb13017b6b084348163974a65135839ecd0f2
MD5 5cf0b02a69e34683d3125be37fb01902
SHA1 2f81e2a2db61ffb05ba7c724d0a9a133fb8fed0d
SHA512 16b213c10744596261c96dd6db15f532d2b366a2e7768886d447ba11f33bdf9da1fc181d0642da53776d17286748e9a7a82348152f5ddcddb5aff2e3f6512309
SSDEEP 49152:g0NFN2zCC6666666666666666666666666666666x666666666666666fwwwwwwu:g0NFA66666666666666666666666666M
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUb4Xn1SzzwRfCyWJ7GjeqYV.exe

Path C:\Users\Admin\Pictures\wUb4Xn1SzzwRfCyWJ7GjeqYV.exe
Size 4.2MB
SHA256 1f7427da5c1491166e751403fedc134da0d7f232b6caa0071582d4b3bac58825
MD5 938630eeb65c102a6893d6a5c6690cd1
SHA1 49933551b9a5f875bad5b956cb3d2adb8c13fd8f
SHA512 da3a865f226c54cde13c78051e5ec1e588c77d296da8020de6f4696665632e7cd2fcd433bd770f16b70bab0cbf83ea9c8207728746e1fa0e52000f28a45b7ea6
SSDEEP 98304:nUXTyVWTswnwCRTBRCXz2eDRSEreCyeCvf1OzwA:UjyVWwSlPCjR9rvKvAL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

memory/1164-123-0x0000000002310000-0x0000000004310000-memory.dmp

Download

memory/1164-111-0x0000000000050000-0x00000000000BE000-memory.dmp

Download

memory/1164-121-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/1164-122-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Download

memory/1164-126-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/1668-216-0x00007FFBAA9E0000-0x00007FFBAABE9000-memory.dmp

Download

memory/1668-210-0x0000000002B50000-0x0000000002F50000-memory.dmp

Download

memory/1668-188-0x0000000000E90000-0x0000000000E99000-memory.dmp

Download

memory/1668-196-0x0000000077180000-0x00000000773D2000-memory.dmp

Download

memory/1668-195-0x00007FFBAA9E0000-0x00007FFBAABE9000-memory.dmp

Download

memory/1668-190-0x0000000002B50000-0x0000000002F50000-memory.dmp

Download

memory/1668-193-0x00007FFBAA9E0000-0x00007FFBAABE9000-memory.dmp

Download

memory/1668-197-0x0000000002B50000-0x0000000002F50000-memory.dmp

Download

memory/1844-391-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1844-389-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1844-378-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1844-392-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1844-384-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1844-390-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1844-388-0x00007FF79E5E0000-0x00007FF79F0EA000-memory.dmp

Download

memory/1940-150-0x0000000004DB0000-0x0000000004E16000-memory.dmp

Download

memory/1940-177-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/1940-159-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/1940-176-0x0000000004990000-0x00000000049A0000-memory.dmp

Download

memory/2000-83-0x0000000003190000-0x0000000003A7B000-memory.dmp

Download

memory/2000-182-0x0000000002D90000-0x0000000003189000-memory.dmp

Download

memory/2000-82-0x0000000002D90000-0x0000000003189000-memory.dmp

Download

memory/2000-191-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/2000-95-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/2000-393-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/2372-116-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-125-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-180-0x0000000003660000-0x0000000003A60000-memory.dmp

Download

memory/2372-183-0x0000000003660000-0x0000000003A60000-memory.dmp

Download

memory/2372-228-0x0000000003660000-0x0000000003A60000-memory.dmp

Download

memory/2372-185-0x0000000003660000-0x0000000003A60000-memory.dmp

Download

memory/2372-184-0x00007FFBAA9E0000-0x00007FFBAABE9000-memory.dmp

Download

memory/2372-120-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-187-0x0000000077180000-0x00000000773D2000-memory.dmp

Download

memory/2524-212-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/3328-0-0x0000024F97FC0000-0x0000024F97FCA000-memory.dmp

Download

memory/3328-9-0x00007FFB89BD0000-0x00007FFB8A692000-memory.dmp

Download

memory/3328-5-0x0000024F99C00000-0x0000024F99C5E000-memory.dmp

Download

memory/3328-4-0x0000024F99BE0000-0x0000024F99BFE000-memory.dmp

Download

memory/3328-3-0x0000024FB26D0000-0x0000024FB26E0000-memory.dmp

Download

memory/3328-2-0x00007FFB89BD0000-0x00007FFB8A692000-memory.dmp

Download

memory/3328-1-0x0000024FB24E0000-0x0000024FB2556000-memory.dmp

Download

memory/4492-110-0x0000000002B50000-0x0000000002F49000-memory.dmp

Download

memory/4492-192-0x0000000002B50000-0x0000000002F49000-memory.dmp

Download

memory/4492-119-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/4492-395-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/4492-200-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/4540-142-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/4540-143-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/4540-139-0x0000000004CF0000-0x0000000004D26000-memory.dmp

Download

memory/4544-112-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/4544-8-0x0000000005680000-0x0000000005690000-memory.dmp

Download

memory/4544-7-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/4544-108-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/4544-6-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4788-68-0x0000000002D40000-0x0000000003140000-memory.dmp

Download

memory/4788-179-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/4788-69-0x0000000003140000-0x0000000003A2B000-memory.dmp

Download

memory/4788-70-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/4788-372-0x0000000000400000-0x0000000000EDB000-memory.dmp

Download

memory/4788-140-0x0000000002D40000-0x0000000003140000-memory.dmp

Download

memory/4792-239-0x0000000000400000-0x0000000000B1D000-memory.dmp

Download

memory/4792-54-0x0000000000D60000-0x0000000000E60000-memory.dmp

Download

memory/4792-135-0x0000000000400000-0x0000000000B1D000-memory.dmp

Download

memory/4792-55-0x0000000002840000-0x00000000028AE000-memory.dmp

Download

memory/4792-114-0x0000000000D60000-0x0000000000E60000-memory.dmp

Download

memory/4792-56-0x0000000000400000-0x0000000000B1D000-memory.dmp

Download

memory/4836-138-0x0000000000400000-0x0000000000AF8000-memory.dmp

Download

memory/4836-137-0x0000000002830000-0x0000000002857000-memory.dmp

Download

memory/4836-136-0x0000000000D70000-0x0000000000E70000-memory.dmp

Download

memory/4836-211-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/5020-144-0x0000000005450000-0x0000000005472000-memory.dmp

Download

memory/5020-157-0x0000000005D60000-0x00000000060B7000-memory.dmp

Download

memory/5020-245-0x0000000007620000-0x0000000007654000-memory.dmp

Download

memory/5020-154-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Download

memory/5020-158-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/5020-181-0x0000000006210000-0x000000000625C000-memory.dmp

Download

memory/5020-156-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/5020-155-0x00000000748A0000-0x0000000075051000-memory.dmp

Download

memory/5020-178-0x00000000061D0000-0x00000000061EE000-memory.dmp

Download

memory/5020-141-0x0000000005490000-0x0000000005ABA000-memory.dmp

Download

memory/5020-199-0x0000000007320000-0x0000000007366000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads