amadey | d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9

Analysis

max time kernel
150s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
Size 1.8MB
Sample240409-gre1esbg4w
SHA256 d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9
MD5 97340da7927478220519c911d091bb02
SHA1 a4418eb89f79622898d2bed2e46572bed2461b71
SHA512 fe21f9e33c8826a3d1dd82a52d98b667fe81be9060ed61698dcd0f3198da90b9adee2fb05aa9a3f59041728aa5016983ebe9430ae06ddc2d9aeda84feae99c34
SSDEEP 49152:AdUhuK40n+pNJbYa5F7amMsJF6Uwa+9iS:AdJ7YoNJ9vJ8UwZ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	58562aa7fa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
22	928	rundll32.exe
35	4252	rundll32.exe
39	2664	rundll32.exe
40	1524	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	58562aa7fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	58562aa7fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Executes dropped EXE 7 IoCs

pid	Process
764	explorha.exe
1132	58562aa7fa.exe
4416	amert.exe
2860	352f01dcf2.exe
2008	explorgu.exe
2748	explorha.exe
4168	explorha.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	58562aa7fa.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorha.exe

Loads dropped DLL 6 IoCs

pid	Process
1736	rundll32.exe
928	rundll32.exe
4252	rundll32.exe
3988	rundll32.exe
2664	rundll32.exe
1524	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0002000000025c73-90.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
764	explorha.exe
1132	58562aa7fa.exe
4416	amert.exe
2008	explorgu.exe
2748	explorha.exe
4168	explorha.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorha.job	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
File created	C:\Windows\Tasks\explorgu.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571161637098404"	chrome.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
764	explorha.exe
764	explorha.exe
1132	58562aa7fa.exe
1132	58562aa7fa.exe
4416	amert.exe
4416	amert.exe
3404	chrome.exe
3404	chrome.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
928	rundll32.exe
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe
2008	explorgu.exe
2008	explorgu.exe
2748	explorha.exe
2748	explorha.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe
3404	chrome.exe
3404	chrome.exe
4168	explorha.exe
4168	explorha.exe
3248	chrome.exe
3248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
2860	352f01dcf2.exe
3404	chrome.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
3404	chrome.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe
2860	352f01dcf2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 764	2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe	80
PID 2952 wrote to memory of 764	2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe	80
PID 2952 wrote to memory of 764	2952	d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe	80
PID 764 wrote to memory of 1132	764	explorha.exe	81
PID 764 wrote to memory of 1132	764	explorha.exe	81
PID 764 wrote to memory of 1132	764	explorha.exe	81
PID 764 wrote to memory of 4504	764	explorha.exe	82
PID 764 wrote to memory of 4504	764	explorha.exe	82
PID 764 wrote to memory of 4504	764	explorha.exe	82
PID 764 wrote to memory of 4416	764	explorha.exe	83
PID 764 wrote to memory of 4416	764	explorha.exe	83
PID 764 wrote to memory of 4416	764	explorha.exe	83
PID 764 wrote to memory of 2860	764	explorha.exe	84
PID 764 wrote to memory of 2860	764	explorha.exe	84
PID 764 wrote to memory of 2860	764	explorha.exe	84
PID 2860 wrote to memory of 3404	2860	352f01dcf2.exe	85
PID 2860 wrote to memory of 3404	2860	352f01dcf2.exe	85
PID 3404 wrote to memory of 3844	3404	chrome.exe	88
PID 3404 wrote to memory of 3844	3404	chrome.exe	88
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 1948	3404	chrome.exe	90
PID 3404 wrote to memory of 4724	3404	chrome.exe	91
PID 3404 wrote to memory of 4724	3404	chrome.exe	91
PID 3404 wrote to memory of 3076	3404	chrome.exe	92
PID 3404 wrote to memory of 3076	3404	chrome.exe	92
PID 3404 wrote to memory of 3076	3404	chrome.exe	92
PID 3404 wrote to memory of 3076	3404	chrome.exe	92
PID 3404 wrote to memory of 3076	3404	chrome.exe	92

C:\Users\Admin\AppData\Local\Temp\d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe
"C:\Users\Admin\AppData\Local\Temp\d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Users\Admin\AppData\Local\Temp\1000042001\58562aa7fa.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\58562aa7fa.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\1000051001\352f01dcf2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000051001\352f01dcf2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc29f29758,0x7ffc29f29768,0x7ffc29f29778
        5⤵
        
        PID:3844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:2
        5⤵
        
        PID:1948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:4724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:3076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:1
        5⤵
        
        PID:4800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:1
        5⤵
        
        PID:4964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4444 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:1
        5⤵
        
        PID:4124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3836 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:4764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:2972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:1980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:4792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:8
        5⤵
        
        PID:704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4956 --field-trial-handle=1836,i,3566462590527178931,119632743009734430,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3248
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:1736
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:928
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:4536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084248216164_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:4252

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:688

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:3988
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2664
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084248216164_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1524

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8987bfe1-b15f-438a-9a0c-10a9ccea76d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8987bfe1-b15f-438a-9a0c-10a9ccea76d9.tmp
Size 131KB
SHA256 ad6b2bd05fcc7ccc43d475a68cfc1578f787546d6104dad6ffa46e74587e4ce7
MD5 4f3bba0a22382fbe2c21a0128264460f
SHA1 27dac1ec79cfd607bebe0297c108ea6348c803ff
SHA512 05b3d303cd2cc3482133aa25fdcac10b80f3721c8eb88967cdc003eb57b07b77a3e9342c5ba59987d19e0aabed1f492e70d0cb3f5d511d833b0e20e248182826
SSDEEP 3072:tRCJ6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5B:toJ6d7Yj3Ua9jHThM8fNHK9K5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 c5b7ba4e83d83ed33b74899f1c1bba32105392ef0e76bd799490900f2123e324
MD5 e75f2d0850a931801f2d51d5f3b49b0d
SHA1 7f144d0686304fcef214fe6c5524c1610cf49e23
SHA512 e06696031cf08e52d47b88969e90f738a61fc88ee7bd279cbfb40df82ea53b21a6b82020e5e8a38df157aa86921ea3c958f2db097f56e7320ecb71513e54ef3b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 72732b2c8d87271abc1ca9567852e998a5748b28cb155e9497fcf19fbf1cc4c9
MD5 38a78a15a1ab462651d6af69cdc5ca2e
SHA1 11e4e16d84ef3f26e7aecd9f1580f18a5d7ae1fb
SHA512 670c5d016e5b9f88b5bcda32d4e276a668770cf93e9a88ad835c8313dfd4d917349b58d0638cf2bac39974c2f04476f1367926a4f326a5910ae506c70e4d5ab1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 707B
SHA256 c66bfae4e4a5b14fa600ee6bdf72b48532f34e38d0b628d36d2aa1e29fbed017
MD5 3d10837ca49b25d3ede223fd4fa96ebb
SHA1 2ad2c03cd055c969a73ff93a2dd1b2dcebe1c4ca
SHA512 d250c272c4a0cfd6411b16cb6a76aa5121fc856a738c86d3b103dcdb225daf1ec8d0d0c6761957babbe3c17fc033642a63fe742730fb75fc3c9d0babb3a221a2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3c9e15c5e7266d21b3da1b8b3984cfccf1a98f8cfeaa2fee5a57b9075919effc
MD5 91472b21e16abac706d8448ac49c0928
SHA1 4e4e716a7faac3a68854c52a931fadf9c212517d
SHA512 40c4d5fb50c9d2bac538271f1afec57b13b3d4ff2626f97699ecad52f7f8fd37d81e405a9bfaf015f8fd19bfdbb43b335dcef71a31b045d3627cc00c94e9072f
SSDEEP 192:4GAB6lmZ8TO+yy+FdkR1hLaotjEsXtScPS:4GAB0yxS1hL9tIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 150448fbc0faa818f94821286b35832e41bc8756568334fdb168d6b2c03ab674
MD5 82fd831c40fb4fa46874afc24bfca383
SHA1 055b9448e6bfc79a7031219e6d66269a48e82b5b
SHA512 1411bbf09c0569934301f09a518ecb1005d2401f9e95fb2489e34451e9a275d2aac8e602b817c5a378b0f63f677803fd068f4b1abda6e69dfdaf09060c7f31a8
SSDEEP 384:NZ2xSLPLeFZ/XSZ51kXqKf/pUZNCgVLH2HfkRZ3rUu7HGPsWsEI:vhLPLAvm51kXqKf/pUZNCgVLH2HfK3r7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 284b283febea3550da0adf263dda4b9867a63e90369daa650cedb320029bedea
MD5 5114a43a8429d1f473c095387bc1b68c
SHA1 123ea4cc4ea5072faa8dc31596e8eef4858a8226
SHA512 01eca393c622e234a83aef30948989afc9722b3030d6b835c739784e34106afc4054862f8b5cf5fa111f411b005baa64498798db548d0540926eb7f69bf9a8a5
SSDEEP 6144:jQ3Zr8ybhaYQaUI3suNMHacnXJkQYzJ6d7Yj3Ua9jHThM8fNHK9K5Y:aZwAhaZaUIR66oXJlCIsbUYHTqwNqo5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 b8c52ec2bd90dd5137834709aae55e39d3bdafb60ab2e6db9942b90114280e7e
MD5 e569912bc73713b8cbac86394c6f7434
SHA1 529faceffc2e454a65a23ff02107b2a7b6a434ff
SHA512 c5fbf626610df2fdd84752c001f1730b902b4f2616f34e41be3107bb48f68283151a0546ca70b30de8eebe281ce8916bf11c08def8ea01384959486310adcd23
SSDEEP 6144:jPdg3Zr8ybhaYQaUI3suNMHacnXJkQYzJ6d7Yj3Ua9jHThM8fNHK9K5Y:wZwAhaZaUIR66oXJlCIsbUYHTqwNqo5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a
MD5 ae626d9a72417b14570daa8fcd5d34a4
SHA1 c103ebaf4d760df722d620df87e6f07c0486439f
SHA512 a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 02b28ebbce54c6722b45cc497a275c60698c1be6085cd2bd8bfd5a4c8a7b053f
MD5 6a3d2d8ec742f283d8aa08d1382996e6
SHA1 122eabf3e0b279fea6e837d55cd642b16e352ea3
SHA512 fc7ac5f6c369ec6e2bd5aca829d2f75eaadf03623e1d2ba4b563a86a62eb6c9ec953b641c3e38ce6ac7e6d6cde281f59c26d992d3f510880b3fe1919ea412dae
MD5 SHA1 SHA512

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 1.8MB
SHA256 d7865c82c983722896bfcce4153b1f32c332e04ade7190fceafbb68baa516ea9
MD5 97340da7927478220519c911d091bb02
SHA1 a4418eb89f79622898d2bed2e46572bed2461b71
SHA512 fe21f9e33c8826a3d1dd82a52d98b667fe81be9060ed61698dcd0f3198da90b9adee2fb05aa9a3f59041728aa5016983ebe9430ae06ddc2d9aeda84feae99c34
SSDEEP 49152:AdUhuK40n+pNJbYa5F7amMsJF6Uwa+9iS:AdJ7YoNJ9vJ8UwZ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

58562aa7fa.exe

Path C:\Users\Admin\AppData\Local\Temp\1000042001\58562aa7fa.exe
Size 2.2MB
SHA256 3aaac29bcdd83a7ad264dc6fb9e1aa8e8bdaadfc2861cc9a935ed82d97315adf
MD5 3dfd3254dea18354e452f85a52483bd9
SHA1 7b70c41f745a27af33f2c20797c3c821f74321d3
SHA512 b55f23480b153c1d2ececd0b346f3ed5f944d2e5611e2a8b4ec91e5f39e100671a5ee1da5f2e8b17ed7531e67dda61f5674ac0c5bea366e64b50b61f011d65e9
SSDEEP 49152:1s9NRR5MmyC8+C4A7q7Fjt+9GVD1I4d7s4AvQ2CRrG0v:1QNRG34A7Yt+9G84S4B9G0
MD5 SHA1 SHA512 SSDEEP

Submit Download

amert.exe

Path C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe
Size 1.8MB
SHA256 8a353d394d588f20e854797dfcc3a5ae4f7aabf4955578a0211481b7e3b4c943
MD5 3bd159fb866541963b1ab0c420667ec2
SHA1 d2cfc1a4c19684f59cb74c1a798a6f5f417668d3
SHA512 4da7d4bb8c9e81754d253786bfe1cfc620d42aae1bb47df606a758a929f54f224994578711477d5c9ae70bc2521be85aedec22bc032b4ad262dbd567b2499015
SSDEEP 24576:7AxwCTiobHgKye856HPmX5OAeWJmjAFryUBQzVTQp3bH4FoGCxUeykx16zVLX4cM:74wC2wQOPmT7VjBqeEaGCxikx61YytO
MD5 SHA1 SHA512 SSDEEP

Submit Download

352f01dcf2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000051001\352f01dcf2.exe
Size 1.1MB
SHA256 bad9659524b7e301de1fb3bfc8bd6ba3353b83f71f521469543228bdc42dca06
MD5 9bcdd6cdd7223dabf6b1cce4b806fd10
SHA1 2ff332735bf985948741b6d4accc88a6113c2a91
SHA512 408532da1edc5240a7a93746e3d5071c36055596f62fbb7ef30124a42c7224c00a8c89e5e2eaa1fd4a5ca11be46322fd8ea178773587112243d2ef73d39210ae
SSDEEP 24576:JqDEvCTbMWu7rQYlBQcBiT6rprG8a3J2+b+HdiJUt:JTvC/MTQYxsWR7a3J2+b+HoJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_rhaatqdg.pky.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rhaatqdg.pky.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 109KB
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
SSDEEP 3072:xE5kJp+s5aP40bGsuZR+SVhJQ3ICRv4l:m5ka2obfuZR7Py4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 1.2MB
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
SSDEEP 24576:ZvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgg/l+yC7:ZsMPSYcS5wPi095PbgWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/764-358-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-220-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-388-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-385-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-382-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-370-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-366-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-29-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/764-337-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-28-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/764-317-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-396-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-27-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/764-272-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-25-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/764-244-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-79-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-19-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-26-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Download

memory/764-24-0x0000000004B00000-0x0000000004B01000-memory.dmp

Download

memory/764-177-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/764-23-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download

memory/764-22-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Download

memory/764-128-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/1132-315-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-52-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/1132-57-0x0000000004B10000-0x0000000004B11000-memory.dmp

Download

memory/1132-47-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-395-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-58-0x0000000004B70000-0x0000000004B71000-memory.dmp

Download

memory/1132-155-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-56-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/1132-50-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/1132-330-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-59-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download

memory/1132-60-0x0000000004BA0000-0x0000000004BA2000-memory.dmp

Download

memory/1132-271-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-54-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/1132-339-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-387-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-55-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/1132-49-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/1132-384-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-365-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-51-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/1132-219-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-381-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-53-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Download

memory/1132-368-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/1132-239-0x0000000000D30000-0x00000000012D2000-memory.dmp

Download

memory/2008-359-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-386-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-367-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-251-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-252-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/2008-254-0x0000000004C60000-0x0000000004C61000-memory.dmp

Download

memory/2008-253-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/2008-255-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/2008-257-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/2008-371-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-383-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-318-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-256-0x0000000004C10000-0x0000000004C11000-memory.dmp

Download

memory/2008-242-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-263-0x0000000004C80000-0x0000000004C81000-memory.dmp

Download

memory/2008-397-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-338-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-389-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2008-273-0x0000000000B50000-0x0000000001003000-memory.dmp

Download

memory/2160-167-0x000001BE42E70000-0x000001BE42E80000-memory.dmp

Download

memory/2160-168-0x000001BE5CE00000-0x000001BE5CE12000-memory.dmp

Download

memory/2160-166-0x000001BE42E70000-0x000001BE42E80000-memory.dmp

Download

memory/2160-165-0x00007FFC26D20000-0x00007FFC277E2000-memory.dmp

Download

memory/2160-164-0x000001BE44BF0000-0x000001BE44C12000-memory.dmp

Download

memory/2160-169-0x000001BE5CDF0000-0x000001BE5CDFA000-memory.dmp

Download

memory/2160-175-0x00007FFC26D20000-0x00007FFC277E2000-memory.dmp

Download

memory/2748-262-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/2748-264-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/2748-245-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/2748-270-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/2748-259-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/2748-258-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/2748-260-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/2748-261-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/2952-5-0x0000000005400000-0x0000000005401000-memory.dmp

Download

memory/2952-1-0x00000000775A6000-0x00000000775A8000-memory.dmp

Download

memory/2952-20-0x00000000009C0000-0x0000000000E56000-memory.dmp

Download

memory/2952-6-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/2952-3-0x0000000005420000-0x0000000005421000-memory.dmp

Download

memory/2952-4-0x0000000005460000-0x0000000005461000-memory.dmp

Download

memory/2952-8-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/2952-0-0x00000000009C0000-0x0000000000E56000-memory.dmp

Download

memory/2952-7-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/2952-2-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/4168-380-0x00000000009B0000-0x0000000000E46000-memory.dmp

Download

memory/4416-80-0x0000000005770000-0x0000000005771000-memory.dmp

Download

memory/4416-81-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/4416-78-0x0000000000E00000-0x00000000012B3000-memory.dmp

Download

memory/4416-82-0x0000000005760000-0x0000000005761000-memory.dmp

Download

memory/4416-83-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/4416-85-0x0000000005750000-0x0000000005751000-memory.dmp

Download

memory/4416-84-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/4416-86-0x0000000000E00000-0x00000000012B3000-memory.dmp

Download

memory/4416-106-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/4416-110-0x0000000000E00000-0x00000000012B3000-memory.dmp

Download