metasploit | 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

Resubmissions

09/04/2024, 07:01

240409-htps3scd2w10

09/04/2024, 07:01

09/04/2024, 07:00

09/04/2024, 07:00

07/03/2024, 22:29

Analysis

max time kernel
3s
max time network
64s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/04/2024, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Text Document mod.exe
Size 8KB
Sample240409-htps3scd2w
SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
MD5 69994ff2f00eeca9335ccd502198e05b
SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP 96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit redline risepro stealc xworm zgrat 6077866846 backdoor infostealer rat stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

91.92.247.21:8405

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Extracted

Family

xworm

94.156.8.213:58002

Attributes

Install_directory
%Public%
install_file
svchost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral6/memory/4472-262-0x0000000000130000-0x0000000000146000-memory.dmp	family_xworm
behavioral6/files/0x000700000001abc5-261.dat	family_xworm

Detect ZGRat V1 26 IoCs

resource	yara_rule
behavioral6/memory/2148-120-0x0000024521340000-0x00000245215B6000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-129-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-138-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-140-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-145-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-151-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-154-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-156-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-159-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-162-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-171-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-179-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-186-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-190-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-196-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-201-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-209-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-213-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-215-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-218-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-226-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-233-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-254-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-266-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-263-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1
behavioral6/memory/2148-240-0x0000024521340000-0x00000245215B1000-memory.dmp	family_zgrat_v1

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral6/memory/4700-38-0x0000000001330000-0x0000000001352000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral6/files/0x000800000001aba6-6.dat	themida
behavioral6/memory/1232-82-0x00000000000D0000-0x00000000011EC000-memory.dmp	themida
behavioral6/memory/1232-91-0x00000000000D0000-0x00000000011EC000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
21	pastebin.com
22	pastebin.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral6/files/0x000700000001abb4-90.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3216	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	New Text Document mod.exe

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:388
- C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
  2⤵
  PID:1232
- C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
  2⤵
  PID:3948
- - C:\Users\Admin\AppData\Local\Temp\QgznpbfJ.exe
    "C:\Users\Admin\AppData\Local\Temp\QgznpbfJ.exe"
    3⤵
    PID:4164
- C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
  "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
  "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
  2⤵
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
  2⤵
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
    3⤵
    PID:3916
- C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
  "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
  2⤵
  PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
    3⤵
    PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionExtension .exe
      4⤵
      PID:876
- - C:\Windows\Temp\Temp.exe
    "C:\Windows\Temp\Temp.exe" -s
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\MService.exe
    "C:\Windows\SysWOW64\MService.exe"
    3⤵
    PID:3280
- C:\Users\Admin\AppData\Local\Temp\a\Props.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
  2⤵
  PID:1256
- C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\a\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
  2⤵
  PID:1080
- C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
  2⤵
  PID:3932
- - C:\Users\Admin\AppData\Local\Temp\u318.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u318.0.exe"
    3⤵
    PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JJEGCBGIDH.exe"
      4⤵
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\JJEGCBGIDH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JJEGCBGIDH.exe"
        5⤵
        
        PID:4212
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\JJEGCBGIDH.exe
        6⤵
        
        PID:2848
- - C:\Users\Admin\AppData\Local\Temp\u318.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u318.1.exe"
    3⤵
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      PID:4260
- C:\Users\Admin\AppData\Local\Temp\a\test2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
  2⤵
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
  2⤵
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u1sg.0.exe"
    3⤵
    PID:1924
- C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
  2⤵
  PID:4472
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3216

C:\Users\Public\svchost.exe
C:\Users\Public\svchost.exe
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

responsibilitylead.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
Size 6KB
SHA256 163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a
MD5 f7930c4859ccd34bd2b80a9995f49926
SHA1 8b5b95fb51619e20246f90d60f2137da7654fc5e
SHA512 8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43
SSDEEP 96:e8uC5NiIy2tVikPIkpCLaG+yYepjHm8cBZ+z24Q9QTQ7zNt:GR7cckPIHLg8Hm8Q+5Q9QUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

responsiibilitylead.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe
Size 6KB
SHA256 4588ad64c432d7a20ba41949327be873c25f7eaa0cbba71b3435463739510035
MD5 a0c8b99e0780c3e8f8319f5ec3abf9f4
SHA1 561a59a4d6af134797b2e2907590efee9e519ca3
SHA512 30bd51b731ab989188ae3597f37ba74d56d78287afcb2c2243f657a131618ba6e83d34b82253b6d42efab7a01da0397fb496478628393b4cffca4c907d39f961
SSDEEP 96:VvuSCLNiIK2HVPPMHjeyCPWt/U1jHm8c1z/59f9272ezNt:8SnLmVPUC+yHm8uz/7f92C4
MD5 SHA1 SHA512 SSDEEP

Submit Download

JJEGCBGIDH.exe

Path C:\Users\Admin\AppData\Local\Temp\JJEGCBGIDH.exe
Size 106KB
SHA256 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
MD5 fe380780b5c35bd6d54541791151c2be
SHA1 7fe3a583cf91474c733f85cebf3c857682e269e1
SHA512 ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
SSDEEP 1536:lIpbrxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+UPpe5xKOcuS11Phbiyn2TCf:KpbrsISnRGPJkGt74GsISnRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

QgznpbfJ.exe

Path C:\Users\Admin\AppData\Local\Temp\QgznpbfJ.exe
Size 5KB
SHA256 75b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c
MD5 6a2c09749219d577535d0338c6cffe06
SHA1 576b00c03455a518664308c976097097f691bca4
SHA512 cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c
SSDEEP 48:FnFmUQnqx7Ez8z7LK8yFMOK33vTvK+DjbE+K3b9YoRHSxW27KIBXwkMghMZkHJ/1:TmhqxfzHyFk3rvKgjgrF65HDH
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_oukm32j3.4wp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oukm32j3.4wp.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

1111.exe

Path C:\Users\Admin\AppData\Local\Temp\a\1111.exe
Size 2.8MB
SHA256 a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb
MD5 e670bdc7c82eee75a6d3ada6a7c9134e
SHA1 b0f0bab6f6e92bc86e86fd7bff93c257a4235859
SHA512 7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643
SSDEEP 49152:QmDqX7TnAEgPIq4jqCqt1rdSfI8HPnAl7xcZTKXIVu4jh80:Qb7dpDH0Ou4v
MD5 SHA1 SHA512 SSDEEP

Submit Download

1234.exe

Path C:\Users\Admin\AppData\Local\Temp\a\1234.exe
Size 1.3MB
SHA256 71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5
MD5 5e13199a94cf8664e5bfbe2f68d4738e
SHA1 8cfaa21f68226ae775615f033507b5756f5ccacc
SHA512 b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5
SSDEEP 24576:BH7ByWQ5msM7fVPna+9gtYQfyAzhInRs3JMIdp2sRHpE0TTAyEMFw/ArR2T7:pFsM7fVPabFk65OsRHpRTTAMFw/ArR2v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISetup2.exe

Path C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
Size 413KB
SHA256 27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645
MD5 d388d6918f1e8a6a3b34ad993d8159eb
SHA1 cf3cd31a4dd6571cc78016c7b0f97f621b1f253d
SHA512 54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e
SSDEEP 6144:JVyr1S+1oRgztB06Co1WInKGeZl3HZ3VF2S63BfpMycun70/:JVyr1SuSMYho8qeLXZ2SaWung/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISetup8.exe

Path C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
Size 413KB
SHA256 7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172
MD5 94e9960a45131af61e599acee54d21d6
SHA1 39b03e050337d4eb127ae5ff5f0868e986bec7ad
SHA512 179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a
SSDEEP 6144:JVyr1S+1oRgztB06Co1WInKGeZl3HZ3VF2S63BfpMycun701:JVyr1SuSMYho8qeLXZ2SaWung1
MD5 SHA1 SHA512 SSDEEP

Submit Download

MStore.exe

Path C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
Size 12KB
SHA256 7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc
MD5 282c1ebb16ad0edc41389d1e73a74607
SHA1 fbcdda121484ea6125827ed4e7b1b00f6a88835d
SHA512 94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292
SSDEEP 192:mdPs89eq20SlgHpmeWcL2ShJwHMUNmSTGCu3Q5tfBcyu8:mO89eq2umtE2SH2oSiCu3cz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Props.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Props.exe
Size 7KB
SHA256 35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a
MD5 9c938f91a0530150a2b1c4546334570c
SHA1 f4ae9acba920744457739fef0205f86443dbdf65
SHA512 f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b
SSDEEP 24:eFGStrJ9u0/6ZCnZdkBQAV2HaYaKZq6eNDMSCvOXpmB:is0cakBQ3taASD9C2kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tester.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
Size 267KB
SHA256 d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
MD5 0803c1aec008e75859877844cfa81492
SHA1 16924d5802ddf76a2096fcfade0ce06d4c0670bd
SHA512 9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9
SSDEEP 6144:KlGYSiIgIhk/1TspsI78JtmPNFLVoiho7rnQb:KCgImqpsI75RGk
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypted6077866846MVYQY.exe

Path C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
Size 524KB
SHA256 0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0
MD5 c8edf453ed433cefb2696bb859e0f782
SHA1 e34cf939d6c5a34c7bedfd885249bb7fb15336e5
SHA512 61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c
SSDEEP 12288:ypFy1/EXmhwdmojNcp/yhBxrQWQAxfUyD4lIx:ypFy1/EXRdUqByWQwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

disable-defender.exe

Path C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
Size 294KB
SHA256 feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
MD5 10fc8b2915c43aa16b6a2e2b4529adc5
SHA1 0c15286457963eb86d61d83642870a3473ef38fe
SHA512 421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897
SSDEEP 6144:iZQUudV196PTIr8Py794fexEPBBKohz0vF:P56LIyTnBBKoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

i1gcbW1E.exe

Path C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
Size 2.3MB
SHA256 107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6
MD5 262a7eb58a01d1aab21b24292c181cd3
SHA1 535312b7048fb90be981e04ea759c5ad8aaf6eda
SHA512 358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b
SSDEEP 49152:Iwbow/vbvIgF0kyPGcASmbYK94IZsrNSc8n1PI0IU6iD:IwL3bDjcABKAMSXn1q+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

mQxBvlTA.exe

Path C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
Size 7.7MB
SHA256 ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50
MD5 7aca152e7040f43dae201cfe01ce37b4
SHA1 83eb2fa2d400f96b241e61f81e4d80317eea0200
SHA512 84415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4
SSDEEP 196608:36daVHmaaDRVjdpOEMIUfEB92uOnffW1zPkHS3:KMHmauRNdUvIUfEun3ws+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pclient.exe

Path C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
Size 157KB
SHA256 ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82
MD5 5790d1417f8f00bd7ec6fb7011c79d9c
SHA1 36076ed9457c45d94e664ea291eb01e5c70d084b
SHA512 b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0
SSDEEP 3072:XahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEk1eT:XahOfp0yN90QEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
Size 66KB
SHA256 0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89
MD5 00135a86ab829fc2d4678179d7a6e70f
SHA1 ef75c259865d7685d566b6e25b7a20d134952555
SHA512 011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef
SSDEEP 1536:TjDQ1biZlWCiOmaB6dGXtK8qw2u04+bFoJZ+Pl+aaPOVde0:TQ1alRYQtKw504+bFxPFaPOVdD
MD5 SHA1 SHA512 SSDEEP

Submit Download

test2.exe

Path C:\Users\Admin\AppData\Local\Temp\a\test2.exe
Size 2.7MB
SHA256 a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
MD5 5347852b24409aed42423f0118637f03
SHA1 6c7947428231ab857ee8c9dab7a7e62fdeed024b
SHA512 0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991
SSDEEP 49152:UAzgjdYG43A0ExPRq88tyqTtrQ5z9jzPi7mv9aM/id8T:UAuUkthD/id8
MD5 SHA1 SHA512 SSDEEP

Submit Download

wininit.exe

Path C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
Size 1.3MB
SHA256 0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5
MD5 ddee86f4db0d3b8010110445b0545526
SHA1 b41380b50d17dd679f85a224771398b81966bb9e
SHA512 4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710
SSDEEP 24576:UAHnh+eWsN3skA4RV1Hom2KXMmHa8eaRqz66t/uRLiLjsyVvoCFKyO5:jh+ZkldoPK8Ya8twLjsya
MD5 SHA1 SHA512 SSDEEP

Submit Download

xIPJVPDq.exe

Path C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
Size 13KB
SHA256 0dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912
MD5 0c550ce9bb3efa8c3ce80a507cadfffa
SHA1 6559cb9db9c13147da5139cc3b8d9c60b914b667
SHA512 c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf
SSDEEP 192:yh4gD1GAhChMSXhCUFaBoU3rKgjwQx5K:S4gD1LhChhXhCEaBo+sQx5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 2KB
SHA256 edd1e586b7fb9e8c2475a3f31a7c8a406c43187627e6249dec2efc0536a04721
MD5 d94a1225502f9dac76b0759d518b2493
SHA1 d04bf5ce34d096a55a28684d1856b1527b7fd1af
SHA512 bc332f67dabfef98f43980d2c07ef9ff995357c819fcd21de9adc853b59f85e80e9304c0322470d4ceb513f567f2129187843153f26f22240237e6fb0d06f7c1
MD5 SHA1 SHA512

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 3KB
SHA256 194cb192220e6827b87d8b98a39b91fa029fdca2e4862884b7ecdccb9d237646
MD5 733f8152ad4cd60067a529f0656bd50f
SHA1 0341632d7af1dc8b224a0040b30fdede13fe21b1
SHA512 bafc237b7311d1c6638cddd4f7ff9e92b1ab0302d71c850259d7823f4d7269de3e8cb1072fc9f45f31f820a56244fc68c68ccd0aff1615810f153233efcf6a83
MD5 SHA1 SHA512

Submit Download

u318.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u318.0.exe
Size 271KB
SHA256 7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153
MD5 b95747cad90e982d44da8fd74f50b9a6
SHA1 d7f267d2042f6b67f63542395ff6a5a1b3ba1250
SHA512 615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c
SSDEEP 3072:NNOd0HmRJTREF9qu4+2UGERo7Cvlzox2bmW4+o4LrycZDwigIpMpiv0laYPaXCiD:2dMFK21oHeT4+0IYlaQayiyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

u318.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u318.1.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-85-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/388-1-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/388-2-0x000000001BC10000-0x000000001BC20000-memory.dmp

Download

memory/388-0-0x0000000000E70000-0x0000000000E78000-memory.dmp

Download

memory/388-268-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/388-108-0x000000001BC10000-0x000000001BC20000-memory.dmp

Download

memory/876-94-0x000001CB57310000-0x000001CB57320000-memory.dmp

Download

memory/876-205-0x000001CB57310000-0x000001CB57320000-memory.dmp

Download

memory/876-125-0x000001CB6FB90000-0x000001CB6FC06000-memory.dmp

Download

memory/876-92-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/876-114-0x000001CB57520000-0x000001CB57542000-memory.dmp

Download

memory/876-96-0x000001CB57310000-0x000001CB57320000-memory.dmp

Download

memory/976-295-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/1232-97-0x0000000005FA0000-0x0000000006032000-memory.dmp

Download

memory/1232-245-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1232-110-0x0000000006090000-0x000000000609A000-memory.dmp

Download

memory/1232-113-0x00000000033A0000-0x00000000034EE000-memory.dmp

Download

memory/1232-95-0x00000000064A0000-0x000000000699E000-memory.dmp

Download

memory/1232-25-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1232-91-0x00000000000D0000-0x00000000011EC000-memory.dmp

Download

memory/1232-119-0x00000000060C0000-0x00000000060D4000-memory.dmp

Download

memory/1232-24-0x0000000076590000-0x0000000076660000-memory.dmp

Download

memory/1232-26-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1232-31-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1232-23-0x0000000076590000-0x0000000076660000-memory.dmp

Download

memory/1232-22-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1232-191-0x0000000076590000-0x0000000076660000-memory.dmp

Download

memory/1232-243-0x0000000076590000-0x0000000076660000-memory.dmp

Download

memory/1232-13-0x00000000000D0000-0x00000000011EC000-memory.dmp

Download

memory/1232-82-0x00000000000D0000-0x00000000011EC000-memory.dmp

Download

memory/1232-152-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1232-27-0x0000000076590000-0x0000000076660000-memory.dmp

Download

memory/1232-194-0x0000000076590000-0x0000000076660000-memory.dmp

Download

memory/1232-144-0x00000000000D0000-0x00000000011EC000-memory.dmp

Download

memory/1232-200-0x00000000061A0000-0x00000000061B0000-memory.dmp

Download

memory/1232-197-0x0000000074900000-0x0000000074AC2000-memory.dmp

Download

memory/1256-75-0x0000000140000000-0x0000000140004278-memory.dmp

Download

memory/2060-109-0x0000000000DC0000-0x0000000000DC4000-memory.dmp

Download

memory/2148-254-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-120-0x0000024521340000-0x00000245215B6000-memory.dmp

Download

memory/2148-171-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-179-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-67-0x0000024506DC0000-0x0000024506DC6000-memory.dmp

Download

memory/2148-73-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/2148-186-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-190-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-162-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-159-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-196-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-240-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-156-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-201-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-209-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-213-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-154-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-215-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-218-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-226-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-151-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-270-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/2148-233-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-263-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-145-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-140-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-138-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-129-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2148-266-0x0000024521340000-0x00000245215B1000-memory.dmp

Download

memory/2320-318-0x0000000000400000-0x0000000002D44000-memory.dmp

Download

memory/2320-289-0x0000000000400000-0x0000000002D44000-memory.dmp

Download

memory/2984-184-0x00007FF735B80000-0x00007FF735DD4000-memory.dmp

Download

memory/3916-303-0x0000000000580000-0x0000000000588000-memory.dmp

Download

memory/3932-276-0x0000000000400000-0x0000000002D44000-memory.dmp

Download

memory/3932-147-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

Download

memory/3932-177-0x0000000000400000-0x0000000002D44000-memory.dmp

Download

memory/3932-264-0x0000000000400000-0x0000000002D44000-memory.dmp

Download

memory/3932-150-0x0000000004990000-0x00000000049FC000-memory.dmp

Download

memory/4472-262-0x0000000000130000-0x0000000000146000-memory.dmp

Download

memory/4700-74-0x0000000005E80000-0x0000000005F8A000-memory.dmp

Download

memory/4700-71-0x0000000005D50000-0x0000000005D62000-memory.dmp

Download

memory/4700-157-0x0000000007090000-0x0000000007252000-memory.dmp

Download

memory/4700-38-0x0000000001330000-0x0000000001352000-memory.dmp

Download

memory/4700-168-0x0000000007790000-0x0000000007CBC000-memory.dmp

Download

memory/4700-48-0x0000000005810000-0x0000000005876000-memory.dmp

Download

memory/4700-46-0x0000000073E60000-0x000000007454E000-memory.dmp

Download

memory/4700-79-0x0000000006D70000-0x0000000006DAE000-memory.dmp

Download

memory/4700-271-0x0000000073E60000-0x000000007454E000-memory.dmp

Download

memory/4700-80-0x0000000006DB0000-0x0000000006DFB000-memory.dmp

Download

memory/4700-70-0x00000000062D0000-0x00000000068D6000-memory.dmp

Download

memory/4816-304-0x00007FFFCCAB0000-0x00007FFFCD49C000-memory.dmp

Download

memory/4816-294-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Download

memory/4816-258-0x0000000000F40000-0x0000000000F8A000-memory.dmp

Download

memory/4832-259-0x0000000004910000-0x0000000004937000-memory.dmp

Download

memory/4832-319-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4832-256-0x0000000002D30000-0x0000000002E30000-memory.dmp

Download

memory/4832-307-0x0000000000400000-0x0000000002D21000-memory.dmp

Download

memory/4832-278-0x0000000000400000-0x0000000002D21000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads