Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/04/2024, 02:58

240410-dgn9kacd46 10

10/04/2024, 02:58

240410-dgnm2aff7x 10

10/04/2024, 02:58

240410-dgnb9sff7w 10

10/04/2024, 02:58

240410-dgm2haff7v 10

23/08/2023, 14:58

230823-sb7laaed41 10

Analysis

  • max time kernel
    1799s
  • max time network
    1800s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/04/2024, 02:58

General

  • Target

    loader.exe

  • Size

    401KB

  • MD5

    69e3cdc923b668aec4cb405c040565c6

  • SHA1

    6a675ebf6f241e543f7bb50ccc8ead462a427880

  • SHA256

    8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3

  • SHA512

    5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb

  • SSDEEP

    6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\loader.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2280
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:692
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1984
        • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:3660
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp5043.tmp" -C "C:\Users\Admin\AppData\Local\jjmzzxbvaf"
            4⤵
              PID:4496
            • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
              "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:412
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3124
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3176
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3976
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1508
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1416
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2956
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:112
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2724
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3916
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1968
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1012
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3028
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:352
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2424
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2284
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2276
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:5104
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3356
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1220
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1616
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3068
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3604
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:836
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4220
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4200
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:240
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2028
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1380
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1652
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4984
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2052
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4216
      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2908
        • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1508

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log

        Filesize

        847B

        MD5

        486ebddc86ea8b3e965d390d22283a23

        SHA1

        eaffc047f067084867e8575c576a9ec60e094ba8

        SHA256

        50a57273ecb794e53b0622eb841341e2643c11f53fa47356e6e754ab2268171d

        SHA512

        0a50ba02250b38355a6f4fb94e40c61258a74031d9aea7cdf675f3e068f39ec0748ecf292aaf2f94b1963b9d66516ee79aa6c552617048e248774af0ff07189d

      • C:\Users\Admin\AppData\Local\TeamViewer\loader.exe

        Filesize

        401KB

        MD5

        69e3cdc923b668aec4cb405c040565c6

        SHA1

        6a675ebf6f241e543f7bb50ccc8ead462a427880

        SHA256

        8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3

        SHA512

        5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb

      • C:\Users\Admin\AppData\Local\Temp\tmp5043.tmp

        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

      • C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdesc-consensus

        Filesize

        2.6MB

        MD5

        8155dd4a16697830a63d507d2666b2a9

        SHA1

        e07a54b15c905cd1d9d41db3ccde3bade36bcdb4

        SHA256

        6b4f443629c32b632d8ad7bcb17d84da1e4eaec556dccdf98c5e9051cb404fed

        SHA512

        0cb6c3fa12cbe7f8e63c5c73c0665fc2593109801ba318c582c4bd1c14dfd27fff3252c22b9078040e743ec788ad9534856c72ca5e38d992d9cb5aeacf819e6f

      • C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdescs.new

        Filesize

        12.0MB

        MD5

        2f072b3e3cc53e919b36f5923cde912e

        SHA1

        97f2ec6a7800612af21ad58f9ad13bb920656dc3

        SHA256

        bd57bc516848c829b0585b422e456782d6d6022aaeae1725fa309f2d1fcf136e

        SHA512

        52a62b15a81ae97f2643f9ac2f47f7859d27dbe521ccec4925e84f1feeff2e6ea29ed708c5724c5c9b822fdf2d02429bcbe52acadc0222ddd797b8a343aa670d

      • C:\Users\Admin\AppData\Local\jjmzzxbvaf\host\hostname

        Filesize

        64B

        MD5

        a94316fc1ecd2569cb410e90226ea856

        SHA1

        41b607033167d0cb13ce76e0bd3b9b652f95d705

        SHA256

        116ee44e37d3aa478bfc11acf8694ae67eddee90e905a1b9089c1abce2ac045e

        SHA512

        f65181e9c88a3b252125d0b8f2ac38a71adfcc6e80f21c93fd60615ffa3467bb8257bfe77c4582282cbfec202fa7f7a158a677f0b7952a533ce506754b5a90fa

      • C:\Users\Admin\AppData\Local\jjmzzxbvaf\port.dat

        Filesize

        4B

        MD5

        c5bbd980e5ab2c17413ec02bd757a9e5

        SHA1

        b9c1d2de39fe832a29a1d22c32b7edfda6e1ce81

        SHA256

        115c08a62490bff35d2499453b1d120c023212ac1bd3a477d585155bdb2d2b81

        SHA512

        d806ba436694880c604e417bc2941b7d52ef36bf59b5a1f68b452913c39aa142bd99080f91d999fd53c666346759a3ab5685a9c1a28e15dcbed514c90512e811

      • C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe

        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

      • C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt

        Filesize

        218B

        MD5

        797c4d3d526a55de6e257a9afdf5bcd7

        SHA1

        aa7717384b0736733ce4d1f3b1c1901616490d97

        SHA256

        72534f56125ccd86672b4f34f8e621cfeaa89cda6e5fdcf2bf2a26b582dc09ac

        SHA512

        3e922f7478908e47fda73917c1091c40ff9901c03193626b21c51760766f90df8696304253a350ac6078e8a4e5e5fb53b0da609a28019745aa865ed5a55bd185

      • memory/836-302-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/836-304-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/968-275-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/968-273-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1152-160-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1152-158-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1556-231-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1556-229-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1632-185-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1632-183-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1732-170-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1732-173-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1732-171-0x000001E4B3060000-0x000001E4B3070000-memory.dmp

        Filesize

        64KB

      • memory/1744-194-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1744-192-0x0000022B45220000-0x0000022B45230000-memory.dmp

        Filesize

        64KB

      • memory/1744-191-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1972-216-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1972-219-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/1972-217-0x000001F7652E0000-0x000001F7652F0000-memory.dmp

        Filesize

        64KB

      • memory/2072-117-0x000001E232820000-0x000001E232830000-memory.dmp

        Filesize

        64KB

      • memory/2072-123-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2072-116-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2328-110-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2328-108-0x000001E89F3B0000-0x000001E89F3C0000-memory.dmp

        Filesize

        64KB

      • memory/2328-107-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2468-294-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2468-296-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-92-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-89-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-90-0x000001DF3A940000-0x000001DF3A950000-memory.dmp

        Filesize

        64KB

      • memory/2836-98-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/2836-99-0x0000021225A00000-0x0000021225A10000-memory.dmp

        Filesize

        64KB

      • memory/2836-101-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3048-132-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3048-129-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3048-130-0x000001E5F6340000-0x000001E5F6350000-memory.dmp

        Filesize

        64KB

      • memory/3408-263-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3408-261-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3660-48-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3660-12-0x0000021718B80000-0x0000021718B90000-memory.dmp

        Filesize

        64KB

      • memory/3660-11-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3660-63-0x0000021718B80000-0x0000021718B90000-memory.dmp

        Filesize

        64KB

      • memory/3828-78-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3828-75-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3992-138-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/3992-140-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4020-0-0x0000023BA97F0000-0x0000023BA9858000-memory.dmp

        Filesize

        416KB

      • memory/4020-6-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4020-2-0x0000023BA9D10000-0x0000023BA9D20000-memory.dmp

        Filesize

        64KB

      • memory/4020-1-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4128-281-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4128-284-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4128-282-0x00000249670E0000-0x00000249670F0000-memory.dmp

        Filesize

        64KB

      • memory/4608-206-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4608-204-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4684-237-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4684-243-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4828-249-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4828-251-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4920-84-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/4920-85-0x000001E1D8660000-0x000001E1D8670000-memory.dmp

        Filesize

        64KB

      • memory/4920-87-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/5056-152-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB

      • memory/5056-150-0x00007FFF884D0000-0x00007FFF88F92000-memory.dmp

        Filesize

        10.8MB