Resubmissions
12-04-2024 13:18
240412-qj2nwsdg6z 1012-04-2024 13:18
240412-qj13csdg6y 1012-04-2024 13:18
240412-qj1rladg6x 1012-04-2024 13:18
240412-qjz53aag26 1012-04-2024 13:18
240412-qjzvasag25 1009-04-2024 03:59
240409-ekaq1sea34 1009-04-2024 03:58
240409-ej1aaadh98 1009-04-2024 03:58
240409-ejnw9adh85 1009-04-2024 03:55
240409-eg8tmshd41 1017-02-2024 23:58
240217-31gfhacd52 10Analysis
-
max time kernel
1199s -
max time network
1201s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 13:18
Behavioral task
behavioral1
Sample
stub_tor.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
stub_tor.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
stub_tor.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
stub_tor.exe
Resource
win11-20240221-en
General
-
Target
stub_tor.exe
-
Size
7.8MB
-
MD5
c76390d9e1052d9e708940d67b5c135d
-
SHA1
a370a73a9dd746584428e8a939288ecffd3c80f7
-
SHA256
caf48b67e7bb94a178426fc7ce6b9ed50ffb2f3813a7c68900f21bfffb24e44f
-
SHA512
4d2d38d8719cdac8a406cfa96944ee99d2d926511e64d6b6aa964d40d0d9ddb1dc6e4e6253bcb1e77b32613c0b4409ab32ea54c476018fee963574edb043dd3b
-
SSDEEP
196608:oIRcbH4jSteTGvExwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfuExwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Extracted
bitrat
1.38
7sbl4dpbubwjjghdquwg47fyq7rookd4bgm2ypm2kjzkivd7tomvczqd.onion:440
-
communication_password
4124bc0a9335c27f086f24ba207a4912
-
install_dir
Minecraft
-
install_file
Runtime_Broker
-
tor_process
tor
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral3/files/0x00080000000233e1-18.dat acprotect behavioral3/files/0x00070000000233e5-21.dat acprotect behavioral3/files/0x00070000000233e4-24.dat acprotect behavioral3/files/0x00070000000233e6-32.dat acprotect behavioral3/files/0x00070000000233e3-30.dat acprotect behavioral3/files/0x00070000000233e2-27.dat acprotect behavioral3/files/0x00070000000233e8-26.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation stub_tor.exe -
Executes dropped EXE 50 IoCs
pid Process 2352 tor.exe 4336 tor.exe 4304 tor.exe 2380 tor.exe 1736 tor.exe 4064 tor.exe 1576 tor.exe 1004 tor.exe 3120 tor.exe 4100 tor.exe 4420 tor.exe 4840 tor.exe 716 tor.exe 1672 tor.exe 2476 tor.exe 2376 tor.exe 460 tor.exe 1008 tor.exe 4288 tor.exe 5048 tor.exe 5016 tor.exe 4380 tor.exe 4116 tor.exe 2408 tor.exe 4788 tor.exe 4384 tor.exe 3756 tor.exe 5048 tor.exe 1756 tor.exe 1468 tor.exe 2012 tor.exe 1456 tor.exe 3600 tor.exe 3552 tor.exe 4608 tor.exe 2368 tor.exe 2028 tor.exe 2652 tor.exe 3000 tor.exe 2088 tor.exe 4436 tor.exe 1496 tor.exe 2236 tor.exe 3476 tor.exe 3736 tor.exe 2196 tor.exe 952 tor.exe 3540 tor.exe 3104 tor.exe 1172 tor.exe -
Loads dropped DLL 64 IoCs
pid Process 2352 tor.exe 2352 tor.exe 2352 tor.exe 2352 tor.exe 2352 tor.exe 2352 tor.exe 2352 tor.exe 2352 tor.exe 2352 tor.exe 4336 tor.exe 4336 tor.exe 4336 tor.exe 4336 tor.exe 4336 tor.exe 4336 tor.exe 4336 tor.exe 4304 tor.exe 4304 tor.exe 4304 tor.exe 4304 tor.exe 4304 tor.exe 4304 tor.exe 4304 tor.exe 2380 tor.exe 2380 tor.exe 2380 tor.exe 2380 tor.exe 2380 tor.exe 2380 tor.exe 2380 tor.exe 1736 tor.exe 1736 tor.exe 1736 tor.exe 1736 tor.exe 1736 tor.exe 1736 tor.exe 1736 tor.exe 4064 tor.exe 4064 tor.exe 4064 tor.exe 4064 tor.exe 4064 tor.exe 4064 tor.exe 4064 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1004 tor.exe 1004 tor.exe 1004 tor.exe 1004 tor.exe 1004 tor.exe 1004 tor.exe 1004 tor.exe 3120 tor.exe 3120 tor.exe 3120 tor.exe 3120 tor.exe 3120 tor.exe 3120 tor.exe -
resource yara_rule behavioral3/files/0x00070000000233e7-14.dat upx behavioral3/files/0x00080000000233e1-18.dat upx behavioral3/files/0x00070000000233e5-21.dat upx behavioral3/files/0x00070000000233e4-24.dat upx behavioral3/memory/2352-33-0x0000000073970000-0x0000000073A3E000-memory.dmp upx behavioral3/memory/2352-34-0x0000000073940000-0x0000000073964000-memory.dmp upx behavioral3/files/0x00070000000233e6-32.dat upx behavioral3/files/0x00070000000233e3-30.dat upx behavioral3/files/0x00070000000233e2-27.dat upx behavioral3/files/0x00070000000233e8-26.dat upx behavioral3/memory/2352-25-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-37-0x0000000073870000-0x0000000073938000-memory.dmp upx behavioral3/memory/2352-38-0x00000000736D0000-0x0000000073758000-memory.dmp upx behavioral3/memory/2352-43-0x0000000073400000-0x00000000736CF000-memory.dmp upx behavioral3/memory/2352-45-0x0000000073760000-0x000000007386A000-memory.dmp upx behavioral3/memory/2352-44-0x0000000073A40000-0x0000000073A89000-memory.dmp upx behavioral3/memory/2352-72-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-74-0x0000000073970000-0x0000000073A3E000-memory.dmp upx behavioral3/memory/2352-75-0x0000000073940000-0x0000000073964000-memory.dmp upx behavioral3/memory/2352-76-0x0000000073870000-0x0000000073938000-memory.dmp upx behavioral3/memory/2352-80-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-81-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-90-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-98-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-112-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-120-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-128-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-136-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/4336-161-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2352-162-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/4336-165-0x0000000073870000-0x0000000073938000-memory.dmp upx behavioral3/memory/4336-163-0x0000000073400000-0x00000000736CF000-memory.dmp upx behavioral3/memory/4336-167-0x0000000073970000-0x0000000073A3E000-memory.dmp upx behavioral3/memory/4336-168-0x0000000073A40000-0x0000000073A89000-memory.dmp upx behavioral3/memory/4336-170-0x0000000073940000-0x0000000073964000-memory.dmp upx behavioral3/memory/4336-171-0x0000000073760000-0x000000007386A000-memory.dmp upx behavioral3/memory/4336-172-0x00000000736D0000-0x0000000073758000-memory.dmp upx behavioral3/memory/4336-179-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/4336-180-0x0000000073400000-0x00000000736CF000-memory.dmp upx behavioral3/memory/4304-192-0x0000000073790000-0x0000000073858000-memory.dmp upx behavioral3/memory/4304-193-0x00000000736C0000-0x000000007378E000-memory.dmp upx behavioral3/memory/4304-194-0x0000000073670000-0x00000000736B9000-memory.dmp upx behavioral3/memory/4304-195-0x0000000073530000-0x000000007363A000-memory.dmp upx behavioral3/memory/4304-197-0x00000000734A0000-0x0000000073528000-memory.dmp upx behavioral3/memory/4304-199-0x0000000073860000-0x0000000073B2F000-memory.dmp upx behavioral3/memory/4304-202-0x0000000073640000-0x0000000073664000-memory.dmp upx behavioral3/memory/4304-221-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/4304-222-0x0000000073790000-0x0000000073858000-memory.dmp upx behavioral3/memory/4304-231-0x00000000736C0000-0x000000007378E000-memory.dmp upx behavioral3/memory/4304-235-0x0000000073860000-0x0000000073B2F000-memory.dmp upx behavioral3/memory/2380-252-0x0000000073860000-0x0000000073B2F000-memory.dmp upx behavioral3/memory/2380-255-0x0000000073790000-0x0000000073858000-memory.dmp upx behavioral3/memory/2380-257-0x00000000736C0000-0x000000007378E000-memory.dmp upx behavioral3/memory/2380-259-0x0000000073670000-0x00000000736B9000-memory.dmp upx behavioral3/memory/4304-261-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/2380-263-0x0000000073530000-0x000000007363A000-memory.dmp upx behavioral3/memory/2380-264-0x00000000734A0000-0x0000000073528000-memory.dmp upx behavioral3/memory/2380-260-0x0000000073640000-0x0000000073664000-memory.dmp upx behavioral3/memory/2380-276-0x00000000736C0000-0x000000007378E000-memory.dmp upx behavioral3/memory/2380-275-0x0000000073790000-0x0000000073858000-memory.dmp upx behavioral3/memory/2380-274-0x0000000073860000-0x0000000073B2F000-memory.dmp upx behavioral3/memory/2380-273-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/1736-288-0x0000000000300000-0x0000000000704000-memory.dmp upx behavioral3/memory/1736-289-0x0000000073790000-0x0000000073858000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime_Broker = "C:\\Users\\Admin\\AppData\\Local\\Minecraft\\Runtime_Broker" stub_tor.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime_Broker = "C:\\Users\\Admin\\AppData\\Local\\Minecraft\\Runtime_BrokerÔ€" stub_tor.exe -
Looks up external IP address via web service 24 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 myexternalip.com 156 myexternalip.com 60 myexternalip.com 95 myexternalip.com 141 myexternalip.com 188 myexternalip.com 255 myexternalip.com 246 myexternalip.com 40 myexternalip.com 104 myexternalip.com 179 myexternalip.com 210 myexternalip.com 230 myexternalip.com 134 myexternalip.com 170 myexternalip.com 203 myexternalip.com 24 myexternalip.com 52 myexternalip.com 69 myexternalip.com 77 myexternalip.com 85 myexternalip.com 217 myexternalip.com 223 myexternalip.com 238 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
pid Process 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2932 stub_tor.exe -
Suspicious behavior: RenamesItself 64 IoCs
pid Process 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe 2932 stub_tor.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2932 stub_tor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2932 stub_tor.exe 2932 stub_tor.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2352 2932 stub_tor.exe 77 PID 2932 wrote to memory of 2352 2932 stub_tor.exe 77 PID 2932 wrote to memory of 2352 2932 stub_tor.exe 77 PID 2932 wrote to memory of 4336 2932 stub_tor.exe 78 PID 2932 wrote to memory of 4336 2932 stub_tor.exe 78 PID 2932 wrote to memory of 4336 2932 stub_tor.exe 78 PID 2932 wrote to memory of 4304 2932 stub_tor.exe 79 PID 2932 wrote to memory of 4304 2932 stub_tor.exe 79 PID 2932 wrote to memory of 4304 2932 stub_tor.exe 79 PID 2932 wrote to memory of 2380 2932 stub_tor.exe 80 PID 2932 wrote to memory of 2380 2932 stub_tor.exe 80 PID 2932 wrote to memory of 2380 2932 stub_tor.exe 80 PID 2932 wrote to memory of 1736 2932 stub_tor.exe 81 PID 2932 wrote to memory of 1736 2932 stub_tor.exe 81 PID 2932 wrote to memory of 1736 2932 stub_tor.exe 81 PID 2932 wrote to memory of 4064 2932 stub_tor.exe 82 PID 2932 wrote to memory of 4064 2932 stub_tor.exe 82 PID 2932 wrote to memory of 4064 2932 stub_tor.exe 82 PID 2932 wrote to memory of 1576 2932 stub_tor.exe 83 PID 2932 wrote to memory of 1576 2932 stub_tor.exe 83 PID 2932 wrote to memory of 1576 2932 stub_tor.exe 83 PID 2932 wrote to memory of 1004 2932 stub_tor.exe 84 PID 2932 wrote to memory of 1004 2932 stub_tor.exe 84 PID 2932 wrote to memory of 1004 2932 stub_tor.exe 84 PID 2932 wrote to memory of 3120 2932 stub_tor.exe 85 PID 2932 wrote to memory of 3120 2932 stub_tor.exe 85 PID 2932 wrote to memory of 3120 2932 stub_tor.exe 85 PID 2932 wrote to memory of 4100 2932 stub_tor.exe 86 PID 2932 wrote to memory of 4100 2932 stub_tor.exe 86 PID 2932 wrote to memory of 4100 2932 stub_tor.exe 86 PID 2932 wrote to memory of 4420 2932 stub_tor.exe 87 PID 2932 wrote to memory of 4420 2932 stub_tor.exe 87 PID 2932 wrote to memory of 4420 2932 stub_tor.exe 87 PID 2932 wrote to memory of 4840 2932 stub_tor.exe 88 PID 2932 wrote to memory of 4840 2932 stub_tor.exe 88 PID 2932 wrote to memory of 4840 2932 stub_tor.exe 88 PID 2932 wrote to memory of 716 2932 stub_tor.exe 89 PID 2932 wrote to memory of 716 2932 stub_tor.exe 89 PID 2932 wrote to memory of 716 2932 stub_tor.exe 89 PID 2932 wrote to memory of 1672 2932 stub_tor.exe 90 PID 2932 wrote to memory of 1672 2932 stub_tor.exe 90 PID 2932 wrote to memory of 1672 2932 stub_tor.exe 90 PID 2932 wrote to memory of 2476 2932 stub_tor.exe 91 PID 2932 wrote to memory of 2476 2932 stub_tor.exe 91 PID 2932 wrote to memory of 2476 2932 stub_tor.exe 91 PID 2932 wrote to memory of 2376 2932 stub_tor.exe 92 PID 2932 wrote to memory of 2376 2932 stub_tor.exe 92 PID 2932 wrote to memory of 2376 2932 stub_tor.exe 92 PID 2932 wrote to memory of 460 2932 stub_tor.exe 93 PID 2932 wrote to memory of 460 2932 stub_tor.exe 93 PID 2932 wrote to memory of 460 2932 stub_tor.exe 93 PID 2932 wrote to memory of 1008 2932 stub_tor.exe 94 PID 2932 wrote to memory of 1008 2932 stub_tor.exe 94 PID 2932 wrote to memory of 1008 2932 stub_tor.exe 94 PID 2932 wrote to memory of 4288 2932 stub_tor.exe 95 PID 2932 wrote to memory of 4288 2932 stub_tor.exe 95 PID 2932 wrote to memory of 4288 2932 stub_tor.exe 95 PID 2932 wrote to memory of 5048 2932 stub_tor.exe 96 PID 2932 wrote to memory of 5048 2932 stub_tor.exe 96 PID 2932 wrote to memory of 5048 2932 stub_tor.exe 96 PID 2932 wrote to memory of 5016 2932 stub_tor.exe 104 PID 2932 wrote to memory of 5016 2932 stub_tor.exe 104 PID 2932 wrote to memory of 5016 2932 stub_tor.exe 104 PID 2932 wrote to memory of 4380 2932 stub_tor.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub_tor.exe"C:\Users\Admin\AppData\Local\Temp\stub_tor.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4336
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4304
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4064
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3120
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4100
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4420
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4840
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:716
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2476
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2376
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:460
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1008
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4288
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:5048
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:5016
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4380
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4116
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2408
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4788
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4384
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3756
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:5048
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1756
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1468
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2012
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1456
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3600
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3552
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4608
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2368
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2028
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3000
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2088
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:4436
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2236
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3476
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3736
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:2196
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:952
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3540
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:3104
-
-
C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe"C:\Users\Admin\AppData\Local\a5b260eb\tor\tor.exe" -f torrc2⤵
- Executes dropped EXE
PID:1172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5ebb1999f109647889d1711569c54e036
SHA185cddfa705b77ad831649eb9759cb18d536ddffe
SHA256ec68e262dc57d8402a5b30ecb9be7dfc422f2bb2a051df3b591d2a6c11f5e2aa
SHA512303ed1fdeed56513f61541457f1cf570b89b2cf95e810ac765f2aa7dfcf63d9378aea1b8c963fba427b6fdad782dd25e867fe091f444d6a21bde6b867723fdf5
-
Filesize
15KB
MD518d2c432acc96e68f142e3c3ceb2a2cd
SHA17a13e1545076af0e39b48866aed50b0c299e020b
SHA25613b4941c73380b502ff7241cb3a7786813a78029c678e1923ccf8f4c614c1555
SHA51239b133f7bca60d2d72135f0cb068c971aa047ca55913f2b5bf3da8a38ac863438965b84eb33bd2723b02f51d7ab473e0cb66a64a64e99168b64552e3b4207258
-
Filesize
2.7MB
MD527acfbf94480631e547b5cb508d9d4fb
SHA1f6477330ca9aeb4a8cd19cc44e1a30fa9695b36c
SHA2560fd156526952ba5edb62133774a19bf72f71d3c968d01fcdb517521d45a67c5e
SHA512902ccecfa284881c1f241802b9ccd51a85da0cc48632fbd944b686d37a4fa57bc7cd01c44ef79bfe475494be780164b82ff8fa9a3e77984f6e29467843138929
-
Filesize
20.3MB
MD5256f751c0f93400ae7d2b02fe9a2b032
SHA1a826823f5cacb4f22d30f9f290c9e1d18b23e569
SHA256df88178e63ed28cf14a0346ce8c49c444a7afb7e52fe92e224109e65e09be093
SHA512f1eeef1666c30044ebcd7d0ad313b5db89f55d80ee5c9feb03b2396e0a07c03757a57f7bc4a152fde3ec22977d50e986849ac4530278a245c9556694d79632d2
-
Filesize
8.3MB
MD552516b36e7e7f34f1d530f91751fe32e
SHA19b9f1636af84bcfcad2f908cd913f754def946a3
SHA256067aa7caeca522cd6c3ff9748e0756d3aac13f26d6579c137cef4ba5f502ff99
SHA51235e6d1d58828a5036058d726bb8d312b10b660de531454956d5ca7e0d0a779245bca7b10030f72e694c68c8e873e48e12d015d93c962ccf24b695a1a655d3c18
-
Filesize
232B
MD5e33e167cdc7125ee8a0168352dc1ec81
SHA12d7d69bf7930e340f69a6c76b32ef2f6a7fd6811
SHA25653a30f70950ca838a0f53e688d3afbf72b46c9ca012839658d35d294cf6dc1d6
SHA5129669275c54fa0751ef1e6425f244d4893868587985926c165c0b7ad05cf109406f223dc4c8ea675dd544369c8f6e3bc252e47a44cfdb7b4bb400449ddaa8703d
-
Filesize
3KB
MD5c66189a3c04de1305353203f60cb536a
SHA19d8b439b153a24977269a5845ddd03f27bd21967
SHA2566e4a879d29b1fc6d316290e43f803c81413e2f77bf808d215b25b53a86e99ab0
SHA512892917c299ddc0ffe1682bcca97c265b973da5f9f169663756ebe2c97f0592b290590c5cf8ad6174bc5102e7b0db593c4332a69eec57220223024c49ded0281b
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
157B
MD58ea874223f853aac5ea469ccc164a8f9
SHA170d31011547870c9f930496dbf9fb7ec296a8c28
SHA25695e134044f370b2a96408d581f3c0381fe95388dae27c6d9598f44dc7d72b9ed
SHA512fd1dc20219fbf4863926d90b5a2127b65e165656eac4493a80288d0c57fc309ed998b5d30fe8ce313987ee367fc4fe9b6026ff32d4391950d7f26ca7b6fdcdf2
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa