43cf51ea2ac2ea60017c077d196d9719c6217548510619aa8ac18c6657163c55

General

Target

main.exe
Size

5.9MB
MD5

3354496085a148bf84e4b9249d8ab9b2
SHA1

7f5a53faa73edac8a2999bc8624b8c8ce943f06a
SHA256

43cf51ea2ac2ea60017c077d196d9719c6217548510619aa8ac18c6657163c55
SHA512

66c9f316002593745d1b7e141c5c0cc70695f50f140ac2b9b32753a89ac3c482a3ca57afa825a2bd6c6e72855ac4367eb0ea1b933974fc3592739b63a93c71df
SSDEEP

98304:TXzhW148Pd+Tf1mpcOldJQ3/V5s18HdDo45ow3ONp2MTJs9wplordZNum6vukIP0:zFK4s0TfLOdo/bs1moU2N8AMmofNum6z

Score

10^/10

evasion persistence pyinstaller themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exemain.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	main.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exemain.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	main.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	main.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe

Executes dropped EXE 7 IoCs

Processes:

main.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2784 main.exe
2952 icsys.icn.exe
1192
2800 explorer.exe
2724 spoolsv.exe
2372 svchost.exe
2496 spoolsv.exe
Loads dropped DLL 7 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

pid process

1220 main.exe
1220 main.exe
2520
2952 icsys.icn.exe
2800 explorer.exe
2724 spoolsv.exe
2372 svchost.exe

pid	process
2784	main.exe
2952	icsys.icn.exe
1192
2800	explorer.exe
2724	spoolsv.exe
2372	svchost.exe
2496	spoolsv.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1220-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\Windows\Resources\Themes\icsys.icn.exe	themida
behavioral1/memory/2952-16-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\Windows\Resources\Themes\explorer.exe	themida
behavioral1/memory/1220-28-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2800-30-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\Windows\Resources\spoolsv.exe	themida
behavioral1/memory/2724-43-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\Windows\Resources\svchost.exe	themida
behavioral1/memory/2372-54-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2496-62-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2496-67-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2724-69-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2952-71-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2800-72-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2372-73-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2800-85-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2372-94-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	main.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

1220 main.exe
2952 icsys.icn.exe
2800 explorer.exe
2724 spoolsv.exe
2372 svchost.exe
2496 spoolsv.exe

Drops file in Windows directory 5 IoCs

Processes:

icsys.icn.exeexplorer.exespoolsv.exemain.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	main.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\main.exe	pyinstaller

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1360 schtasks.exe
2084 schtasks.exe
1104 schtasks.exe

pid	process
1360	schtasks.exe
2084	schtasks.exe
1104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exesvchost.exe

pid	process
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
1220	main.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe
2372	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2800 explorer.exe
2372 svchost.exe

pid	process
2800	explorer.exe
2372	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
1220	main.exe
1220	main.exe
2952	icsys.icn.exe
2952	icsys.icn.exe
2800	explorer.exe
2800	explorer.exe
2724	spoolsv.exe
2724	spoolsv.exe
2372	svchost.exe
2372	svchost.exe
2496	spoolsv.exe
2496	spoolsv.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

main.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 1220 wrote to memory of 2784	1220	main.exe	main.exe
PID 1220 wrote to memory of 2784	1220	main.exe	main.exe
PID 1220 wrote to memory of 2784	1220	main.exe	main.exe
PID 1220 wrote to memory of 2784	1220	main.exe	main.exe
PID 1220 wrote to memory of 2952	1220	main.exe	icsys.icn.exe
PID 1220 wrote to memory of 2952	1220	main.exe	icsys.icn.exe
PID 1220 wrote to memory of 2952	1220	main.exe	icsys.icn.exe
PID 1220 wrote to memory of 2952	1220	main.exe	icsys.icn.exe
PID 2952 wrote to memory of 2800	2952	icsys.icn.exe	explorer.exe
PID 2952 wrote to memory of 2800	2952	icsys.icn.exe	explorer.exe
PID 2952 wrote to memory of 2800	2952	icsys.icn.exe	explorer.exe
PID 2952 wrote to memory of 2800	2952	icsys.icn.exe	explorer.exe
PID 2800 wrote to memory of 2724	2800	explorer.exe	spoolsv.exe
PID 2800 wrote to memory of 2724	2800	explorer.exe	spoolsv.exe
PID 2800 wrote to memory of 2724	2800	explorer.exe	spoolsv.exe
PID 2800 wrote to memory of 2724	2800	explorer.exe	spoolsv.exe
PID 2724 wrote to memory of 2372	2724	spoolsv.exe	svchost.exe
PID 2724 wrote to memory of 2372	2724	spoolsv.exe	svchost.exe
PID 2724 wrote to memory of 2372	2724	spoolsv.exe	svchost.exe
PID 2724 wrote to memory of 2372	2724	spoolsv.exe	svchost.exe
PID 2372 wrote to memory of 2496	2372	svchost.exe	spoolsv.exe
PID 2372 wrote to memory of 2496	2372	svchost.exe	spoolsv.exe
PID 2372 wrote to memory of 2496	2372	svchost.exe	spoolsv.exe
PID 2372 wrote to memory of 2496	2372	svchost.exe	spoolsv.exe
PID 2800 wrote to memory of 1688	2800	explorer.exe	Explorer.exe
PID 2800 wrote to memory of 1688	2800	explorer.exe	Explorer.exe
PID 2800 wrote to memory of 1688	2800	explorer.exe	Explorer.exe
PID 2800 wrote to memory of 1688	2800	explorer.exe	Explorer.exe
PID 2372 wrote to memory of 1360	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1360	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1360	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1360	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 2084	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 2084	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 2084	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 2084	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1104	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1104	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1104	2372	svchost.exe	schtasks.exe
PID 2372 wrote to memory of 1104	2372	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220

\??\c:\users\admin\appdata\local\temp\main.exe
c:\users\admin\appdata\local\temp\main.exe
2⤵
- Executes dropped EXE
PID:2784

C:\Windows\Resources\Themes\icsys.icn.exe
C:\Windows\Resources\Themes\icsys.icn.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
5⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2496

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:26 /f
6⤵
- Creates scheduled task(s)
PID:1360

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:27 /f
6⤵
- Creates scheduled task(s)
PID:2084

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 05:28 /f
6⤵
- Creates scheduled task(s)
PID:1104

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
4⤵
PID:1688

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\main.exe
Filesize
3.3MB

MD5
e168624c9f4fad11c86c25d583cefb04

SHA1
a556c2fdfad5c51aba45adc409eaf7338d23a428

SHA256
d0047a3ee6b59e8818d228ed777ca9b89d24704a434d27b81684024a413f3fbe

SHA512
4b4b96e7db991280e9bcf882ad5d693d7347343ebdf100f6710e034b7c0f410c6e67b19646b0904571eb0bc852e0137ee4d236af23463c89f1cbc48b419c404d

Download Submit
\Windows\Resources\Themes\explorer.exe
Filesize
2.6MB

MD5
fae0220246e76e539ff48bab74664cd3

SHA1
cfea95b1abafa74e8bcefc6ba9515447317a7a9d

SHA256
71b2400130a0f890c6a2f843a62f11161285befb27de402a887df80c4494fa92

SHA512
3eb202570e5759a1962b8489ae4a69a09900b7f7cf97384060e7e26b8c83564ed7a4d9d5365bd992c8f5bd40fd25db4effe679ac674f1e03e5346a7758b748e9

Download Submit
\Windows\Resources\Themes\icsys.icn.exe
Filesize
2.6MB

MD5
8fae25504ebef94f673e3c80794aebf2

SHA1
41c47bbb0df508aa7df176b341de0def27753bb5

SHA256
be5266e372e2a0a51e96f68b0d63399ec215b47424333846fa178dbfcf4c423f

SHA512
62ef06081c7f3bf5e1d197f804976479ce983203eb1001b5d9aaeb342d86b041711ad9075ef88952d37051bd2f3a22a391534543d9dd1340db801bde4b1c7aaa

Download Submit
\Windows\Resources\spoolsv.exe
Filesize
2.6MB

MD5
06a03b0b3cb30f666e96c47529e1292c

SHA1
ffaf45d47c0f7204c566420d0d7b78997763f79b

SHA256
22719a6c480b994aa6cb2e01fb1fdea4061d518a62bb4bbb86a0e156349f7af1

SHA512
425a4834c3bac134a4358b254b91da01d0a55e23ff7a6e7e00b9045b3ff49bc94660e526208983d06f936681df9283848d0cd61c99a391fd48b8ddcdc2900dd7

Download Submit
\Windows\Resources\svchost.exe
Filesize
2.6MB

MD5
bcd0f5c22362e4f806ef43ed919e8bf2

SHA1
667732e724953059271f1b5706aab9a7ddaece1e

SHA256
117b797e07adc1d67c18c331b13b24d6169a6ddb3bb0d36e43c7f45463c9b0ee

SHA512
86b536d4f0e515322e3b6b19dba1ef5ab3f017b4260ee65e203770ac7b8868b998cfbc8b07061f86a94639a983df248c0b4658f7172f13f33e87166749adeba8

Download Submit
memory/1220-28-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1220-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1220-1-0x0000000077380000-0x0000000077382000-memory.dmp

Filesize
8KB

Download
memory/2372-94-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2372-73-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2372-61-0x0000000003250000-0x0000000003866000-memory.dmp

Filesize
6.1MB

Download
memory/2372-54-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2496-62-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2496-67-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2724-43-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2724-69-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2800-42-0x00000000037F0000-0x0000000003E06000-memory.dmp

Filesize
6.1MB

Download
memory/2800-72-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2800-74-0x00000000037F0000-0x0000000003E06000-memory.dmp

Filesize
6.1MB

Download
memory/2800-85-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2800-30-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2952-16-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2952-71-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2952-31-0x0000000003780000-0x0000000003D96000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads