blackmoon | c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
submitted
09/05/2024, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Size 2.6MB
Sample240509-nc9d2shc84
SHA256 c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6
MD5 584ee828a62a16a43cdf707ee0404dfd
SHA1 a244cf8bbdaa1cc7176cce70c9d37aca5ab7d61a
SHA512 c63865964603ecf1a7934f40f2502026a17d72a444584d22ed1d840ae3fc13b1d24902d964363403195debb765ce2b5d64f5033e94aed51141a8a63e4f539654
SSDEEP 49152:aYREXSVMDi3NnsHyjtk2MYC5GD7LCC12IX:P2SVMD8Nnsmtk2auCW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon gh0strat xred backdoor banker defense_evasion discovery persistence rat trojan upx

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral2/files/0x00070000000233f3-16.dat	family_blackmoon
behavioral2/files/0x00070000000233f4-35.dat	family_blackmoon
behavioral2/memory/4976-137-0x0000000000400000-0x000000000057D000-memory.dmp	family_blackmoon
behavioral2/memory/3844-198-0x0000000000400000-0x000000000057D000-memory.dmp	family_blackmoon
behavioral2/memory/3844-224-0x0000000000400000-0x000000000057D000-memory.dmp	family_blackmoon

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233ec-5.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\._cache_Synaptics.exe	._cache_Synaptics.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_SYNAPTICS.EXE	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_HD_C5680DE29ECAA3ADFF453C92E1C4CC471815C1351AEB545D8DF3CCF469A7E9A6.EXE	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240607031.bat"	look2.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 6 IoCs

pid	Process
4812	look2.exe
4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
840	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
3844	Synaptics.exe
3608	._cache_Synaptics.exe
4068	svchcst.exe

Loads dropped DLL 5 IoCs

pid	Process
4812	look2.exe
4592	svchost.exe
840	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
3608	._cache_Synaptics.exe
4068	svchcst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_HD_C5680DE29ECAA3ADFF453C92E1C4CC471815C1351AEB545D8DF3CCF469A7E9A6.EXE	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\._CACHE_SYNAPTICS.EXE	._cache_Synaptics.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240607031.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/840-121-0x0000000000560000-0x000000000056B000-memory.dmp	upx
behavioral2/memory/3608-171-0x0000000000670000-0x000000000067B000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Control Panel 6 IoCs

evasion

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	._cache_Synaptics.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\LanguageConfiguration	._cache_Synaptics.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION	._cache_Synaptics.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\LanguageConfiguration	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2116	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Token: SeBackupPrivilege	840	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Token: SeRestorePrivilege	840	._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Token: SeDebugPrivilege	3608	._cache_Synaptics.exe
Token: SeBackupPrivilege	3608	._cache_Synaptics.exe
Token: SeRestorePrivilege	3608	._cache_Synaptics.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE
2116	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4812	2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	81
PID 2472 wrote to memory of 4812	2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	81
PID 2472 wrote to memory of 4812	2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	81
PID 2472 wrote to memory of 4976	2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	84
PID 2472 wrote to memory of 4976	2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	84
PID 2472 wrote to memory of 4976	2472	c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	84
PID 4976 wrote to memory of 840	4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	85
PID 4976 wrote to memory of 840	4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	85
PID 4976 wrote to memory of 840	4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	85
PID 4976 wrote to memory of 3844	4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	86
PID 4976 wrote to memory of 3844	4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	86
PID 4976 wrote to memory of 3844	4976	HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe	86
PID 3844 wrote to memory of 3608	3844	Synaptics.exe	87
PID 3844 wrote to memory of 3608	3844	Synaptics.exe	87
PID 3844 wrote to memory of 3608	3844	Synaptics.exe	87
PID 4592 wrote to memory of 4068	4592	svchost.exe	93
PID 4592 wrote to memory of 4068	4592	svchost.exe	93
PID 4592 wrote to memory of 4068	4592	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
"C:\Users\Admin\AppData\Local\Temp\c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
  C:\Users\Admin\AppData\Local\Temp\HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Suspicious use of AdjustPrivilegeToken
      PID:3608

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:512

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\240607031.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4068

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gzip.dll

Path C:\ProgramData\E-Module\gzip.dll
Size 29KB
SHA256 97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e
MD5 8b3591965f623b219c0c528153746cab
SHA1 020961494fa0e08779b7aacf4422269935354f7d
SHA512 6e547197d160c9ec13cf2384add1bb6753276e3dab97d951adba9257d6bf999720635a7b9d94a5ca8b94bdda2f25f36c5938d126bc3e46a358e1fad072132351
SSDEEP 768:T5aM3xJoa/eBmLnw7w4/Y5C81G1ky6lHA6St:d5Joa/eIH4/Y55JvHAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Size 747KB
SHA256 90fbfaf9abaa4be6a30466f9c3bdc971fb5fbaccb1c1b39e32645c7b7cca08ed
MD5 ec2befc15f5b72b781b8496e8b83bb83
SHA1 4aab05024233c4ec4e264bed56b6db224276fcd4
SHA512 8d6598017c2a6b197f29a846b230a6e65522677feb8460f988d0a2ce6ddb971e0a4f50dec8aaf96c710d87d696f7ae847b66ecc0d535117161b01d1028c09603
SSDEEP 12288:n0w8PAzNVDFyj+9wbYCVyXB2vJ/Vc2qbGWTiSGjqfNnzoxMvjxI/dOiejv48oS5a:n0w84zbDFyj+9wbYCVyXB2vJ/Vc2qGWu
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.2MB
SHA256 5956bf87d53f3b5481b97d02d878f44371270a561178c1af712e03271698a1dc
MD5 606d7b21e0a67d3eb6ff557e8f2efd40
SHA1 15a90ba2719bdd5c0e3f5168140fd0c26db4af56
SHA512 2d5915c12cf1fb5f910be02489b37482366bf4e2b96be54747d894cd4c6e7aa19e3ac6bbe708b858258acf5168e41e618b2f63f55f15b83336f3f60fb0284ad2
SSDEEP 24576:aYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnIyz8:aYREXSVMDi3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_c5680de29ecaa3adff453c92e1c4cc471815c1351aeb545d8df3ccf469a7e9a6.exe
Size 1.5MB
SHA256 cccbf20629744a9c79f7c010ae833cac2a8a2c5dfebf9dbd6248500449b0f97f
MD5 cb6b31577a100c0cb57d8240799fc403
SHA1 240030ba88aabb5b4e7a4a0d7097eaed68826983
SHA512 a53a6c0fbd75ea2231ab3f00a425e3a02c3169a33ddf1dc76bd54adb462a9b7ab04372a7041e92fa3c23bd1e0a7ee27b980410279b46ff7d6a8241fa6d71d5d0
SSDEEP 24576:XnsJ39LyjbJkQFMhmC+6GD9A0w84zbDFyj+9wbYCVyXB2vJ/Vc2qGWTiVjqfNnzW:XnsHyjtk2MYC5GD7LCC12IX
MD5 SHA1 SHA512 SSDEEP

Submit Download

b9RtnmxA.xlsm

Path C:\Users\Admin\AppData\Local\Temp\b9RtnmxA.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

look2.exe

Path C:\Users\Admin\AppData\Local\Temp\look2.exe
Size 337KB
SHA256 86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
MD5 2f3b6f16e33e28ad75f3fdaef2567807
SHA1 85e907340faf1edfc9210db85a04abd43d21b741
SHA512 db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
SSDEEP 6144:8IXwWcHnNmZEvB7csAPRZyfQjCfA3lMXm4Y+5bFnWBFopJOU:8IXwDNmZEvJcscRZzjCI1O5W
MD5 SHA1 SHA512 SSDEEP

Submit Download

240607031.bat

Path C:\Windows\SysWOW64\240607031.bat
Size 51KB
SHA256 3bd74d423ad107e073fba565f7355100edac28a70e0461e0954a1bfeb1fe93b1
MD5 ac63bba2d9223614c632e3ea6d30dc77
SHA1 129331320ec95dae7cb1176e149f280bb55e9e15
SHA512 ba2d13da173549b14f1a60e70da5f237da9e76b5a73d1e9dc09b8bf8512a3fbbafdd35b2a49ab5fe127e3f36a6ab8e2c4c8a85a2a540309e488b2c8e2edfdd83
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLlJYH5:1dWubF3n9S91BF3fboxJYH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Windows\SysWOW64\svchcst.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-121-0x0000000000560000-0x000000000056B000-memory.dmp

Download

memory/840-126-0x000000006FB90000-0x000000006FBA0000-memory.dmp

Download

memory/2116-179-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp

Download

memory/2116-177-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp

Download

memory/2116-176-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp

Download

memory/2116-175-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp

Download

memory/2116-178-0x00007FF9D6C50000-0x00007FF9D6C60000-memory.dmp

Download

memory/2116-180-0x00007FF9D4A70000-0x00007FF9D4A80000-memory.dmp

Download

memory/2116-181-0x00007FF9D4A70000-0x00007FF9D4A80000-memory.dmp

Download

memory/3608-171-0x0000000000670000-0x000000000067B000-memory.dmp

Download

memory/3844-198-0x0000000000400000-0x000000000057D000-memory.dmp

Download

memory/3844-224-0x0000000000400000-0x000000000057D000-memory.dmp

Download

memory/4976-137-0x0000000000400000-0x000000000057D000-memory.dmp

Download

memory/4976-18-0x0000000000770000-0x0000000000771000-memory.dmp

Download