lokibot | 5720c60315d74bd03cbac4ff76f9357561723a412d92359d0b16fab556f00eea

Analysis

max time kernel
145s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e89cd9271ce8707e8d39ad3b96128c6_JaffaCakes118.rtf
Size 524KB
Sample240510-ls824sbb46
SHA256 5720c60315d74bd03cbac4ff76f9357561723a412d92359d0b16fab556f00eea
MD5 2e89cd9271ce8707e8d39ad3b96128c6
SHA1 90be2881bf4702bfe0f905728ab284b783ffda45
SHA512 4f6ba8cf7627b97379212c7d246c0ba76b0c7a69019b6b85cfa2f30617eb43ce0785d6b6974ff1942971776b50838c6163256a1836f30cb405ac5abcce143850
SSDEEP 12288:HQPeWsDoNrXHvrfjM+lygoGE2AAxBme8KZrZNc:wPFsyXvjlfdE2L/me8K6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lokibot collection spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://kammies.co.za/fund/loki/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2628	1612	cmd.exe	27
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2452	1612	cmd.exe	27

Executes dropped EXE 2 IoCs

pid	Process
2404	exe.exe
2000	exe.exe

Loads dropped DLL 3 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe
2404	exe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	exe.exe
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	exe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2000	2404	exe.exe	65

Office loads VBA resources, possible macro or embedded object present

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2888	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1032	taskkill.exe

Launches Equation Editor 1 TTPs 2 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2588	EQNEDT32.EXE
2440	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1612	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeDebugPrivilege	2000	exe.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2404	exe.exe
2404	exe.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2404	exe.exe
2404	exe.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1612	WINWORD.EXE
1612	WINWORD.EXE
1612	WINWORD.EXE
2404	exe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2628	1612	WINWORD.EXE	28
PID 1612 wrote to memory of 2628	1612	WINWORD.EXE	28
PID 1612 wrote to memory of 2628	1612	WINWORD.EXE	28
PID 1612 wrote to memory of 2628	1612	WINWORD.EXE	28
PID 2628 wrote to memory of 2664	2628	cmd.exe	30
PID 2628 wrote to memory of 2664	2628	cmd.exe	30
PID 2628 wrote to memory of 2664	2628	cmd.exe	30
PID 2628 wrote to memory of 2664	2628	cmd.exe	30
PID 1612 wrote to memory of 2452	1612	WINWORD.EXE	31
PID 1612 wrote to memory of 2452	1612	WINWORD.EXE	31
PID 1612 wrote to memory of 2452	1612	WINWORD.EXE	31
PID 1612 wrote to memory of 2452	1612	WINWORD.EXE	31
PID 2664 wrote to memory of 2888	2664	cmd.exe	33
PID 2664 wrote to memory of 2888	2664	cmd.exe	33
PID 2664 wrote to memory of 2888	2664	cmd.exe	33
PID 2664 wrote to memory of 2888	2664	cmd.exe	33
PID 2588 wrote to memory of 2424	2588	EQNEDT32.EXE	35
PID 2588 wrote to memory of 2424	2588	EQNEDT32.EXE	35
PID 2588 wrote to memory of 2424	2588	EQNEDT32.EXE	35
PID 2588 wrote to memory of 2424	2588	EQNEDT32.EXE	35
PID 2664 wrote to memory of 2404	2664	cmd.exe	38
PID 2664 wrote to memory of 2404	2664	cmd.exe	38
PID 2664 wrote to memory of 2404	2664	cmd.exe	38
PID 2664 wrote to memory of 2404	2664	cmd.exe	38
PID 2664 wrote to memory of 1032	2664	cmd.exe	39
PID 2664 wrote to memory of 1032	2664	cmd.exe	39
PID 2664 wrote to memory of 1032	2664	cmd.exe	39
PID 2664 wrote to memory of 1032	2664	cmd.exe	39
PID 2664 wrote to memory of 568	2664	cmd.exe	41
PID 2664 wrote to memory of 568	2664	cmd.exe	41
PID 2664 wrote to memory of 568	2664	cmd.exe	41
PID 2664 wrote to memory of 568	2664	cmd.exe	41
PID 2664 wrote to memory of 1880	2664	cmd.exe	42
PID 2664 wrote to memory of 1880	2664	cmd.exe	42
PID 2664 wrote to memory of 1880	2664	cmd.exe	42
PID 2664 wrote to memory of 1880	2664	cmd.exe	42
PID 2664 wrote to memory of 1180	2664	cmd.exe	43
PID 2664 wrote to memory of 1180	2664	cmd.exe	43
PID 2664 wrote to memory of 1180	2664	cmd.exe	43
PID 2664 wrote to memory of 1180	2664	cmd.exe	43
PID 2664 wrote to memory of 1868	2664	cmd.exe	44
PID 2664 wrote to memory of 1868	2664	cmd.exe	44
PID 2664 wrote to memory of 1868	2664	cmd.exe	44
PID 2664 wrote to memory of 1868	2664	cmd.exe	44
PID 2664 wrote to memory of 2484	2664	cmd.exe	45
PID 2664 wrote to memory of 2484	2664	cmd.exe	45
PID 2664 wrote to memory of 2484	2664	cmd.exe	45
PID 2664 wrote to memory of 2484	2664	cmd.exe	45
PID 2664 wrote to memory of 2668	2664	cmd.exe	46
PID 2664 wrote to memory of 2668	2664	cmd.exe	46
PID 2664 wrote to memory of 2668	2664	cmd.exe	46
PID 2664 wrote to memory of 2668	2664	cmd.exe	46
PID 2664 wrote to memory of 2512	2664	cmd.exe	47
PID 2664 wrote to memory of 2512	2664	cmd.exe	47
PID 2664 wrote to memory of 2512	2664	cmd.exe	47
PID 2664 wrote to memory of 2512	2664	cmd.exe	47
PID 2664 wrote to memory of 2716	2664	cmd.exe	48
PID 2664 wrote to memory of 2716	2664	cmd.exe	48
PID 2664 wrote to memory of 2716	2664	cmd.exe	48
PID 2664 wrote to memory of 2716	2664	cmd.exe	48
PID 2664 wrote to memory of 2708	2664	cmd.exe	49
PID 2664 wrote to memory of 2708	2664	cmd.exe	49
PID 2664 wrote to memory of 2708	2664	cmd.exe	49
PID 2664 wrote to memory of 2708	2664	cmd.exe	49

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	exe.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	exe.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2e89cd9271ce8707e8d39ad3b96128c6_JaffaCakes118.rtf"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\TaSk.BaT
  2⤵
  - Process spawned unexpected child process
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\2nd.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\timeout.exe
      TIMEOUT 1
      4⤵
      Delays execution with timeout.exe
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\exe.exe
      C:\Users\Admin\AppData\Local\Temp\ExE.ExE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\exe.exe
        
        C:\Users\Admin\AppData\Local\Temp\ExE.ExE
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:2000
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im WiNwOrD.ExE
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1032
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f
      4⤵
      PID:1180
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f
      4⤵
      PID:2484
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\reg.exe
      reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:2708
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:2832
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:2856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:2604
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:2212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:1512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:2236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:1372
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:1796
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
      4⤵
      PID:1444
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
        5⤵
        
        PID:1500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\TaSk.BaT
  2⤵
  - Process spawned unexpected child process
  PID:2452

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\CmD.exe
  CmD /C %tmp%\task.bat & UUUUUUUUc
  2⤵
  PID:2424

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2nd.bat

Path C:\Users\Admin\AppData\Local\Temp\2nd.bat
Size 2KB
SHA256 0869a1fd4fb5aa0e5c701ce235f5f9a0925743bf6476b77695ee653e595aa13e
MD5 dfbdc9e9405e901b283ccb70364c9c5f
SHA1 6ab78e770fa57175aba8a89cdf71bb3553ebcac7
SHA512 6dcc08bb22ac6383797fd87dbbbf6048917db9135ca7333892b4fda626ca9f045aca36b10b351739c5fe10d6f3d2849ebf11493ddec401245c0aac988cb2a579
MD5 SHA1 SHA512

Submit Download

decoy.doc

Path C:\Users\Admin\AppData\Local\Temp\decoy.doc
Size 6KB
SHA256 12d569236200a78da31715b1276e6c953780ee3ea36bee03ed7cafea51be7f68
MD5 22db91ced51f52822e10d64a397460fe
SHA1 9deeabdd9a08b58ac448649c860985f0c148cbfa
SHA512 c36cdfbafaa010b656996e0e06233090a57c8600bf74091cffdefd1d8ba9b11b952423e9ed2a8ce4d3128f85b67cb5f18c01d3df8569db2f63dd58846d728371
SSDEEP 96:rxMowP8d+jESgQoBgYC2zGTLSQojjRgbaQPWnIwa0G5Zc7+wyROPNMORvCw:NzIFjESgQ2aLcfg8xFc67+wyRGiO8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

exe.exe

Path C:\Users\Admin\AppData\Local\Temp\exe.exe
Size 212KB
SHA256 17d6bedaab6665be9ce53aef10096abff538bafee00685afbe6392d7e7db98b9
MD5 08147977cd3942bc48eea306e67789e1
SHA1 5c1aa2e79933e2a4d6b4b928beaacb3900978c9b
SHA512 bdaf8dd3cacabaf9d4c4ce5b0241b2d57003af0b98a07b6916bec8c180557bb547cff80f7ae07d0df87fc9db64a1a3b67e93bec85c9cf8e299b23b42f2af32a4
SSDEEP 6144:2D2XeskRAn4Fsl7GU2XPb33Di6KxzamUFM:QkeskRA4+7GUCUxemR
MD5 SHA1 SHA512 SSDEEP

Submit Download

inteldriverupd1.sct

Path C:\Users\Admin\AppData\Local\Temp\inteldriverupd1.sct
Size 423B
SHA256 002394c515bc0df787f99f565b6c032bef239a5e40a33ac710395bf264520df7
MD5 36ad6d953da9665f7ff59e4145d5278a
SHA1 d6b7685ec25b5a40b3d40c945df56b3dee4a580e
SHA512 afdbf8ffb330d2f4b3893adecd7153be7ce2b53c1635ca0f506d7a71354e576d70cfd5ff0787e2d61915525ed26a0dd729696be32c202e4acc2b4854dec4229f
MD5 SHA1 SHA512

Submit Download

task.bat

Path C:\Users\Admin\AppData\Local\Temp\task.bat
Size 150B
SHA256 237522755a5bc868ccb78ab36ef3f0f7bd241e3efaca1b11ff01c81ea823f7a6
MD5 ed18567cefdf0fb72e8c9e142e40d9f6
SHA1 3f857e43375c98a1e2bd085d246e43436af17b5f
SHA512 3f1188636f7bd7c98554d66e7358e37b405776a8607fc5a2031d1a2af470f3a3f085cdc2efe06fb172a23e1840b0e1c5861593e7c0327b9567af0e51abdb08cf
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\0f5007522459c86e95ffcc62f32308f1_4456596e-0528-4680-8940-5edc26c0ff50
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

memory/1612-0-0x000000002FB71000-0x000000002FB72000-memory.dmp

Download

memory/1612-2-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

Download

memory/1612-42-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

Download

memory/1612-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2000-46-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2000-48-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2000-67-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/2000-82-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads