lockbit | 1ce80b2bb2a5f56573ca7b6f662accea56f4b9e0e3052ddec14fe03364c14dfe

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cryp_RAT.rtf
Size 662KB
Sample240521-sr92caad4w
SHA256 44b87df9f68f5a3084c7d80c1c7492ca5209e816a4e83fdbd6e2fcb6f1ff936f
MD5 1fc2941b70df9dd6cdf4cb82af740fe9
SHA1 e5d18e3487ca2d5037215c0e0ebfaf7ccae1c655
SHA512 d5da156e406093bfd398d78a36962360ed6918d6b96e641843e7eeddbd6fe41c0a1681bf0a4fe9e31be22d7b1e16267e62abafc9c14d1dea223e72f3ef810081
SSDEEP 12288:6NtcndUa0XzmFe4lT+F4qZDGefM4qeF4C:6Oua0XzmFFI+7Z4VT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit neshta persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\TdGeIqAUn.README.txt

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom If you not pay Payment:BITCOIN AFTER SEND BITCOIN Contact [email protected]

Emails

[email protected]

Signatures

Detect Neshta payload 7 IoCs

resource	yara_rule
behavioral2/files/0x00060000000173f6-9.dat	family_neshta
behavioral2/files/0x0001000000010313-23.dat	family_neshta
behavioral2/files/0x0005000000018797-1088.dat	family_neshta
behavioral2/memory/2704-1143-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/840-1144-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2704-1148-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/840-1146-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Lockbit
Ransomware family with multiple variants released since late 2019.
ransomware lockbit
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Renames multiple (365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 5 IoCs

pid	Process
2704	Client.exe
2568	Client.exe
1732	Client.exe
1536	496F.tmp
840	svchost.com

Loads dropped DLL 32 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe
2704	Client.exe
2568	Client.exe
2704	Client.exe
1732	Client.exe
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com
840	svchost.com

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Client.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini	Client.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini	Client.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\TdGeIqAUn.bmp"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\TdGeIqAUn.bmp"	Client.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1536	496F.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 1732	2568	Client.exe	36

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	Client.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	Client.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	Client.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	Client.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	Client.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	Client.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	Client.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	Client.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	Client.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 2 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
3028	EQNEDT32.EXE
2672	EQNEDT32.EXE

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\WallpaperStyle = "10"	Client.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.TdGeIqAUn\ = "TdGeIqAUn"	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TdGeIqAUn\DefaultIcon	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1964	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe
1732	Client.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	Client.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	Client.exe
Token: SeAssignPrimaryTokenPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeDebugPrivilege	1732	Client.exe
Token: 36	1732	Client.exe
Token: SeImpersonatePrivilege	1732	Client.exe
Token: SeIncBasePriorityPrivilege	1732	Client.exe
Token: SeIncreaseQuotaPrivilege	1732	Client.exe
Token: 33	1732	Client.exe
Token: SeManageVolumePrivilege	1732	Client.exe
Token: SeProfSingleProcessPrivilege	1732	Client.exe
Token: SeRestorePrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSystemProfilePrivilege	1732	Client.exe
Token: SeTakeOwnershipPrivilege	1732	Client.exe
Token: SeShutdownPrivilege	1732	Client.exe
Token: SeDebugPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeBackupPrivilege	1732	Client.exe
Token: SeSecurityPrivilege	1732	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	WINWORD.EXE
1964	WINWORD.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2664	2672	EQNEDT32.EXE	30
PID 2672 wrote to memory of 2664	2672	EQNEDT32.EXE	30
PID 2672 wrote to memory of 2664	2672	EQNEDT32.EXE	30
PID 2672 wrote to memory of 2664	2672	EQNEDT32.EXE	30
PID 2664 wrote to memory of 2704	2664	cmd.exe	32
PID 2664 wrote to memory of 2704	2664	cmd.exe	32
PID 2664 wrote to memory of 2704	2664	cmd.exe	32
PID 2664 wrote to memory of 2704	2664	cmd.exe	32
PID 2704 wrote to memory of 2568	2704	Client.exe	34
PID 2704 wrote to memory of 2568	2704	Client.exe	34
PID 2704 wrote to memory of 2568	2704	Client.exe	34
PID 2704 wrote to memory of 2568	2704	Client.exe	34
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 2568 wrote to memory of 1732	2568	Client.exe	36
PID 1732 wrote to memory of 1536	1732	Client.exe	40
PID 1732 wrote to memory of 1536	1732	Client.exe	40
PID 1732 wrote to memory of 1536	1732	Client.exe	40
PID 1732 wrote to memory of 1536	1732	Client.exe	40
PID 1732 wrote to memory of 1536	1732	Client.exe	40
PID 1536 wrote to memory of 840	1536	496F.tmp	41
PID 1536 wrote to memory of 840	1536	496F.tmp	41
PID 1536 wrote to memory of 840	1536	496F.tmp	41
PID 1536 wrote to memory of 840	1536	496F.tmp	41
PID 840 wrote to memory of 2940	840	svchost.com	42
PID 840 wrote to memory of 2940	840	svchost.com	42
PID 840 wrote to memory of 2940	840	svchost.com	42
PID 840 wrote to memory of 2940	840	svchost.com	42

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Cryp_RAT.rtf"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1964

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
PID:3028

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c%tmp%\Client.exe AC
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Client.exe
    C:\Users\Admin\AppData\Local\Temp\Client.exe AC
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe" A C
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\Client.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops desktop.ini file(s)
        Sets desktop wallpaper using registry
        Modifies Control Panel
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: RenamesItself
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1732
      - C:\ProgramData\496F.tmp
        
        "C:\ProgramData\496F.tmp"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\496F.tmp >> NUL
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\496F.tmp >> NUL
        8⤵
        
        PID:2940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini
Size 129B
SHA256 17eae72a7e16b9a5bb9eba572457853e86d6f13b64a71041f74031385a7a949c
MD5 5f6918fc63cf6df088dfc79350a3f35e
SHA1 8d5263809e10bdb315b0d4bef26f9f95de8b48ae
SHA512 51762520971b6e0a1ad6d8c894c576c0702d4e66b49b1090437863c3eb942b8e07bf7c288419ae963342e43c54f1cd4b411df1f7868044312b86f0984477e534
MD5 SHA1 SHA512

Submit Download

DW20.EXE

Path C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
Size 859KB
SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
MD5 02ee6a3424782531461fb2f10713d3c1
SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
SSDEEP 24576:XWq1lx7SqE0xJ2pm8FiWCm3LHgZpJEHp37d:XWq171dxJ6mAQm3LHkJEJLd
MD5 SHA1 SHA512 SSDEEP

Submit Download

TdGeIqAUn.README.txt

Path C:\TdGeIqAUn.README.txt
Size 289B
SHA256 a0c4eeae47956b19b2667ae5c94a154fc5002a78dea22e028049ece1d7a0c920
MD5 47bf1514a0892e2468125cbf3b32caa9
SHA1 c3c24479ebefd9a0a05b0db879941951a702c77b
SHA512 252d78c25d9d5bd3eece76ce940cfadd6f80a81f59fea34c37495388cba4baccf1982cc2098cba28ee933b1d18cfbaa485b9e0fafa1791edfc5c86dd463329aa
MD5 SHA1 SHA512

Submit Download

FC0511BC.wmf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FC0511BC.wmf
Size 316B
SHA256 9639441a9d36e7e4fda980961b75eeb334540b8cfbcee71eb3cd857e0a838e0c
MD5 95bb648d6eb9265eeaf0f889731b1e23
SHA1 631d60a024835f4e53ceb9d0a987ce52fe517df4
SHA512 184414ea68092124290049282147070a86172833359404ee26199a36083d720e291d55bb85e4ae1d02504ce841efbc646760e7cc5af4088a253aed7b2665c420
MD5 SHA1 SHA512

Submit Download

EEEEEEEEEE

Path C:\Users\Admin\AppData\Local\Temp\3582-490\EEEEEEEEEE
Size 282KB
SHA256 374c837398a9f6948d10ada457996c52baaa269442c9f0d29e206f0663a34d87
MD5 45401d42eb2ae93f5b01c8a771bde3fb
SHA1 c90e32ca084f1a9c553dbb435e88eef4ea7783d3
SHA512 f3dd83761dc0479516a66e5476b9bdd8f19554e544b14b504038d49954e5923e0ba1f70cf9aa9fa3c84c728400f76fe3ee406a72cd44030d5bdc9e787d638794
SSDEEP 6144:gCIVc1bYP5CIVc1bYP5CIVc1bYP5CIVc1bYP5CIVG:11bR1bR1bR1b1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Local\Temp\Client.exe
Size 323KB
SHA256 f6c559c031b7b16b1edf34b38e74b6bf3a7106ca34881d7f5c63b8e0d7ac3694
MD5 2b9a1b7a5e13b8672655d0a09ce50217
SHA1 2b62dbb4edbc5460bb42e790ca1a4ba7a4821362
SHA512 db34521fbd83a5c9a3671f2ed14854e98c83256a8e16b809d7a165754e5f02c3c6b7dd1f4e994be7e859da5a5a852b5a93d4846cefbc6985d81a56a34a766f52
SSDEEP 3072:sr85CS8+cKuGcaYYPhZyK0aGp0vH+rUTftHool3G+Ehgi3M1SBJhGvlfb9FDh5a7:k9S87iZOaGpWHSkhaYKJhq346VzQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

~$yp_RAT.rtf

Path C:\Users\Admin\AppData\Local\Temp\~$yp_RAT.rtf
Size 162B
SHA256 5539dec4d5053baed5c2c2f331ae97ecc7972cc801df6145f020648c25cbe01b
MD5 02b0e93f13f2d9a87780298eaf864e1d
SHA1 30f8443140bf25af06014ab312e9e2e470bb7c63
SHA512 e1d6b74c3db9d33bfdb78e383fc03c3d150583975b8e81888126cca24c0712998c08fb7395ff16bc665a78650ad3df35baebfe39200054cca7f475311ce4ce1d
MD5 SHA1 SHA512

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 91a8a010b76f69ec29934c4d0fa207c54850daa5941aeccea941d46e0525fc27
MD5 27cc46f9e49226bff7bd9d80ceb6f00b
SHA1 ce38b70cb368a5047c32a63f5c1942e04e1d8d3d
SHA512 c3a9d7886aa34ef77bffdc55c5aa59eff8eed4367b514606f197590cf63deadf5f1e83b4aaf5d87e668e5e5f710ee0737b7cf64416892fcdfc6430f28b356f65
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ4IFiwmnVoc:JxqjQ+P04wsmJCdIfmn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDDDDDDDDDD

Path F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\DDDDDDDDDDD
Size 129B
SHA256 b71be3ead5e9c46d88ef0d9140600ffaf7413312a537aecc15ca824f0d39e9a2
MD5 60904494ccb19c16d869e624ef5eb784
SHA1 950523c82f4d6d7f9fd5a63e6e8f3bb0d4bf64a5
SHA512 fbb58c38e3895bc99415a5d776099fc8ec5037141ab8040f5edaf5caefce3ac4c2a72d84af09e7672886b2d3cc3bc83a635b39f3a4f8ee7e121295f0b267f42a
MD5 SHA1 SHA512

Submit Download

LOGTRA~1.EXE

Path \PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
Size 252KB
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
SSDEEP 6144:gMTi0+lfh+L5qe9T5q4GAFzWTBPMmC1UC6fOaU:gMTi0uhMqe9ts2zWTpMmCG7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

496F.tmp

Path \ProgramData\496F.tmp
Size 14KB
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path \Users\Admin\AppData\Local\Temp\3582-490\Client.exe
Size 282KB
SHA256 f00b211b5f93e23409e9383930c79990949b3671b1c1e0dc00208bb1c8f1e10d
MD5 035a441e07c7d7797cccfc92a988e156
SHA1 7d33fe3c6e43ae0440db5fc51d7d9fe653379902
SHA512 9b10c302581fed3b186ee9ad598ba98597318ae09a538eaedab7bffa0db5d4dea82d1a2ae4e320e210575763073f0e58be9416e8758ab495b02f9a54360a6636
SSDEEP 3072:XefdNTzaf8KuGcaYYPhZyK0aGp0vH+rUTftHool3G+Ehgi3M1SBJhGvlfb9FDh5r:X6VzQyiZOaGpWHSkhaYKJhq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ose00000.exe

Path \Users\Admin\AppData\Local\Temp\ose00000.exe
Size 145KB
SHA256 70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc
MD5 9d10f99a6712e28f8acd5641e3a7ea6b
SHA1 835e982347db919a681ba12f3891f62152e50f0d
SHA512 2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5
SSDEEP 1536:vC4QOL26NOd32mM6X/pGzd4t/qcarbwNfQ8WfQJ+ItkbKR2zy2IoN7Zo86eAI0UV:K4QgNOd3z44Kw6JrokFyF5Zat/Vq09oi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-1144-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/840-1146-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1732-48-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-1044-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-44-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-53-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-55-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-40-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-42-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-36-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-63-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-60-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-205-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-46-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-268-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1732-51-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-1023-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-1022-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-1047-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-1046-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1732-38-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1964-0-0x000000002F9F1000-0x000000002F9F2000-memory.dmp

Download

memory/1964-71-0x000000007183D000-0x0000000071848000-memory.dmp

Download

memory/1964-2-0x000000007183D000-0x0000000071848000-memory.dmp

Download

memory/1964-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2568-34-0x00000000008C0000-0x00000000008D2000-memory.dmp

Download

memory/2568-25-0x0000000000E90000-0x0000000000EDC000-memory.dmp

Download

memory/2704-1143-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2704-1148-0x0000000000400000-0x000000000041B000-memory.dmp

Download