gh0strat | d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Size 3.0MB
Sample240528-v2fxcsdc6v
SHA256 d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302
MD5 48a26f5029845c68214facd89bd88430
SHA1 c41953476df622810edbc81510a6b0a3f4f75521
SHA512 639e3634392317a36687aa008a25c33db98dfc3775fb5a4fab19d7ce9c75b156a603a4634f3c8c188fc75266168ba1e19ceae37bf479d37331b8af233e2346fe
SSDEEP 49152:n09XJt4HIN2H2tFvduySd3dUZTHhLAlUvwaMb:0ZJt4HINy2Lkd3dUZt7vwaM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox discovery evasion persistence rat rootkit spyware stealer trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3444-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3444-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3444-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/216-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/216-33-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/216-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/216-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4700-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/3444-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3444-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3444-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/216-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/216-33-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/216-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/216-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4700-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	HD_msedge.exe

Executes dropped EXE 22 IoCs

pid	Process
3444	RVN.exe
4700	TXPlatforn.exe
216	TXPlatforn.exe
1988	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
2760	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
4736	msedge.exe
2924	RVN.exe
4684	TXPlatforn.exe
880	TXPlatforn.exe
3868	HD_msedge.exe
2580	HD_msedge.exe
3768	HD_msedge.exe
3624	HD_msedge.exe
600	HD_msedge.exe
780	HD_msedge.exe
4496	HD_msedge.exe
1580	HD_msedge.exe
2060	HD_msedge.exe
1440	HD_msedge.exe
548	HD_msedge.exe
2824	HD_msedge.exe
4056	HD_msedge.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3444-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3444-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3444-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/216-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/216-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/216-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/216-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4700-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_msedge.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\Z:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\B:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\K:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\M:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\Q:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\T:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\V:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\A:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\E:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\O:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\W:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\X:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\G:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\L:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\U:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\S:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\H:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\I:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\J:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\N:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\P:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened (read-only)	\??\R:	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	HD_msedge.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	HD_msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	HD_msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3304	PING.EXE
4080	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
4736	msedge.exe
4736	msedge.exe
3624	HD_msedge.exe
3624	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3320	identity_helper.exe
3320	identity_helper.exe
4056	HD_msedge.exe
4056	HD_msedge.exe
4056	HD_msedge.exe
4056	HD_msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
216	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3444	RVN.exe
Token: SeDebugPrivilege	1988	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Token: SeDebugPrivilege	1988	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Token: SeLoadDriverPrivilege	216	TXPlatforn.exe
Token: SeDebugPrivilege	2760	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Token: SeDebugPrivilege	2760	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Token: SeIncBasePriorityPrivilege	2924	RVN.exe
Token: 33	216	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	216	TXPlatforn.exe
Token: 33	216	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	216	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe
3868	HD_msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 3444	1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	85
PID 1908 wrote to memory of 3444	1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	85
PID 1908 wrote to memory of 3444	1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	85
PID 3444 wrote to memory of 4140	3444	RVN.exe	87
PID 3444 wrote to memory of 4140	3444	RVN.exe	87
PID 3444 wrote to memory of 4140	3444	RVN.exe	87
PID 4700 wrote to memory of 216	4700	TXPlatforn.exe	88
PID 4700 wrote to memory of 216	4700	TXPlatforn.exe	88
PID 4700 wrote to memory of 216	4700	TXPlatforn.exe	88
PID 1908 wrote to memory of 1988	1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	89
PID 1908 wrote to memory of 1988	1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	89
PID 1908 wrote to memory of 1988	1908	d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	89
PID 4140 wrote to memory of 3304	4140	cmd.exe	91
PID 4140 wrote to memory of 3304	4140	cmd.exe	91
PID 4140 wrote to memory of 3304	4140	cmd.exe	91
PID 1988 wrote to memory of 2760	1988	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	93
PID 1988 wrote to memory of 2760	1988	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	93
PID 1988 wrote to memory of 2760	1988	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	93
PID 2760 wrote to memory of 4736	2760	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	102
PID 2760 wrote to memory of 4736	2760	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	102
PID 2760 wrote to memory of 4736	2760	HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe	102
PID 4736 wrote to memory of 2924	4736	msedge.exe	103
PID 4736 wrote to memory of 2924	4736	msedge.exe	103
PID 4736 wrote to memory of 2924	4736	msedge.exe	103
PID 2924 wrote to memory of 4616	2924	RVN.exe	106
PID 2924 wrote to memory of 4616	2924	RVN.exe	106
PID 2924 wrote to memory of 4616	2924	RVN.exe	106
PID 4684 wrote to memory of 880	4684	TXPlatforn.exe	107
PID 4684 wrote to memory of 880	4684	TXPlatforn.exe	107
PID 4684 wrote to memory of 880	4684	TXPlatforn.exe	107
PID 4736 wrote to memory of 3868	4736	msedge.exe	108
PID 4736 wrote to memory of 3868	4736	msedge.exe	108
PID 3868 wrote to memory of 2580	3868	HD_msedge.exe	109
PID 3868 wrote to memory of 2580	3868	HD_msedge.exe	109
PID 4616 wrote to memory of 4080	4616	cmd.exe	111
PID 4616 wrote to memory of 4080	4616	cmd.exe	111
PID 4616 wrote to memory of 4080	4616	cmd.exe	111
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112
PID 3868 wrote to memory of 3768	3868	HD_msedge.exe	112

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	HD_msedge.exe

C:\Users\Admin\AppData\Local\Temp\d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
"C:\Users\Admin\AppData\Local\Temp\d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3304
- C:\Users\Admin\AppData\Local\Temp\HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
  C:\Users\Admin\AppData\Local\Temp\HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
    "C:\Users\Admin\AppData\Local\Temp\HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe" Admin
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\RVN.exe
        
        C:\Users\Admin\AppData\Local\Temp\\RVN.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        7⤵
        Runs ping.exe
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3868
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc9d346f8,0x7ffcc9d34708,0x7ffcc9d34718
        6⤵
        Executes dropped EXE
        
        PID:2580
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        6⤵
        Executes dropped EXE
        
        PID:3768
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3624
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3056 /prefetch:8
        6⤵
        Executes dropped EXE
        
        PID:600
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:780
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4496
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2060
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1580
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
        6⤵
        
        PID:2796
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3320
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
        6⤵
        Executes dropped EXE
        
        PID:1440
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:548
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2824
      - C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2016,17389010170318971082,937727242297688783,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4056

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:216

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
Size 3.2MB
SHA256 73d84d249f16b943d1d3f9dd9e516fadd323e70939c29b4a640693eb8818ee9a
MD5 ad8536c7440638d40156e883ac25086e
SHA1 fa9e8b7fb10473a01b8925c4c5b0888924a1147c
SHA512 b5f368be8853aa142dba614dcca7e021aba92b337fe36cfc186714092a4dab1c7a2181954cd737923edd351149980182a090dbde91081c81d83f471ff18888fe
SSDEEP 49152:+t3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMlTZZ2y/B5:+HCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.3MB
SHA256 f1830954c0b22ac81a3be46492c1f7dd0d91e146783e04d24119959a6ebd31b6
MD5 541cc4cee85cff3b243320a4ce0339a9
SHA1 ed7b64c6e01053210bc7f5d41a132f2ad51bd870
SHA512 14f69a44ab9eb28573b062a7e19c0c27f6a62c3accb67c07dace11febcb0fc6c1db5124714a4261a0d0f46ab5e6ceea745f3cc53c1e2a15f8a3bd437683bedd0
SSDEEP 49152:n09XJt4HIN2H2tFvduySwt3Pouv6sYIwNX7nw908hDspRqHZZOAQ6N2EMTTKgrMt:0ZJt4HINy2LkwHCLX7nkDnaDIZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f70ea92041c537539f2653758014de7abbb62c19ab5d19522952b481031c30fb
MD5 8efd665aac5efc1fde9e305790932377
SHA1 80cf779e2636be04ad2e647125103fbed287f493
SHA512 0aeb0a97cd372c444eb2e5244d4b11f7941da8ef19dd3f4cc22f9b801ccd247409bcff54b33799cc3a2a08f4a48a45696cef34e596bf2885a9dc4b67409ec77c
SSDEEP 96:nxokCB21tEj0wpvWMoiVmdeHmQIXUWQyV+VDCziEwb:nmk3LEj0GWMX0ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7aa2aefaf94d985539d8e5b18499325f3c5733a9a7cd0ad41ae4abeb363e87a2
MD5 db6061bf523d3aa0fb114f46540de255
SHA1 eae4fc462df1da40fc572372c6f29a27e1b40743
SHA512 03806b7af0f566d01ae0067f59810257851b2e5c58d66c41180213df6153a40a27c443e358375ffe055d098bad328d9a119cd616dca1bd4285ce79dd5f94be91
SSDEEP 96:nxok5B21tEj0wpvWMoiVmdeHmQIXUWQyV+VD7AiEwb:nmkCLEj0GWMX0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9d786071ef6742bfd9652294c6745f16ab53b67730956612382c8ac934f83775
MD5 0af66f41c38c9c3c409aa8cab4902ad4
SHA1 da6170111a6cd8b6841745dd74e261d2acc45875
SHA512 9fb90469ac1efe8767eea1ae07c7d074b4f20434c10718b4623ea3c7a066b0696beed41ed170639c4e4d95db5c359d3f74bfaa624b9a1411857b2319b2ea4bf6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupeSe2RUK+IKbN9fYOxhZHn4:A9iIxuERzA83h09RZxYesELxTHqTMTtG
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.2MB
SHA256 3892b5097ac17db1798fbd6c375c8089fa4198a34a0de1bf52cd8356a86f09ac
MD5 3c176561c153f60731739e816ad6768e
SHA1 ce78963a4368e71d79700741c57382045f786e3a
SHA512 b52e43d49a5393a40461c394fff756614d2e6430c7b62116223e96cc22038acb3c1fa7656ff2c47964af9ed715aad9b9799f1e70184d7b297f5b82c72faa45aa
SSDEEP 24576:n09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+iN:n09XJt4HIN2H2tFvduySw
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_d03251955fe23b21f471c714139041a7bf3d68dbb473db1c42009ab4387b2302.exe
Size 1.8MB
SHA256 8f4a93e879dd4627fb3e653b7907af42b76c5cd47fec957cbaeed3c74c6bd06a
MD5 87116cba87f4a00ac21f67003f623780
SHA1 1458e3807bd2569476558be954b917ed3d7eb9df
SHA512 976e09dd993ee3dd3a2a84973d1d9a9beaf0c43755706c9a2303e9c5554593e11a62cea32dcfb3b353a130f8ab2a3c6ff5c5c716eaf6a728fd9552a5f76b385f
SSDEEP 24576:j3vLR2VhZBJ905EmMyPnQxhe4dLwvHYgUaHEwvCMXrXDC/hR:j3dUZTHhLAlUvwaMb
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 822B
SHA256 1bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
MD5 03450e8ddb20859f242195450c19b8f1
SHA1 9698f8caf67c8853e14c8bf4933949f458c3044a
SHA512 87371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b
MD5 SHA1 SHA512

Submit Download

memory/216-33-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/216-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/216-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/216-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1988-80-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/2760-86-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/2760-83-0x0000000000400000-0x00000000005E4000-memory.dmp

Download

memory/3444-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3444-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3444-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3444-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3768-129-0x00007FFCD7E70000-0x00007FFCD7E71000-memory.dmp

Download

memory/4700-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4700-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download