exelastealer | f2e5a0cd3ad67ce08355c82525410f94484becd9ab5290245baad29633506b18

Analysis

max time kernel
145s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

35.4MB
MD5

2171c1030c8ef81b3d358519af67de82
SHA1

3ddf1d2798d351c6176d17d618d8e4572abe05e5
SHA256

e9cc790d80084d871196a56fc53f02a82ecc58c2e1321c07fa6db01002c5c04c
SHA512

a65ff90ba63e43a5784a79e422d094082a4e78baa3e52593f624a41c3c47e6f1f03d0693c328d001bdfe5fc05b957400d5293cce88784eb91e78f032ded5bd6d
SSDEEP

786432:pccIpAjY8dwtj9AK7DIZPFwyfyV4OwtD9WFhJjPcxImWl1wf7OJXiMLV3anZ8tav:ucIpAdQ+BPFwyfyHwtDsFPBwqJXiMpmF

Score

10^/10

exelastealer defense_evasion evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4652	netsh.exe
1804	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4364	main.exe

Loads dropped DLL 50 IoCs

pid	Process
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe
4364	main.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Waltuhium Update Service = "C:\\Users\\Admin\\AppData\\Local\\WaltuhiumUpdateService\\Waltuhium.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
39	discord.com
40	discord.com
41	discord.com
42	discord.com
37	discord.com
38	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1860	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3424	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
2892	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1196	WMIC.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery

T1057

pid	Process
1992	tasklist.exe
2280	tasklist.exe
3248	tasklist.exe
3828	tasklist.exe
3744	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2876	ipconfig.exe
4576	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2332	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4392	powershell.exe
4392	powershell.exe
4392	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	main.exe
Token: SeIncreaseQuotaPrivilege	1196	WMIC.exe
Token: SeSecurityPrivilege	1196	WMIC.exe
Token: SeTakeOwnershipPrivilege	1196	WMIC.exe
Token: SeLoadDriverPrivilege	1196	WMIC.exe
Token: SeSystemProfilePrivilege	1196	WMIC.exe
Token: SeSystemtimePrivilege	1196	WMIC.exe
Token: SeProfSingleProcessPrivilege	1196	WMIC.exe
Token: SeIncBasePriorityPrivilege	1196	WMIC.exe
Token: SeCreatePagefilePrivilege	1196	WMIC.exe
Token: SeBackupPrivilege	1196	WMIC.exe
Token: SeRestorePrivilege	1196	WMIC.exe
Token: SeShutdownPrivilege	1196	WMIC.exe
Token: SeDebugPrivilege	1196	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1196	WMIC.exe
Token: SeRemoteShutdownPrivilege	1196	WMIC.exe
Token: SeUndockPrivilege	1196	WMIC.exe
Token: SeManageVolumePrivilege	1196	WMIC.exe
Token: 33	1196	WMIC.exe
Token: 34	1196	WMIC.exe
Token: 35	1196	WMIC.exe
Token: 36	1196	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2872	WMIC.exe
Token: SeSecurityPrivilege	2872	WMIC.exe
Token: SeTakeOwnershipPrivilege	2872	WMIC.exe
Token: SeLoadDriverPrivilege	2872	WMIC.exe
Token: SeSystemProfilePrivilege	2872	WMIC.exe
Token: SeSystemtimePrivilege	2872	WMIC.exe
Token: SeProfSingleProcessPrivilege	2872	WMIC.exe
Token: SeIncBasePriorityPrivilege	2872	WMIC.exe
Token: SeCreatePagefilePrivilege	2872	WMIC.exe
Token: SeBackupPrivilege	2872	WMIC.exe
Token: SeRestorePrivilege	2872	WMIC.exe
Token: SeShutdownPrivilege	2872	WMIC.exe
Token: SeDebugPrivilege	2872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2872	WMIC.exe
Token: SeRemoteShutdownPrivilege	2872	WMIC.exe
Token: SeUndockPrivilege	2872	WMIC.exe
Token: SeManageVolumePrivilege	2872	WMIC.exe
Token: 33	2872	WMIC.exe
Token: 34	2872	WMIC.exe
Token: 35	2872	WMIC.exe
Token: 36	2872	WMIC.exe
Token: SeDebugPrivilege	3828	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1196	WMIC.exe
Token: SeSecurityPrivilege	1196	WMIC.exe
Token: SeTakeOwnershipPrivilege	1196	WMIC.exe
Token: SeLoadDriverPrivilege	1196	WMIC.exe
Token: SeSystemProfilePrivilege	1196	WMIC.exe
Token: SeSystemtimePrivilege	1196	WMIC.exe
Token: SeProfSingleProcessPrivilege	1196	WMIC.exe
Token: SeIncBasePriorityPrivilege	1196	WMIC.exe
Token: SeCreatePagefilePrivilege	1196	WMIC.exe
Token: SeBackupPrivilege	1196	WMIC.exe
Token: SeRestorePrivilege	1196	WMIC.exe
Token: SeShutdownPrivilege	1196	WMIC.exe
Token: SeDebugPrivilege	1196	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1196	WMIC.exe
Token: SeRemoteShutdownPrivilege	1196	WMIC.exe
Token: SeUndockPrivilege	1196	WMIC.exe
Token: SeManageVolumePrivilege	1196	WMIC.exe
Token: 33	1196	WMIC.exe
Token: 34	1196	WMIC.exe
Token: 35	1196	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 4364	2640	main.exe	87
PID 2640 wrote to memory of 4364	2640	main.exe	87
PID 4364 wrote to memory of 1016	4364	main.exe	88
PID 4364 wrote to memory of 1016	4364	main.exe	88
PID 4364 wrote to memory of 3084	4364	main.exe	89
PID 4364 wrote to memory of 3084	4364	main.exe	89
PID 4364 wrote to memory of 1680	4364	main.exe	90
PID 4364 wrote to memory of 1680	4364	main.exe	90
PID 4364 wrote to memory of 880	4364	main.exe	91
PID 4364 wrote to memory of 880	4364	main.exe	91
PID 4364 wrote to memory of 1960	4364	main.exe	92
PID 4364 wrote to memory of 1960	4364	main.exe	92
PID 3084 wrote to memory of 1196	3084	cmd.exe	93
PID 3084 wrote to memory of 1196	3084	cmd.exe	93
PID 1680 wrote to memory of 2872	1680	cmd.exe	94
PID 1680 wrote to memory of 2872	1680	cmd.exe	94
PID 1960 wrote to memory of 3828	1960	cmd.exe	95
PID 1960 wrote to memory of 3828	1960	cmd.exe	95
PID 4364 wrote to memory of 4084	4364	main.exe	97
PID 4364 wrote to memory of 4084	4364	main.exe	97
PID 4084 wrote to memory of 3044	4084	cmd.exe	98
PID 4084 wrote to memory of 3044	4084	cmd.exe	98
PID 4364 wrote to memory of 4648	4364	main.exe	99
PID 4364 wrote to memory of 4648	4364	main.exe	99
PID 4364 wrote to memory of 3744	4364	main.exe	100
PID 4364 wrote to memory of 3744	4364	main.exe	100
PID 4648 wrote to memory of 1716	4648	cmd.exe	101
PID 4648 wrote to memory of 1716	4648	cmd.exe	101
PID 3744 wrote to memory of 1992	3744	cmd.exe	102
PID 3744 wrote to memory of 1992	3744	cmd.exe	102
PID 4364 wrote to memory of 1860	4364	main.exe	103
PID 4364 wrote to memory of 1860	4364	main.exe	103
PID 1860 wrote to memory of 3480	1860	cmd.exe	104
PID 1860 wrote to memory of 3480	1860	cmd.exe	104
PID 4364 wrote to memory of 452	4364	main.exe	105
PID 4364 wrote to memory of 452	4364	main.exe	105
PID 452 wrote to memory of 4532	452	cmd.exe	106
PID 452 wrote to memory of 4532	452	cmd.exe	106
PID 4364 wrote to memory of 1504	4364	main.exe	107
PID 4364 wrote to memory of 1504	4364	main.exe	107
PID 1504 wrote to memory of 2280	1504	cmd.exe	108
PID 1504 wrote to memory of 2280	1504	cmd.exe	108
PID 4364 wrote to memory of 4432	4364	main.exe	109
PID 4364 wrote to memory of 4432	4364	main.exe	109
PID 4364 wrote to memory of 428	4364	main.exe	110
PID 4364 wrote to memory of 428	4364	main.exe	110
PID 4364 wrote to memory of 3972	4364	main.exe	111
PID 4364 wrote to memory of 3972	4364	main.exe	111
PID 4364 wrote to memory of 3288	4364	main.exe	112
PID 4364 wrote to memory of 3288	4364	main.exe	112
PID 4432 wrote to memory of 4184	4432	cmd.exe	113
PID 4432 wrote to memory of 4184	4432	cmd.exe	113
PID 428 wrote to memory of 1084	428	cmd.exe	114
PID 428 wrote to memory of 1084	428	cmd.exe	114
PID 3972 wrote to memory of 3248	3972	cmd.exe	115
PID 3972 wrote to memory of 3248	3972	cmd.exe	115
PID 3288 wrote to memory of 4392	3288	cmd.exe	116
PID 3288 wrote to memory of 4392	3288	cmd.exe	116
PID 4184 wrote to memory of 4544	4184	cmd.exe	117
PID 4184 wrote to memory of 4544	4184	cmd.exe	117
PID 1084 wrote to memory of 4884	1084	cmd.exe	118
PID 1084 wrote to memory of 4884	1084	cmd.exe	118
PID 4364 wrote to memory of 3096	4364	main.exe	119
PID 4364 wrote to memory of 3096	4364	main.exe	119

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3480	attrib.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe"
      4⤵
      Views/modifies file attributes
      PID:3480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Waltuhium Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Waltuhium Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\WaltuhiumUpdateService\Waltuhium.exe" /f
      4⤵
      Adds Run key to start application
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    PID:3096
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2332
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:2892
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:3680
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4216
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2872
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:2200
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:3936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:3044
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:4536
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:4672
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:1960
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:2004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:3764
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3744
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2876
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:1432
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      PID:452
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      PID:4576
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:3424
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4652
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    PID:4564
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

Filesize
81KB

MD5
86d1b2a9070cd7d52124126a357ff067

SHA1
18e30446fe51ced706f62c3544a8c8fdc08de503

SHA256
62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

SHA512
7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem

Filesize
285KB

MD5
d3e74c9d33719c8ab162baa4ae743b27

SHA1
ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b

SHA256
7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92

SHA512
e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd

Filesize
117KB

MD5
494f5b9adc1cfb7fdb919c9b1af346e1

SHA1
4a5fddd47812d19948585390f76d5435c4220e6b

SHA256
ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051

SHA512
2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll

Filesize
17.8MB

MD5
181458ffd109573a1cde903e187b0b46

SHA1
6822c8b9cad8f13f3c0921205ada08efd693d93e

SHA256
b177778656455f6b8482154238d323a3de4d74f2a8b7a62bd973251a259edb87

SHA512
0f771e01e5f89dd83a8e46d129a7975b6ca395369d82411c9864805f1efa9ab7051e6caa24a5fad121391a25cb84dc991845da976265f3d67f8528aa01a280a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32security.pyd

Filesize
133KB

MD5
ed4ac9facd1fd1986b1e955431edee0c

SHA1
3884e4a8d7d8e6975e8633884b3a1aedffb8539e

SHA256
2bf2f46c7b902f1525fdc58bd0ccead46b57a8568f68495ec41157b2125b3e23

SHA512
5d768fdd9d9404183dc636a1d55d9aeec994b320359cc88b36cb412c97b952550b2f3301b164e7694090d0a19d3088f9cb90aa04791221f97ff109a8185e3c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x1eu41td.jp5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_ctypes.pyd

Filesize
120KB

MD5
1635a0c5a72df5ae64072cbb0065aebe

SHA1
c975865208b3369e71e3464bbcc87b65718b2b1f

SHA256
1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

SHA512
6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_decimal.pyd

Filesize
248KB

MD5
20c77203ddf9ff2ff96d6d11dea2edcf

SHA1
0d660b8d1161e72c993c6e2ab0292a409f6379a5

SHA256
9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133

SHA512
2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_hashlib.pyd

Filesize
63KB

MD5
d4674750c732f0db4c4dd6a83a9124fe

SHA1
fd8d76817abc847bb8359a7c268acada9d26bfd5

SHA256
caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

SHA512
97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_lzma.pyd

Filesize
154KB

MD5
7447efd8d71e8a1929be0fac722b42dc

SHA1
6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

SHA256
60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

SHA512
c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_mysql_connector.pyd

Filesize
62KB

MD5
c61bbc9d4e224daa5f7f3caff51146d7

SHA1
a34ab73638c7681272b55a495bfae8ad209568cc

SHA256
bc8ba8b78e69b56e3b6c9987d0f87645a8dd482442f1694ae697f2d5b67d6454

SHA512
e8534d9a2383a2f630e0b1edec24f52ce924f19c515fefd71e743561e06cbf8edc0b1adb830c708d752e281cb6fb6f38ee75eb6a32d1e0623b49b699fd608c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_queue.pyd

Filesize
30KB

MD5
d8c1b81bbc125b6ad1f48a172181336e

SHA1
3ff1d8dcec04ce16e97e12263b9233fbf982340c

SHA256
925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

SHA512
ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_socket.pyd

Filesize
77KB

MD5
819166054fec07efcd1062f13c2147ee

SHA1
93868ebcd6e013fda9cd96d8065a1d70a66a2a26

SHA256
e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

SHA512
da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_ssl.pyd

Filesize
156KB

MD5
7910fb2af40e81bee211182cffec0a06

SHA1
251482ed44840b3c75426dd8e3280059d2ca06c6

SHA256
d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

SHA512
bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\_uuid.pyd

Filesize
24KB

MD5
b68c98113c8e7e83af56ba98ff3ac84a

SHA1
448938564559570b269e05e745d9c52ecda37154

SHA256
990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2

SHA512
33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\charset_normalizer\md.pyd

Filesize
10KB

MD5
f33ca57d413e6b5313272fa54dbc8baa

SHA1
4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44

SHA256
9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664

SHA512
f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\libcrypto-3-x64.dll

Filesize
4.9MB

MD5
7c1064e46f186a9b5b3348097551d625

SHA1
44c3d79e2e3c8e75b8b0c4730cea3125c857efe3

SHA256
d24111b7b006ec6ed917f407f5694c15b380cfd9ad2400d82d492e2ef8042800

SHA512
78daf6a72134b01d699987299c8e9c4f03cb23e4aedc83b7ecca1db2cecf0013369147237609ea8f5b8dc635162c6676408a7c93f4f134c2ded60a13bd158672

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\libmysql.dll

Filesize
6.7MB

MD5
ad5231552cfae6071c2c27ea43b438e4

SHA1
de8d7f4c4dccca7fa2b6d913a28759fc366efc68

SHA256
d0d363c525813f6437ad81a1894e6d29a5be6982b67a263edb03e1be5518efe4

SHA512
b309ab58eeec4505d472a3ba426d0c55fb9ebbf8653703bd9f553e8a643363935190211b9e86de9703b0a610d93c872285cd35203532971fd0fab540c803c295

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\libssl-1_1.dll

Filesize
688KB

MD5
bec0f86f9da765e2a02c9237259a7898

SHA1
3caa604c3fff88e71f489977e4293a488fb5671c

SHA256
d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

SHA512
ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\libssl-3-x64.dll

Filesize
758KB

MD5
f1d4563f03bb93441bea4a4dd81ca654

SHA1
c6ac64f5211cbe3bb9a6a456266748909b6305a8

SHA256
6cf23d4e61457f493116fa83ae504d514522a58de874655193ae9bcec52245fd

SHA512
cda0a5296ceaa6653b8885d249ed83d25707c809260c31f0e23b0306e5944115a3a679f06ad7aff757e6cc0e7f5c2fcbe2bf194d2d2a4fa1bafc972829cdf159

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\main.exe

Filesize
43.4MB

MD5
6e9d3e1015a944dd20120d792ec80453

SHA1
9f490e82a1329d73c3117e61fee3de89004b08c7

SHA256
e8f1c1b00978443e9808e9671bbf8c8b402311cc3f1086b99d3c7970476df82d

SHA512
73b3342a6db4eb8155fa62bbf1c31a205a25bff12e9053a7c1d1a7b2feba2d3fe2db38e1245e8b6fd498ede373bb56d2456d821a0c317c4ca4b1738e6bdeae00

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\msvcp140.dll

Filesize
576KB

MD5
01b946a2edc5cc166de018dbb754b69c

SHA1
dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46

SHA256
88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5

SHA512
65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\psutil\_psutil_windows.pyd

Filesize
65KB

MD5
3cba71b6bc59c26518dc865241add80a

SHA1
7e9c609790b1de110328bbbcbb4cd09b7150e5bd

SHA256
e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996

SHA512
3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\python3.dll

Filesize
64KB

MD5
fd4a39e7c1f7f07cf635145a2af0dc3a

SHA1
05292ba14acc978bb195818499a294028ab644bd

SHA256
dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9

SHA512
37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\python310.dll

Filesize
4.3MB

MD5
63a1fa9259a35eaeac04174cecb90048

SHA1
0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

SHA256
14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

SHA512
896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\pywintypes310.dll

Filesize
131KB

MD5
ceb06a956b276cea73098d145fa64712

SHA1
6f0ba21f0325acc7cf6bf9f099d9a86470a786bf

SHA256
c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005

SHA512
05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\select.pyd

Filesize
29KB

MD5
a653f35d05d2f6debc5d34daddd3dfa1

SHA1
1a2ceec28ea44388f412420425665c3781af2435

SHA256
db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

SHA512
5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\unicodedata.pyd

Filesize
1.1MB

MD5
81d62ad36cbddb4e57a91018f3c0816e

SHA1
fe4a4fc35df240b50db22b35824e4826059a807b

SHA256
1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

SHA512
7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\vcruntime140_1.dll

Filesize
36KB

MD5
135359d350f72ad4bf716b764d39e749

SHA1
2e59d9bbcce356f0fece56c9c4917a5cacec63d7

SHA256
34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

SHA512
cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2640_133637774428346412\zstandard\backend_c.pyd

Filesize
512KB

MD5
4652c4087b148d08adefedf55719308b

SHA1
30e06026fea94e5777c529b479470809025ffbe2

SHA256
003f439c27a532d6f3443706ccefac6be4152bebc1aa8bdf1c4adfc095d33795

SHA512
d4972c51ffbce63d2888ddfead2f616166b6f21a0c186ccf97a41c447c1fac6e848f464e4acde05bea5b24c73c5a03b834731f8807a54ee46ca8619b1d0c465d

Download Submit
memory/4364-196-0x00007FF8C6070000-0x00007FF8C71FF000-memory.dmp

Filesize
17.6MB

Download
memory/4364-207-0x00007FF8C6070000-0x00007FF8C71FF000-memory.dmp

Filesize
17.6MB

Download
memory/4392-189-0x000002A0B3D90000-0x000002A0B3DB2000-memory.dmp

Filesize
136KB

Download