blackmoon | 5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd

Analysis

max time kernel
34s
max time network
65s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
Size

259KB
MD5

f9f5342074462fa1048fea806eef535f
SHA1

61c4e925d54b4e85564abb2a233b976306ee4e74
SHA256

5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd
SHA512

5b1823ae6153f30e9c24b2240aea2610f5f05182ae66b933122721d312d8fae8ef8ca3cdfe03b4f316e12c7e45acfe0f1fcdd35f5b81748477f27477ce00b9b9
SSDEEP

6144:r+k9IKKJPa1DyKHC055swEUkezQ12rqyFWaiwV:ik9IKKJip9C0kmzQ12rqyQaX

Score

10^/10

blackmoon gh0strat banker evasion persistence privilege_escalation rat trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 8 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000136fc-2.dat	family_blackmoon
behavioral1/memory/1756-13-0x0000000000400000-0x00000000004CF000-memory.dmp	family_blackmoon
behavioral1/memory/2696-32-0x0000000000400000-0x0000000000D37000-memory.dmp	family_blackmoon
behavioral1/memory/2696-59-0x0000000000400000-0x0000000000D37000-memory.dmp	family_blackmoon
behavioral1/memory/2696-1838-0x0000000000400000-0x0000000000D37000-memory.dmp	family_blackmoon
behavioral1/files/0x000500000001876e-8335.dat	family_blackmoon
behavioral1/memory/7348-13706-0x0000000000400000-0x0000000001BF4000-memory.dmp	family_blackmoon
behavioral1/memory/2696-13707-0x0000000000400000-0x0000000000D37000-memory.dmp	family_blackmoon

Gh0st RAT payload 12 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000136fc-2.dat	family_gh0strat
behavioral1/files/0x0036000000015d06-10.dat	family_gh0strat
behavioral1/memory/2640-11-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/2640-12-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/memory/1756-13-0x0000000000400000-0x00000000004CF000-memory.dmp	family_gh0strat
behavioral1/memory/2640-6808-0x0000000000400000-0x0000000000409000-memory.dmp	family_gh0strat
behavioral1/files/0x000500000001876e-8335.dat	family_gh0strat
behavioral1/memory/6996-9983-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/6996-9981-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/6996-9979-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/6996-10609-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral1/memory/7348-13706-0x0000000000400000-0x0000000001BF4000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Detects executables containing possible sandbox analysis VM usernames 4 IoCs

resource	yara_rule
behavioral1/memory/2696-32-0x0000000000400000-0x0000000000D37000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2696-59-0x0000000000400000-0x0000000000D37000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2696-1838-0x0000000000400000-0x0000000000D37000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2696-13707-0x0000000000400000-0x0000000000D37000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 2 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000136fc-2.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/1756-13-0x0000000000400000-0x00000000004CF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000400000-0x00000000004CF000-memory.dmp	UPX
behavioral1/memory/1756-13-0x0000000000400000-0x00000000004CF000-memory.dmp	UPX
behavioral1/files/0x0007000000016411-22.dat	UPX
behavioral1/memory/2696-32-0x0000000000400000-0x0000000000D37000-memory.dmp	UPX
behavioral1/memory/2696-59-0x0000000000400000-0x0000000000D37000-memory.dmp	UPX
behavioral1/memory/2696-1838-0x0000000000400000-0x0000000000D37000-memory.dmp	UPX
behavioral1/files/0x0005000000018765-5389.dat	UPX
behavioral1/memory/7348-7146-0x0000000000400000-0x0000000001BF4000-memory.dmp	UPX
behavioral1/memory/7348-13706-0x0000000000400000-0x0000000001BF4000-memory.dmp	UPX
behavioral1/memory/2696-13707-0x0000000000400000-0x0000000000D37000-memory.dmp	UPX

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe	MSSQLH.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\RunDllExe\Driver = "C:\\Windows\\Logs\\RunDllExe.dll"	MSSQLH.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 12 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
19984	netsh.exe
20232	netsh.exe
5012	netsh.exe
20440	netsh.exe
4888	netsh.exe
8096	netsh.exe
19676	netsh.exe
19808	netsh.exe
19880	netsh.exe
20096	netsh.exe
20328	netsh.exe
5124	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\GraphicsPerfSvcs\Parameters\ServiceDll = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Roaming\\GraphicsPerfSvcs.dll"	Hooks.exe

Executes dropped EXE 4 IoCs

pid	Process
2380	MSSQLH.exe
708	Process not Found
2696	MpMgSvc.exe
7348	Hooks.exe

Loads dropped DLL 7 IoCs

pid	Process
1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
2640	svchost.exe
2640	svchost.exe
2640	svchost.exe
2640	svchost.exe
5064	svchost.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/1756-13-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/files/0x0007000000016411-22.dat	upx
behavioral1/memory/2696-32-0x0000000000400000-0x0000000000D37000-memory.dmp	upx
behavioral1/memory/2696-59-0x0000000000400000-0x0000000000D37000-memory.dmp	upx
behavioral1/memory/2696-1838-0x0000000000400000-0x0000000000D37000-memory.dmp	upx
behavioral1/files/0x0005000000018765-5389.dat	upx
behavioral1/memory/7348-7146-0x0000000000400000-0x0000000001BF4000-memory.dmp	upx
behavioral1/memory/7348-13706-0x0000000000400000-0x0000000001BF4000-memory.dmp	upx
behavioral1/memory/2696-13707-0x0000000000400000-0x0000000000D37000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.226.84.135

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MpMgDLL[1].jpg	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MpMgSvc[1].jpg	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Hooks[1].jpg	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GraphicsPerfSvcs.dll	Hooks.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5064 set thread context of 6996	5064	svchost.exe	35

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Logs\RunDllExe.dll	MSSQLH.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 42 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-20-6e-1f-74-54\WpadDecisionTime = c003bf468acada01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C57856-3E1E-4F8F-BCB5-470C026DA9F3}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C57856-3E1E-4F8F-BCB5-470C026DA9F3}\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C57856-3E1E-4F8F-BCB5-470C026DA9F3}\WpadNetworkName = "Network 3"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C57856-3E1E-4F8F-BCB5-470C026DA9F3}\26-20-6e-1f-74-54	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C57856-3E1E-4F8F-BCB5-470C026DA9F3}\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-20-6e-1f-74-54\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C57856-3E1E-4F8F-BCB5-470C026DA9F3}\WpadDecisionTime = c003bf468acada01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-20-6e-1f-74-54\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-20-6e-1f-74-54	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2380	MSSQLH.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6996	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
2380	MSSQLH.exe
2696	MpMgSvc.exe
2696	MpMgSvc.exe
7348	Hooks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2380	1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	28
PID 1756 wrote to memory of 2380	1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	28
PID 1756 wrote to memory of 2380	1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	28
PID 1756 wrote to memory of 2380	1756	5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe	28
PID 2640 wrote to memory of 2696	2640	svchost.exe	30
PID 2640 wrote to memory of 2696	2640	svchost.exe	30
PID 2640 wrote to memory of 2696	2640	svchost.exe	30
PID 2640 wrote to memory of 2696	2640	svchost.exe	30
PID 2640 wrote to memory of 7348	2640	svchost.exe	31
PID 2640 wrote to memory of 7348	2640	svchost.exe	31
PID 2640 wrote to memory of 7348	2640	svchost.exe	31
PID 2640 wrote to memory of 7348	2640	svchost.exe	31
PID 7348 wrote to memory of 2220	7348	Hooks.exe	33
PID 7348 wrote to memory of 2220	7348	Hooks.exe	33
PID 7348 wrote to memory of 2220	7348	Hooks.exe	33
PID 7348 wrote to memory of 2220	7348	Hooks.exe	33
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 6996	5064	svchost.exe	35
PID 5064 wrote to memory of 8096	5064	svchost.exe	36
PID 5064 wrote to memory of 8096	5064	svchost.exe	36
PID 5064 wrote to memory of 8096	5064	svchost.exe	36
PID 5064 wrote to memory of 8096	5064	svchost.exe	36
PID 5064 wrote to memory of 19676	5064	svchost.exe	39
PID 5064 wrote to memory of 19676	5064	svchost.exe	39
PID 5064 wrote to memory of 19676	5064	svchost.exe	39
PID 5064 wrote to memory of 19676	5064	svchost.exe	39
PID 7348 wrote to memory of 19660	7348	Hooks.exe	38
PID 7348 wrote to memory of 19660	7348	Hooks.exe	38
PID 7348 wrote to memory of 19660	7348	Hooks.exe	38
PID 7348 wrote to memory of 19660	7348	Hooks.exe	38
PID 5064 wrote to memory of 19808	5064	svchost.exe	42
PID 5064 wrote to memory of 19808	5064	svchost.exe	42
PID 5064 wrote to memory of 19808	5064	svchost.exe	42
PID 5064 wrote to memory of 19808	5064	svchost.exe	42
PID 5064 wrote to memory of 19880	5064	svchost.exe	44
PID 5064 wrote to memory of 19880	5064	svchost.exe	44
PID 5064 wrote to memory of 19880	5064	svchost.exe	44
PID 5064 wrote to memory of 19880	5064	svchost.exe	44
PID 7348 wrote to memory of 19888	7348	Hooks.exe	45
PID 7348 wrote to memory of 19888	7348	Hooks.exe	45
PID 7348 wrote to memory of 19888	7348	Hooks.exe	45
PID 7348 wrote to memory of 19888	7348	Hooks.exe	45
PID 5064 wrote to memory of 19984	5064	svchost.exe	48
PID 5064 wrote to memory of 19984	5064	svchost.exe	48
PID 5064 wrote to memory of 19984	5064	svchost.exe	48
PID 5064 wrote to memory of 19984	5064	svchost.exe	48
PID 7348 wrote to memory of 20084	7348	Hooks.exe	50
PID 7348 wrote to memory of 20084	7348	Hooks.exe	50
PID 7348 wrote to memory of 20084	7348	Hooks.exe	50
PID 7348 wrote to memory of 20084	7348	Hooks.exe	50
PID 5064 wrote to memory of 20096	5064	svchost.exe	51
PID 5064 wrote to memory of 20096	5064	svchost.exe	51
PID 5064 wrote to memory of 20096	5064	svchost.exe	51
PID 5064 wrote to memory of 20096	5064	svchost.exe	51
PID 7348 wrote to memory of 20204	7348	Hooks.exe	54
PID 7348 wrote to memory of 20204	7348	Hooks.exe	54
PID 7348 wrote to memory of 20204	7348	Hooks.exe	54

C:\Users\Admin\AppData\Local\Temp\5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe
"C:\Users\Admin\AppData\Local\Temp\5d87bd723f8267c3c0bef75f2b502321c518ac6a09696f3971ace53d0ba505cd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\MSSQLH.exe
  C:\Users\Admin\AppData\Local\Temp\MSSQLH.exe
  2⤵
  - Boot or Logon Autostart Execution: Port Monitors
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2380

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2640
- C:\WINDOWS\Temp\MpMgSvc.exe
  "C:\WINDOWS\Temp\MpMgSvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2696
- - C:\WINDOWS\Temp\Eternalblue-2.2.0.exe
    Eternalblue-2.2.0.exe --TargetIp 10.127.0.243 --Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt
    3⤵
    PID:1760
- - C:\WINDOWS\Temp\Eternalblue-2.2.0.exe
    Eternalblue-2.2.0.exe --TargetIp 10.127.0.243 --Target WIN72K8R2 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig LOG.txt
    3⤵
    PID:6016
- C:\WINDOWS\Temp\Hooks.exe
  "C:\WINDOWS\Temp\Hooks.exe"
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:7348
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=Block
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies data under HKEY_USERS
    PID:2220
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Filter1
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies data under HKEY_USERS
    PID:19660
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies data under HKEY_USERS
    PID:19888
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies data under HKEY_USERS
    PID:20084
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Modifies data under HKEY_USERS
    PID:20204
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:20360
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=FilteraAtion1 action=block
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static set policy name=Block assign=y
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"
    3⤵
    PID:6660

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:6996
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:8096
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:19676
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:19808
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:19880
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:19984
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:20096
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:20232
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:20328
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:20440
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
  2⤵
  - Modifies Windows Firewall
  PID:4888
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
  2⤵
  - Modifies Windows Firewall
  PID:5012
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:5124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\Temp\libxml2.dll

Filesize
807KB

MD5
9a5cec05e9c158cbc51cdc972693363d

SHA1
ca4d1bb44c64a85871944f3913ca6ccddfa2dc04

SHA256
aceb27720115a63b9d47e737fd878a61c52435ea4ec86ba8e58ee744bc85c4f3

SHA512
8af997c3095d728fe95eeedfec23b5d4a9f2ea0a8945f8c136cda3128c17acb0a6e45345637cf1d7a5836aaa83641016c50dbb59461a5a3fb7b302c2c60dfc94

Download Submit
C:\Windows\Temp\Eternalblue-2.2.0.xml

Filesize
7KB

MD5
497080fed2000e8b49ee2e97e54036b1

SHA1
4af3fae881a80355dd09df6e736203c30c4faac5

SHA256
756f44f1d667132b043bfd3da16b91c9f6681e5d778c5f07bb031d62ff00d380

SHA512
4f8bd09f9d8d332c436beb8164eec90b0e260b69230f102565298beff0db37265be1ae5eb70acf60e77d5589c61c7ee7f01a02d2a30ac72d794a04efef6f25df

Download Submit
C:\Windows\Temp\Hooks.exe

Filesize
11.7MB

MD5
422f3763021f8f9bfc31a9a7e4b049f9

SHA1
d9b34b3cf62c66dd776ba5bed3abb0c409c6c3f0

SHA256
a1871f4f0149065abab263411d6afdd8ae962060db732e740e956898b62cee0b

SHA512
46ad02ef99385a98fd18479bf409caacf5b2f4a1d3beecfe7b85a5af893cec96a57fd8715c24bfed222e1e1dd480bd1ced0c398d5893e3d6d2caef65797bb6e0

Download Submit
C:\Windows\Temp\MpMgSvc.exe

Filesize
3.2MB

MD5
40670d0d30c6855dd2b3db30b81f9ce2

SHA1
1f553452c564af39945941dc850bf3e16ca72290

SHA256
d34098c57d0588f6bdf79abd8af98e22904ba595e27a58966400f500688f34f3

SHA512
8c2df4e2190437645e8c1f29cacd9a6b538dd6bd9a0697ad4a61455a712b8f051a773ebf47342014760c74881627c129b8b3597705cee1de5f634d0542816a2a

Download Submit
C:\Windows\Temp\ip.txt

Filesize
6KB

MD5
aec243ec4ce4542294598b176520e9c2

SHA1
5f880188f3481221500f06c2312c458cab5090f5

SHA256
36667baed91df606b30ab8c01c9b3f82dc3bb1aed9a989c6dcada35478f85ec6

SHA512
dba1c32db6328e21de0caba75474b9575d89fb9bc9ef56b8d45ccfcef00e540ce4d9329663233fecf6381ac21d7608a05ec8ac3c5e4c6bd1056442fa0ee2724f

Download Submit
\??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\graphicsperfsvcs.dll

Filesize
23.7MB

MD5
eb72d63d5e250781fb1b84f185581e1e

SHA1
262f689ab8a405404a0ed0fc876cfe8e4a0d6efb

SHA256
440bbe8365019a7cec572f1f91159a6209636d4bf3fe3b85506bad0ff5097bc4

SHA512
e02050a2e93d9c0f67c48c879d368b3a4d7a0a8bfcdc9a8c153dc1be87d809a5a20e95108721ce8194b80bc6dfd474a23474e503afc6ddd5c7c1dff23e62bcb1

Download Submit
\Users\Admin\AppData\Local\Temp\MSSQLH.exe

Filesize
436KB

MD5
214f53c5c0181d9e0531c48d46ed0881

SHA1
4d5629a5fbb29439b66caf98c5cec56730118ecd

SHA256
224bf0bd119ef5c8aed25875cb66f62f9e2054dea8de5a3083cc43468a5da0da

SHA512
a941ec678f6eb05c3c7692dc5b297ccea552e30b0cdab123111e39527fd51a2b9b16b9956ecfccf05193518bee5478d7562c5a4b4e0338016032e5384cb19c5a

Download Submit
\Windows\Logs\RunDllExe.dll

Filesize
153KB

MD5
12682cac60b5927fb4a0d1f9ad28b5d3

SHA1
bedaaee5b7af9f0c956fae5e19d354e30e9a75fe

SHA256
89622226b6a14d9a5021ec33536f0c4ec39f733b204ab0eecbde2bc786bb4a41

SHA512
5e907262376691907097e187b65d72036f7c0d52dcab7ffb0f5a34aea52e38304e2032d897d70a1e68a4e8649b2353b22611ded58de86333e45afebdf04f30c5

Download Submit
\Windows\Temp\Eternalblue-2.2.0.exe

Filesize
126KB

MD5
8c80dd97c37525927c1e549cb59bcbf3

SHA1
4e80fa7d98c8e87facecdef0fc7de0d957d809e1

SHA256
85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

SHA512
50e9a3b950bbd56ff9654f9c2758721b181e7891384fb37e4836cf78422399a07e6b0bfab16350e35eb2a13c4d07b5ce8d4192fd864fb9aaa9602c7978d2d35e

Download Submit
\Windows\Temp\coli-0.dll

Filesize
15KB

MD5
3c2fe2dbdf09cfa869344fdb53307cb2

SHA1
b67a8475e6076a24066b7cb6b36d307244bb741f

SHA256
0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887

SHA512
d6b819643108446b1739cbcb8d5c87e05875d7c1989d03975575c7d808f715ddcce94480860828210970cec8b775c14ee955f99bd6e16f9a32b1d5dafd82dc8c

Download Submit
\Windows\Temp\exma-1.dll

Filesize
10KB

MD5
ba629216db6cf7c0c720054b0c9a13f3

SHA1
37bb800b2bb812d4430e2510f14b5b717099abaa

SHA256
15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9

SHA512
c4f116701798f210d347726680419fd85880a8dc12bf78075be6b655f056a17e0a940b28bbc9a5a78fac99e3bb99003240948ed878d75b848854d1f9e5768ec9

Download Submit
\Windows\Temp\posh-0.dll

Filesize
11KB

MD5
2f0a52ce4f445c6e656ecebbcaceade5

SHA1
35493e06b0b2cdab2211c0fc02286f45d5e2606d

SHA256
cde45f7ff05f52b7215e4b0ea1f2f42ad9b42031e16a3be9772aa09e014bacdb

SHA512
88151ce5c89c96c4bb086d188f044fa2d66d64d0811e622f35dceaadfa2c7c7c084dd8afb5f774e8ad93ca2475cc3cba60ba36818b5cfb4a472fc9ceef1b9da1

Download Submit
\Windows\Temp\tibe-2.dll

Filesize
232KB

MD5
f0881d5a7f75389deba3eff3f4df09ac

SHA1
8404f2776fa8f7f8eaffb7a1859c19b0817b147a

SHA256
ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362

SHA512
f266baecae0840c365fe537289a8bf05323d048ef3451ebffbe75129719c1856022b4bddd225b85b6661bbe4b2c7ac336aa9efdeb26a91a0be08c66a9e3fe97e

Download Submit
\Windows\Temp\trch-1.dll

Filesize
58KB

MD5
838ceb02081ac27de43da56bec20fc76

SHA1
972ab587cdb63c8263eb977f10977fd7d27ecf7b

SHA256
0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f

SHA512
bcca9e1e2f84929bf513f26cc2a7dc91f066e775ef1d34b0fb00a54c8521de55ef8c81f796c7970d5237cdeab4572dedfd2b138d21183cb19d2225bdb0362a22

Download Submit
\Windows\Temp\trfo-2.dll

Filesize
29KB

MD5
3e89c56056e5525bf4d9e52b28fbbca7

SHA1
08f93ab25190a44c4e29bee5e8aacecc90dab80c

SHA256
b2a3172a1d676f00a62df376d8da805714553bb3221a8426f9823a8a5887daaa

SHA512
32487c6bca48a989d48fa7b362381fadd0209fdcc8e837f2008f16c4b52ab4830942b2e0aa1fb18dbec7fce189bb9a6d40f362a6c2b4f44649bd98557ecddbb6

Download Submit
\Windows\Temp\tucl-1.dll

Filesize
9KB

MD5
83076104ae977d850d1e015704e5730a

SHA1
776e7079734bc4817e3af0049f42524404a55310

SHA256
cf25bdc6711a72713d80a4a860df724a79042be210930dcbfc522da72b39bb12

SHA512
bd1e6c99308c128a07fbb0c05e3a09dbcf4cec91326148439210077d09992ebf25403f6656a49d79ad2151c2e61e6532108fed12727c41103df3d7a2b1ba82f8

Download Submit
\Windows\Temp\ucl.dll

Filesize
57KB

MD5
6b7276e4aa7a1e50735d2f6923b40de4

SHA1
db8603ac6cac7eb3690f67af7b8d081aa9ce3075

SHA256
f0df80978b3a563077def7ba919e2f49e5883d24176e6b3371a8eef1efe2b06a

SHA512
58e65ce3a5bcb65f056856cfda06462d3fbce4d625a76526107977fd7a44d93cfc16de5f9952b8fcff7049a7556b0d35de0aa02de736f0daeec1e41d02a20daa

Download Submit
memory/1756-13-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1756-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1760-13735-0x00000000000E0000-0x00000000000F1000-memory.dmp

Filesize
68KB

Download
memory/2640-30-0x0000000003270000-0x0000000003BA7000-memory.dmp

Filesize
9.2MB

Download
memory/2640-6812-0x0000000003370000-0x0000000004B64000-memory.dmp

Filesize
24.0MB

Download
memory/2640-6808-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-6811-0x0000000003370000-0x0000000004B64000-memory.dmp

Filesize
24.0MB

Download
memory/2640-6809-0x0000000003270000-0x0000000003BA7000-memory.dmp

Filesize
9.2MB

Download
memory/2640-31-0x0000000003270000-0x0000000003BA7000-memory.dmp

Filesize
9.2MB

Download
memory/2640-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2640-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2696-59-0x0000000000400000-0x0000000000D37000-memory.dmp

Filesize
9.2MB

Download
memory/2696-13707-0x0000000000400000-0x0000000000D37000-memory.dmp

Filesize
9.2MB

Download
memory/2696-32-0x0000000000400000-0x0000000000D37000-memory.dmp

Filesize
9.2MB

Download
memory/2696-1838-0x0000000000400000-0x0000000000D37000-memory.dmp

Filesize
9.2MB

Download
memory/6016-13752-0x00000000000B0000-0x00000000000C1000-memory.dmp

Filesize
68KB

Download
memory/6996-9981-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6996-9979-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6996-10609-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6996-9983-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6996-9984-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/6996-9978-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/6996-9977-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/7348-7146-0x0000000000400000-0x0000000001BF4000-memory.dmp

Filesize
24.0MB

Download
memory/7348-13706-0x0000000000400000-0x0000000001BF4000-memory.dmp

Filesize
24.0MB

Download