modiloader | 68a27b558777a677920f88a3c34226e7efb0b87c90c9ff9143c992c98848f38f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
submitted
02/07/2024, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Build.exe
Size 821KB
Sample240702-ff9j8azgrn
SHA256 68a27b558777a677920f88a3c34226e7efb0b87c90c9ff9143c992c98848f38f
MD5 2f6f4f9674c6721b5ea8319ed90a8f20
SHA1 154e852c206379e4a6a02d4981f2c4d8be1319c5
SHA512 3240e8f0321f2afcca7485a4a3658c88518145c803a445361302f64e2f5e24078f1f2633d8e4d2850b0e987f782510dcd14e201d981e542e83f7475025adea9d
SSDEEP 12288:UpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9j9DXMS9:QJ39LyjbJkQFMhmC+6GD9j1n9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader neshta xred backdoor discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

ModiLoader Second Stage 8 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023572-4.dat	modiloader_stage2
behavioral2/files/0x0007000000023577-18.dat	modiloader_stage2
behavioral2/memory/3820-139-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4836-173-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/528-186-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4736-319-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/3604-321-0x0000000000400000-0x0000000000411000-memory.dmp	modiloader_stage2
behavioral2/memory/4736-361-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	._cache_Build.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 6 IoCs

pid	Process
3820	Build.exe
4836	._cache_Build.exe
4736	Synaptics.exe
4444	svchost.com
3604	AdobeART.exe
528	._cache_Synaptics.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Build.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe"	AdobeART.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe"	._cache_Synaptics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Build.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	Build.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\NOTIFI~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	Build.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	Build.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\BHO\IE_TO_~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\ELEVAT~1.EXE	Build.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	Build.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	Build.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	Build.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	Build.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	Build.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\MSEDGE~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\msedge.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MIA062~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	Build.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	Build.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\COOKIE~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\125025~1.92\INSTAL~1\setup.exe	Build.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE	Build.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	Build.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	Build.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	Build.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	Build.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	Build.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	Build.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	._cache_Build.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Build.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Build.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	._cache_Build.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5048	EXCEL.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5048	EXCEL.EXE
5048	EXCEL.EXE
5048	EXCEL.EXE
5048	EXCEL.EXE
5048	EXCEL.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3820	2796	Build.exe	82
PID 2796 wrote to memory of 3820	2796	Build.exe	82
PID 2796 wrote to memory of 3820	2796	Build.exe	82
PID 3820 wrote to memory of 4836	3820	Build.exe	83
PID 3820 wrote to memory of 4836	3820	Build.exe	83
PID 3820 wrote to memory of 4836	3820	Build.exe	83
PID 3820 wrote to memory of 4736	3820	Build.exe	84
PID 3820 wrote to memory of 4736	3820	Build.exe	84
PID 3820 wrote to memory of 4736	3820	Build.exe	84
PID 4836 wrote to memory of 4444	4836	._cache_Build.exe	85
PID 4836 wrote to memory of 4444	4836	._cache_Build.exe	85
PID 4836 wrote to memory of 4444	4836	._cache_Build.exe	85
PID 4444 wrote to memory of 3604	4444	svchost.com	86
PID 4444 wrote to memory of 3604	4444	svchost.com	86
PID 4444 wrote to memory of 3604	4444	svchost.com	86
PID 4736 wrote to memory of 528	4736	Synaptics.exe	87
PID 4736 wrote to memory of 528	4736	Synaptics.exe	87
PID 4736 wrote to memory of 528	4736	Synaptics.exe	87

C:\Users\Admin\AppData\Local\Temp\Build.exe
"C:\Users\Admin\AppData\Local\Temp\Build.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\3582-490\Build.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\Build.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\._cache_Build.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Build.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\Users\Admin\AppData\Roaming\AdobeART.exe
        
        C:\Users\Admin\AppData\Roaming\AdobeART.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3604
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:528

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
MD5 124147ede15f97b47224628152110ce2
SHA1 4530fee9b1199777693073414b82420a7c88a042
SHA512 f4c2825380d1bb9ca889d5c5684f13aa0cacb0d6511f6409ca0972a7191195a0175e00c995407848bf09ea03cff05c7395952bf2ffd2af2015b8939f75a8e627
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_Build.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Build.exe
Size 36KB
SHA256 81d622108a3bd126a2ac9f101dcb37bc160141585e3f9e1e1ab7905ee6bc5e07
MD5 0fd492912e95d20941f96a49d493da9c
SHA1 3336bf0f29bde762b36b876488ddf3c562174462
SHA512 831cd4319d607c5b030503ccde7f3fabc38d74c73b38228557495c3c611ae482e73a43f6c94267beb84b41b3b0e5c4f0a0f5202c6e59744657bff48de33d4745
SSDEEP 768:bycqOQ0bwMK2M3fQde8Pfymg0M9EQfRo0ys/KzI:OcqOQbB3fQc8Pfymg0yxpByxzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Build.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\Build.exe
Size 781KB
SHA256 78175d8bac0c2a60dcd011b294e4b3127677e134a3a60c154f509b6021ab1244
MD5 a8a7c72473da536ed5af5168b890ef51
SHA1 9f7793ca3ef966284c9621bcfb1b6b98cdf4f8dd
SHA512 0501058922d22b251a4ae9d59bb321bbf446632f1e633d4ebb478ce42b3d9e9513644884d73342356cbc61089084780616e770d964e95143729e1b11f5865cbc
SSDEEP 12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9j9s:WnsJ39LyjbJkQFMhmC+6GD9ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

FH3SbSWu.xlsm

Path C:\Users\Admin\AppData\Local\Temp\FH3SbSWu.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5023.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
Size 8B
SHA256 483d7bd11c86597aed4813a7bf06f115ed74ab692f37fd49a4a472f6e5a77462
MD5 13836ff65b3d9714d397f5443131f40e
SHA1 63cff42c169e9c4d2d9c7026552a4071bc0f5513
SHA512 b79183b3b2d3dfe41f7282c9e92bade05c9f435ca6604ed81d80e0314e703eab0cd7ea7808f9ba4608524c527fc76e79e28665b3ea64185de7bf341bfdb5d68c
MD5 SHA1 SHA512

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 16e3fb784a474ccd787e669c3117baec169cd5d3e5e53acf6540889539b8abee
MD5 f7a0b431d559f3b49ca6e69ec1df344f
SHA1 716acdcc834ad512e175f2b87ec87409bd66cd92
SHA512 7704ddfa53cfa078771c35acee7549d545a49b5d16d3952312e3baf5bbb69c9c4614560e5cac621fd70cb982a6b3c12829653a73b3f7d31a7ad9e30e25f76eec
SSDEEP 768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJfafikupIj7FLQAdHMRmXJ:yxqjQ+P04wsZLnDrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/528-186-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2796-327-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2796-322-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2796-315-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3604-321-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3820-139-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/3820-13-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/4444-320-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4444-332-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4736-319-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4736-361-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4836-173-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/5048-207-0x00007FFA89490000-0x00007FFA894A0000-memory.dmp

Download

memory/5048-194-0x00007FFA89490000-0x00007FFA894A0000-memory.dmp

Download

memory/5048-191-0x00007FFA8BC30000-0x00007FFA8BC40000-memory.dmp

Download

memory/5048-187-0x00007FFA8BC30000-0x00007FFA8BC40000-memory.dmp

Download

memory/5048-188-0x00007FFA8BC30000-0x00007FFA8BC40000-memory.dmp

Download

memory/5048-190-0x00007FFA8BC30000-0x00007FFA8BC40000-memory.dmp

Download

memory/5048-189-0x00007FFA8BC30000-0x00007FFA8BC40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads