ardamax | 375402f893ec73af7675ccaf20e54afc0cc6fcf937fff42ba5d505ad52b29cb2

General

Target

4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
Size

1.0MB
MD5

4a6759af1734b97f4004c709f85c13af
SHA1

b25e78c591331359fdcfbb8a06058f6d3cceb7d0
SHA256

375402f893ec73af7675ccaf20e54afc0cc6fcf937fff42ba5d505ad52b29cb2
SHA512

da39d9245d209923f34a0c739ed1f9441549ac4977e301e04e5afbda2acce5081f4083799f9187ee3efe7cb96aba950213ace7b7aeab17b17c1af3a415c7d1ea
SSDEEP

24576:/DX4OBs6ZBLWprDlQ5t4tElW714/dnKDlGRwj0wJFa:boOBzB6tm5t4aIxJGmjC

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000018660-12.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
2848	OSF.exe

Loads dropped DLL 2 IoCs

pid	Process
2280	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
2848	OSF.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OSF Start = "C:\\Windows\\SysWOW64\\UIBKOH\\OSF.exe"	OSF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UIBKOH\OSF.004	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\UIBKOH\OSF.001	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\UIBKOH\OSF.002	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\UIBKOH\OSF.exe	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\UIBKOH\	OSF.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{8CBCC8DB-FC269D9E-8CD313EC-B9FA7DDE}	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{8CBCC8DB-FC269D9E-8CD313EC-B9FA7DDE}\ = 1ce3dfb8f74cd8aa68410019826a5bfe6f73633f30f37c00f0080ba4879aa46f7ac388ef3bdc0f6e23bc874f24633a97c8d423964765bbc948fd5ace6862fcf88fb41c85905a99286d5cfdd0cd981e932c505ee0d22b27e0bbd0c8e1de4d139d5752946eaa9c9fd313d7575424a6da9b91171a2b96bf65cc3ae34e77af920d0580f47f858c19dcedd1e261e8014595e929bedd4daefdfc0e8f225c56eeeafd801aa91c5a6eeefc034d1fbe5372d7705b76573a1b4e6fdcc36fbf9c8c6e7f9cf3ef00e32e188256a0545baad799ebadd8fe2c4c80dccb2fe78394b0ebba1fc9d326983aae70838fbfa3ccb8830e6062e070db80d7a7649ba628558025a75abbe8c8795e719239174a6bde7f53f32f80e34930fd4db26147f1cb0998e11792eba6e0bbfab7b784c4f587756b351ff653741046d27aa7f624048a34818abd9fce6c03fef7f3048f841c98d19125d56916651a292e7d42f187498b1df8ee353cf530364d84fd988eab6327a77ba43014f824b39ac8a966018469075d4b2d3f61f3e177493b258fea2378c74eeb3cd87256b81a3496b8144fd663abaf1ffc93f297716485d496e9e5c1856656f4e4f938c9f0828bb7d87b6acfc69caa6e9ffc6cf2c0c7dbb497b81437268bf4a089b4def9520ed83caa70b9c8b5218add98d1d3aea89d1851eadd2192092e9ddcee91fcd54da6a15bb2d70894621756db2aa8600396e7658479d589592595a55a7a97b02bb56739047126d1f4fce89fe41bf73a424a4c85e172621ae76a9d50dbe7e6aba57a45e889b413e79dd4001644a2f01e069a1bd16c81e27e89325e40d2dc91505266d674eb88ffe18cf9bf8e733cbf1accc3014f21630547559b9517966b945fd513269f046c0642ba96c9e5a289665af4d6b91a49e8e5a7968b5a58d012955925e9d9bae9718289b7de4bedbf5dcc911f9d13d22f914325ef0963e6bfaa4cbf404c4800da7c97b05406d674d548d500a6be8b4d279dbb92b7167464b57af50ecaa240882e25bc4a327ec0cca77ecb0cb8c37517f52bfa4037080b9a67a8cb43203fa64cb4e085b1d5b15a4a9120114169855d56ed54419671d54da6dd0a51e69d255239afb103f64f343c88cefb63f72044f2f481c5d2d99752ab905861d43d970d64e1297abd4e4e221d98ad697e7d4cb1603a19b01107ed8b0240be92f3a0ff0d0c5e7e6cb33e77738bff384c0c5e3c2cb0be0bb30707eb6b0087827489089958d2ac567fda73ee7f1db36d307d4fb143c6f7ea3b59f71684ea9681a5fa99b7928bd160a5e25af9960edb42ef405cf6d045abba87368404e7287bbecff283b75884e8483af8f6b1b545f6097a59cee9c27ed9b31537593b69cfd97c160f24e374a80adddf6d53e19f226cce3c030e6f22bc788ec8c39847519bd928e958fa6c708188815fea131f5f13d317575b2bafe0bc72ccb65d8ad1c72e94e21a0f1683e5b8b98ecec34310ef24fc1a8caec30350d7e2e49fb593f9507228b14509891d5aed6e629c56d164da3b900fe5c34a30e686d5b5a9b53ac6c97ac58eca431867542b5a5feed31d60d27aae8ee3c370d7fc248d7881b19e8dacbedd325280d072d346df0b2c7f61336907d9cb2d58fd50b264ff2b735fc7d3ab5760abea18de6ced1e01eca562ca6826bbdaf7afc4a346481ac4a8e838ffca73bfff33b3b7704bf67ffa73b107fa0b4edfc22cbebc8d8e7ebdf20d3161357d89cde2bee80c9be02fca03c1bf9e8cec61bfd98c2a621ef8acf280ff198c529c506f20e3b8b8b53109b939768944e616cb64bfca0c4122799eb5acfa63310f317c0db09d01ee56dc546d26dd9aee511d592dad7d1e8e535c576e1b42971e946c5923d137e2cb865feb5360a0fa94cfe58326083add762dbb3d77b18bfe003314c0eae478c54e657c99f291b91a3528c9dee593f6afbb7cf732b40e87e20b417f457315f7564bd47f59731107d90b6edf422c3ebe8c8c618175e57916b5143518499099d26edf3c5332df3e2c72fcc0cd9c82addea1adda9e6f6c03bc0f33fc0f8e2383bfb7ccc4a36757cb2b80bf4773eb07c0bb844fcb2360b7c64b8b1f4093e467c93b858fc6236517c52b96bf5533d907eafb9e48ed661e74acc6c15bdea8527cd64e9a5c912c5a1ceeee1d1d1151555d29d1a5ae8a6259c811bd5d31edb57db9318ac6c6042b18e7aedbc3d038a3f79fbb2c88627b4e37bd0bf1d8ce9623955fa993e6a895985a13a867ff5bccef7e5cb252889e039350ef907c2d8d627d40712e366344d7f4944a9a60919dad91deaead1c1d92d198126d61c15996d51525993996896adee613fa9f312c49bc820d5e9d926eefa23cae0ce31c605034e4fa4471b6b9058a59f955b19a0a961ee5d22a591e69523dd04e6d9c5d2d5142e9b89a77110b955866ee5aa36e6823e617dbabaffffc8c4d5d012e3982ce59bc2af16002d6ef2be3fff0cc0c8182ed2662d4c829db46102a66d84453b7af8b9c80122a1666941be9d73e648c54c36ae83f6433b8b74bfb7fc8737aff0e4cc21eb1d2f9114e6e836257c65b2a6fe003eb37dffb2c087f6033b5cfb95c8a6e3e628c8060035aaf173c6bcf0723cb2747ab7bc0b03b82c8f9bc4df3fd780e36bc04b1db8dafe29c1f92d3e1e8be9f73d3f760c4f0daf15702db70e840e6a575d9b92a7226304a04c02a6e06bc644fd89c94129928ade4a235ffb573b9374ec4a356c754242ad8b8d0b2990f960324e768641b54ef6a9ca01133ed87de74d27a517622cae65845140a26e63aab710005f6f5bb4ac8587a528ed8232d77e20bee1fdd93111065d839abf6000a845869687dc6310b41d8fd960ea5e2660f24631a8f10bc62f0e0735cb06c765e8aacf9c13289307a4888fee70ddbc1a8f5e5ba79cfc943a1876a34fe740c381ef6928bdf072c9bbc9731a4c2f4c0751d86917ad27619059519ea911fe5ec9afe69cd1a7d6ef13cb9328ace9e43d35fa893209814d49627e5dbe628445cd4ae9a43a97f8133ce0f9da32d281d20911e966c6580e975fa45b0253f19cc953e160c147d28cd9a7e294c195e29ec995d2a513861c8e1786e0c7ce00e815df9918a6a81186169f9a58a4a6618c416b5d4755b0597b59405db256fc523061f9ad3909063e5ef15dca5eeca63c6205bf0ef41fc71cc7563c9bf9e4c535c105064e2ca0839e6b1b582c6ae0a3db84dc95dc192baa6cfe563062f240338c772b486fb654f490359e816001436d67525f9598e6d7dddf1520aa7c73bcb0ff8e30a40402d1e9dac125f2e931c9752e4aea9633d6f0d43feff8c4c9f606c4c3ee20c4f1e636c4f1ee3ac58bf50335c3f13cc6f8023af1f8393d0e8a5f86a738600f5fe868d34feca8de1a1014255c829d9e6160a5a1e50ace8bf4533694fa183e270ce381d362dfb3d4f7183b678ba48c97c5df2ed3f3e33cc47e3fbc777840bc91f6513c9580612baa6f194ba1b702fca83e68f057c59ceaac27ec7720b76473a4b4edfc22c77e14bfd9fceec2221a8093c418eae2262e0480d1d5e515225d8092afdd872d301efa57c1ab22e41c245606974e5bb15cfd51cead03ed672db48a8e29a47697bbe770cbb3e08f25b4f971c24ee55a365d0f997759b3928ce6402240e2843a017d5eb9640a4	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{8CBCC8DB-FC269D9E-8CD313EC-B9FA7DDE}\ = 89dc8f7bf74cd8aa68410019826a5bfe6f73633f30f37c00f0080ba4879aa46f7ac388ef3bdc0f6e23bc874f24633a97c8d423964765bbc948fd5ace6862fcf88fb41c85905a99286d5cfdd0cd981e932c505ee0d22b27e0bbd0c8e1de4d139d5752946eaa9c9fd313d7575424a6da9b91171a2b96bf65cc3ae34e77af920d0580f47f858c19dcedd1e261e8014595e929bedd4daefdfc0e8f225c56eeeafd801da91c5a6eeefc034d1fbe5372d7705b76573a1b4e6fdcc36fbf9c8c6e7f9cf3ef00e32e188256a0545baad799ebadd8fe2c4c80dccb2fe78394b0ebba1fc9d326983aae70838fbfa3ccb8830e6062e070db80d7a7649ba628558025a75abbe8c8795e719239174a6bde7f53f32f80e34930fd4db26147f1cb0998e11792eba6e0bbfab7b784c4f587756b351ff653741046d27aa7f624048a34818abd9fce6c03fef7f3048f841c98d19125d56916651a292e7d42f187498b1df8ee353cf530364d84fd988eab6327a77ba43014f824b39ac8a966018469075d4b2d3f61f3e177493b258fea2378c74eeb3cd87256b81a3496b8144fd663abaf1ffc93f297716485d496e9e5c1856656f4e4f938c9f0828bb7d87b6acfc69caa6e9ffc6cf2c0c7dbb497b81437268bf4a089b4def9520ed83caa70b9c8b5218add98d1d3aea89d1851eadd2192092e9ddcee91fcd54da6a15bb2d70894621756db2aa8600396e7658479d589592595a55a7a97b02bb56739047126a10bfce89fe41bf73a424a4c85e172621ae76a9d50dbe7e6aba57a45e889b413e79dd4001644a2f01e069a1bd16c81e27e89325e40d2dc91505266d674eb88ffe18cf9bf8e733cbf1accc3014f21630547559b9517966b945fd513269f046c0642ba96c9e5a289665af4d6b91a49e8e5a7968b5a58d012955925e9d9bae9718289b7de4bedbf5dcc911f9d13d22f914325ef0963e6bfaa4cbf404c4800da7c97b05406d674d548d500a6be8b4d279dbb92b7167464b57af50ecaa240882e25bc4a327ec0cca77ecb0cb8c37517f52bfa4037080b9a67a8cb43203fa64cb4e085b1d5b15a4a9120114169855d56ed54419671d54da6dd0a51e69d255239afb103f64f343c88cefb63f72044f2f481c5d2d99752ab905861d43d970d64e1297abd4e4e221d98ad697e7d4cb1603a19b01107ed8b0240be92f3a0ff0d0c5e7e6cb33e77738bff384c0c5e3c2cb0be0bb30707eb6b0087827489089958d2ac567fda73ee7f1db36d307d4fb143c6f7ea3b59f71684ea9681a5fa99b7928bd160a5e25af9960edb42ef405cf6d045abba87368404e7287bbecff283b75884e8483af8f6b1b545f6097a59cee9c27ed9b31537593b69cfd97c160f24e374a80adddf6d53e19f226cce3c030e6f22bc788ec8c39847519bd928e958fa6c708188815fea131f5f13d317575b2bafe0bc72ccb65d8ad1c72e94e21a0f1683e5b8b98ecec34310ef24fc1a8caec30350d7e2e49fb593f9507228b14509891d5aed6e629c56d164da3b900fe5c34a30e686d5b5a9b53ac6c97ac58eca431867542b5a5feed31d60d27aae8ee3c370d7fc248d7881b19e8dacbedd325280d072d346df0b2c7f61336907d9cb2d58fd50b264ff2b735fc7d3ab5760abea18de6ced1e01eca562ca6826bbdaf7afc4a346481ac4a8e838ffca73bfff33b3b7704bf67ffa73b107fa0b4edfc22cbebc8d8e7ebdf20d3161357d89cde2bee80c9be02fca03c1bf9e8cec61bfd98c2a621ef8acf280ff198c529c506f20e3b8b8b53109b939768944e616cb64bfca0c4122799eb5acfa63310f317c0db09d01ee56dc546d26dd9aee511d592dad7d1e8e535c576e1b42971e946c5923d137e2cb865feb5360a0fa94cfe58326083add762dbb3d77b18bfe003314c0eae478c54e657c99f291b91a3528c9dee593f6afbb7cf732b40e87e20b417f457315f7564bd47f59731107d90b6edf422c3ebe8c8c618175e57916b5143518499099d26edf3c5332df3e2c72fcc0cd9c82addea1adda9e6f6c03bc0f33fc0f8e2383bfb7ccc4a36757cb2b80bf4773eb07c0bb844fcb2360b7c64b8b1f4093e467c93b858fc6236517c52b96bf5533d907eafb9e48ed661e74acc6c15bdea8527cd64e9a5c912c5a1ceeee1d1d1151555d29d1a5ae8a6259c811bd5d31edb57db9318ac6c6042b18e7aedbc3d038a3f79fbb2c88627b4e37bd0bf1d8ce9623955fa993e6a895985a13a867ff5bccef7e5cb252889e039350ef907c2d8d627d40712e366344d7f4944a9a60919dad91deaead1c1d92d198126d61c15996d51525993996896adee613fa9f312c49bc820d5e9d926eefa23cae0ce31c605034e4fa4471b6b9058a59f955b19a0a961ee5d22a591e69523dd04e6d9c5d2d5142e9b89a77110b955866ee5aa36e6823e617dbabaffffc8c4d5d012e3982ce59bc2af16002d6ef2be3fff0cc0c8182ed2662d4c829db46102a66d84453b7af8b9c80122a1666941be9d73e648c54c36ae83f6433b8b74bfb7fc8737aff0e4cc21eb1d2f9114e6e836257c65b2a6fe003eb37dffb2c087f6033b5cfb95c8a6e3e628c8060035aaf173c6bcf0723cb2747ab7bc0b03b82c8f9bc4df3fd780e36bc04b1db8dafe29c1f92d3e1e8be9f73d3f760c4f0daf15702db70e840e6a575d9b92a7226304a04c02a6e06bc644fd89c94129928ade4a235ffb573b9374ec4a356c754242ad8b8d0b2990f960324e768641b54ef6a9ca01133ed87de74d27a517622cae65845140a26e63aab710005f6f5bb4ac8587a528ed8232d77e20bee1fdd93111065d839abf6000a845869687dc6310b41d8fd960ea5e2660f24631a8f10bc62f0e0735cb06c765e8aacf9c13289307a4888fee70ddbc1a8f5e5ba79cfc943a1876a34fe740c381ef6928bdf072c9bbc9731a4c2f4c0751d86917ad27619059519ea911fe5ec9afe69cd1a7d6ef13cb9328ace9e43d35fa893209814d49627e5dbe628445cd4ae9a43a97f8133ce0f9da32d281d20911e966c6580e975fa45b0253f19cc953e160c147d28cd9a7e294c195e29ec995d2a513861c8e1786e0c7ce00e815df9918a6a81186169f9a58a4a6618c416b5d4755b0597b59405db256fc523061f9ad3909063e5ef15dca5eeca63c6205bf0ef41fc71cc7563c9bf9e4c535c105064e2ca0839e6b1b582c6ae0a3db84dc95dc192baa6cfe563062f240338c772b486fb654f490359e816001436d67525f9598e6d7dddf1520aa7c73bcb0ff8e30a40402d1e9dac125f2e931c9752e4aea9633d6f0d43feff8c4c9f606c4c3ee20c4f1e636c4f1ee3ac58bf50335c3f13cc6f8023af1f8393d0e8a5f86a738600f5fe868d34feca8de1a1014255c829d9e6160a5a1e50ace8bf4533694fa183e270ce381d362dfb3d4f7183b678ba48c97c5df2ed3f3e33cc47e3fbc777840bc91f6513c9580612baa6f194ba1b702fca83e68f057c59ceaac27ec7720b76473a4b4edfc22c77e14bfd9fceec2221a8093c418eae2262e0480d1d5e515225d8092afdd872d301efa57c1ab22e41c245606974e5bb15cfd51cead03ed672db48a8e29a47697bbe770cbb3e08f25b4f971c24ee55a365d0f997759b3928ce6402240e2843a017d5eb9640a4	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2848	OSF.exe
Token: SeIncBasePriorityPrivilege	2848	OSF.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2848	OSF.exe
2848	OSF.exe
2848	OSF.exe
2848	OSF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2848	2280	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2848	2280	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2848	2280	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe	30
PID 2280 wrote to memory of 2848	2280	4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a6759af1734b97f4004c709f85c13af_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\UIBKOH\OSF.exe
  "C:\Windows\system32\UIBKOH\OSF.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
ab94d37a64a9285fc7393dd154545e0f

SHA1
0ba2ed8caf3c3fc49de44323103ca4bb7e6f8ee4

SHA256
074420699496d6dbe450ea80be110b104282fa3c2886757488b628cbd1c7ab32

SHA512
68ccc85be327bea12d573d73b6a6a5d75dd2b8d946da61dac57a5c6ee54284631356c24c74e2445895ab94753122aedcf361ec7cd7bd53b90852d6319f960e36

Download Submit
C:\Windows\SysWOW64\UIBKOH\OSF.001

Filesize
61KB

MD5
383d5f5d4240d590e7dec3f7312a4ac7

SHA1
f6bcade8d37afb80cf52a89b3e84683f4643fbce

SHA256
7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422

SHA512
e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a

Download Submit
C:\Windows\SysWOW64\UIBKOH\OSF.002

Filesize
43KB

MD5
93df156c4bd9d7341f4c4a4847616a69

SHA1
c7663b32c3c8e247bc16b51aff87b45484652dc1

SHA256
e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e

SHA512
ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35

Download Submit
C:\Windows\SysWOW64\UIBKOH\OSF.004

Filesize
1KB

MD5
946eb370adc99fbe08064dac5d836f8a

SHA1
370069238fa8779ecdf2c3ea9d948eafd9fafcae

SHA256
9167c2d604bf14043dbd6c01ad76d90bdcdab17463888e8f89ade049346ae148

SHA512
10d6af7f448f7c469d96710c08b4c7cef219e3836dfa5f90cbe0da8d095d1a596726e153803bf1cc7e1c121a2d87acd9efd8cf106cce9228f3b68c29f5623f88

Download Submit
\Windows\SysWOW64\UIBKOH\OSF.exe

Filesize
1.7MB

MD5
3cd29c0df98a7aeb69a9692843ca3edb

SHA1
7c86aea093f1979d18901bd1b89a2b02a60ac3e2

SHA256
5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32

SHA512
e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9

Download Submit
memory/2280-0-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2280-17-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2848-23-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads