asyncrat | e5bbb80e14cc81f6dcc7263461f6650f1fb23cbdbcdacc4d42406621c6f97123

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
23-08-2024 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

asyncrat phorphiex redline stealc daval default kir credential_access discovery evasion execution infostealer loader persistence rat spyware stealer trojan worm

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

127.0.0.1:1024

20.199.84.103:1024

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

stealc

Botnet

daval

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

phorphiex

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes

mutex
x88767657x
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Extracted

Family

redline

Botnet

kir

147.45.44.73:6282

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysarddrvs.exe

Phorphiex payload 3 IoCs

resource	yara_rule
behavioral4/files/0x000300000002ab01-26.dat	family_phorphiex
behavioral4/files/0x000200000002ab1c-223.dat	family_phorphiex
behavioral4/files/0x000100000002ab22-359.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000100000002ab25-375.dat	family_redline
behavioral4/memory/6972-382-0x00000000000B0000-0x0000000000102000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral4/files/0x000400000002aacf-10.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5452	powershell.exe
7596	powershell.exe

Contacts a large (1118) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 22 IoCs

pid	Process
3980	Client.exe
2400	r.exe
4972	t1.exe
2016	sysmablsvr.exe
2708	1107128135.exe
4880	t2.exe
3624	stealc_daval.exe
2200	DecryptJohn.exe
1672	npp.exe
5060	098.exe
4588	m.exe
4508	3135528911.exe
5152	sysmysldrv.exe
4280	963432165.exe
6948	66b5ac957cc65_crypta.exe
7068	1.exe
7156	s.exe
6972	exec.exe
7028	pei.exe
7136	sysarddrvs.exe
7896	546731166.exe
7576	2772018654.exe

Loads dropped DLL 3 IoCs

pid	Process
2200	DecryptJohn.exe
3624	stealc_daval.exe
3624	stealc_daval.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmysldrv.exe"	3135528911.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 1284	2200	DecryptJohn.exe	88
PID 5060 set thread context of 2460	5060	098.exe	91
PID 6948 set thread context of 712	6948	66b5ac957cc65_crypta.exe	112

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	r.exe
File opened for modification	C:\Windows\sysmablsvr.exe	r.exe
File created	C:\Windows\sysmysldrv.exe	3135528911.exe
File opened for modification	C:\Windows\sysmysldrv.exe	3135528911.exe
File created	C:\Windows\sysarddrvs.exe	1.exe
File opened for modification	C:\Windows\sysarddrvs.exe	1.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5484	sc.exe
5508	sc.exe
5528	sc.exe
5576	sc.exe
7620	sc.exe
7652	sc.exe
5460	sc.exe
7764	sc.exe
7820	sc.exe
7740	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3088	2460	WerFault.exe	91
4444	2460	WerFault.exe	91
7028	712	WerFault.exe	112
7204	712	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1107128135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3135528911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DecryptJohn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmysldrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	963432165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2772018654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_daval.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5ac957cc65_crypta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	546731166.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_daval.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_daval.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	exec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	exec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3624	stealc_daval.exe
3624	stealc_daval.exe
3624	stealc_daval.exe
3624	stealc_daval.exe
5452	powershell.exe
5452	powershell.exe
7596	powershell.exe
7596	powershell.exe
7596	powershell.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
5152	sysmysldrv.exe
7136	sysarddrvs.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	280	4363463463464363463463463.exe
Token: SeDebugPrivilege	5060	098.exe
Token: SeDebugPrivilege	5452	powershell.exe
Token: SeDebugPrivilege	6948	66b5ac957cc65_crypta.exe
Token: SeDebugPrivilege	7596	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 3980	280	4363463463464363463463463.exe	79
PID 280 wrote to memory of 3980	280	4363463463464363463463463.exe	79
PID 280 wrote to memory of 2400	280	4363463463464363463463463.exe	80
PID 280 wrote to memory of 2400	280	4363463463464363463463463.exe	80
PID 280 wrote to memory of 2400	280	4363463463464363463463463.exe	80
PID 280 wrote to memory of 4972	280	4363463463464363463463463.exe	81
PID 280 wrote to memory of 4972	280	4363463463464363463463463.exe	81
PID 280 wrote to memory of 4972	280	4363463463464363463463463.exe	81
PID 2400 wrote to memory of 2016	2400	r.exe	82
PID 2400 wrote to memory of 2016	2400	r.exe	82
PID 2400 wrote to memory of 2016	2400	r.exe	82
PID 2016 wrote to memory of 2708	2016	sysmablsvr.exe	83
PID 2016 wrote to memory of 2708	2016	sysmablsvr.exe	83
PID 2016 wrote to memory of 2708	2016	sysmablsvr.exe	83
PID 280 wrote to memory of 4880	280	4363463463464363463463463.exe	84
PID 280 wrote to memory of 4880	280	4363463463464363463463463.exe	84
PID 280 wrote to memory of 4880	280	4363463463464363463463463.exe	84
PID 280 wrote to memory of 3624	280	4363463463464363463463463.exe	85
PID 280 wrote to memory of 3624	280	4363463463464363463463463.exe	85
PID 280 wrote to memory of 3624	280	4363463463464363463463463.exe	85
PID 280 wrote to memory of 2200	280	4363463463464363463463463.exe	86
PID 280 wrote to memory of 2200	280	4363463463464363463463463.exe	86
PID 280 wrote to memory of 2200	280	4363463463464363463463463.exe	86
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 2200 wrote to memory of 1284	2200	DecryptJohn.exe	88
PID 280 wrote to memory of 1672	280	4363463463464363463463463.exe	89
PID 280 wrote to memory of 1672	280	4363463463464363463463463.exe	89
PID 280 wrote to memory of 1672	280	4363463463464363463463463.exe	89
PID 280 wrote to memory of 5060	280	4363463463464363463463463.exe	90
PID 280 wrote to memory of 5060	280	4363463463464363463463463.exe	90
PID 280 wrote to memory of 5060	280	4363463463464363463463463.exe	90
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 5060 wrote to memory of 2460	5060	098.exe	91
PID 280 wrote to memory of 4588	280	4363463463464363463463463.exe	92
PID 280 wrote to memory of 4588	280	4363463463464363463463463.exe	92
PID 280 wrote to memory of 4588	280	4363463463464363463463463.exe	92
PID 1672 wrote to memory of 4508	1672	npp.exe	98
PID 1672 wrote to memory of 4508	1672	npp.exe	98
PID 1672 wrote to memory of 4508	1672	npp.exe	98
PID 4508 wrote to memory of 5152	4508	3135528911.exe	99
PID 4508 wrote to memory of 5152	4508	3135528911.exe	99
PID 4508 wrote to memory of 5152	4508	3135528911.exe	99
PID 5152 wrote to memory of 5360	5152	sysmysldrv.exe	100
PID 5152 wrote to memory of 5360	5152	sysmysldrv.exe	100
PID 5152 wrote to memory of 5360	5152	sysmysldrv.exe	100
PID 5152 wrote to memory of 5368	5152	sysmysldrv.exe	101
PID 5152 wrote to memory of 5368	5152	sysmysldrv.exe	101
PID 5152 wrote to memory of 5368	5152	sysmysldrv.exe	101

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:280
- C:\Users\Admin\AppData\Local\Temp\Files\Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\Files\r.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\sysmablsvr.exe
    C:\Windows\sysmablsvr.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\1107128135.exe
      C:\Users\Admin\AppData\Local\Temp\1107128135.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2708
- C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4972
- C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4880
- C:\Users\Admin\AppData\Local\Temp\Files\stealc_daval.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stealc_daval.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1284
- C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\3135528911.exe
    C:\Users\Admin\AppData\Local\Temp\3135528911.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\sysmysldrv.exe
      C:\Windows\sysmysldrv.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      Suspicious use of WriteProcessMemory
      PID:5152
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5460
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5484
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5508
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\963432165.exe
        
        C:\Users\Admin\AppData\Local\Temp\963432165.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4280
- C:\Users\Admin\AppData\Local\Temp\Files\098.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\098.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 728
      4⤵
      Program crash
      PID:3088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1168
      4⤵
      Program crash
      PID:4444
- C:\Users\Admin\AppData\Local\Temp\Files\m.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\Files\66b5ac957cc65_crypta.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\66b5ac957cc65_crypta.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 688
      4⤵
      Program crash
      PID:7028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 688
      4⤵
      Program crash
      PID:7204
- C:\Users\Admin\AppData\Local\Temp\Files\1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:7068
- - C:\Windows\sysarddrvs.exe
    C:\Windows\sysarddrvs.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:7136
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7512
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7596
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
      4⤵
      System Location Discovery: System Language Discovery
      PID:7532
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7620
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7652
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7740
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7764
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\2772018654.exe
      C:\Users\Admin\AppData\Local\Temp\2772018654.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7576
- C:\Users\Admin\AppData\Local\Temp\Files\s.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7156
- C:\Users\Admin\AppData\Local\Temp\Files\exec.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\exec.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:6972
- C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7028
- - C:\Users\Admin\AppData\Local\Temp\546731166.exe
    C:\Users\Admin\AppData\Local\Temp\546731166.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2460 -ip 2460
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2460 -ip 2460
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 712 -ip 712
1⤵
PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 712 -ip 712
1⤵
PID:7184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
04edfc84f02ea06995ffa3d5a29c5ec2

SHA1
abd572d59152d855bd0002de660a8e22eb580095

SHA256
a09d498f33b31fb7abe59c3622fc9a0d02082258058b2446528a3b1f9ea16a59

SHA512
52e2042c746317777b69280d80581f8ef4c9effee3d6122a2db724babe4e32564ccabd1bd33421b91a346cd3a0a0279de9e0582fec179feb4b123100d13b434d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1107128135.exe

Filesize
19KB

MD5
dce86bff5ca04db752b19245e111a636

SHA1
f1e3a56d5be946483b5eac047540a37d6af60f03

SHA256
1467e4763d7a4b66d33c01714e7ed6192c8518688a72f91bf37a51ef35095a6d

SHA512
448bd6926688f32afef0d759dcdbe10915736e51f0b4b3059d402e58d677b4ed915460809a91680bd2eb640fc830dfaeda02484157a94f1d8ce2447e3a795ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\3135528911.exe

Filesize
92KB

MD5
be9388b42333b3d4e163b0ace699897b

SHA1
4e1109772eb9cb59c557380822166fe1664403bd

SHA256
d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f

SHA512
5f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\963432165.exe

Filesize
19KB

MD5
e9be5fcdbb65af72e3cc268a846608cc

SHA1
c3654860cec82d28852375bc7ad192e26b0ea240

SHA256
69d5bbd72a7c5ebb74b727849ec63898cb8672a1211bcc1750d7affdcbfc5759

SHA512
fbedc4634ab30192482878cee3d62b38d1c6a98be4ff2ef17b60238761b58fe4f0ad302beb9e35af57f3cc64b45df988c30ab9126bae4c81b66fdc2ec8399e03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\098.exe

Filesize
13KB

MD5
d62734be89eafc36d0f9fc8f3d3f0b60

SHA1
72a5683731178990c6b2e11f18ffdcdca7f60622

SHA256
1d17ebf5d32ebbba8a50b9e44e3fa76a3430c1949e12b66d76d39e8e2ce51191

SHA512
65bfe8c8bbed1ef35b7280b08895b86f5783f38e2dd0d86173075358430dfa523c44dbe3e7dbb0e476a5626154143f0f8404a8a9ca6ac760702662f76b035007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\1.exe

Filesize
79KB

MD5
e2e3268f813a0c5128ff8347cbaa58c8

SHA1
4952cbfbdec300c048808d79ee431972b8a7ba84

SHA256
d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

SHA512
cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\66b5ac957cc65_crypta.exe

Filesize
6.7MB

MD5
6faf304cc49ec71e06409e5965296025

SHA1
42c36bc0741798185118879a55006a56008a9257

SHA256
e6e621591cd287a1b4504c178c9ce8e53e8c7e8c299ffaf0add782e21c96b99b

SHA512
794423d0efaf2012f9eb93f91d02ce99ca473eab0e6a295b423541522bef3dcaad0ce235f0c73a7059a9de6e4bc1a1931b5e803c1ae1347afd62aa9de42452b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Client.exe

Filesize
47KB

MD5
fedb1274930bfa08a83480134a3f1412

SHA1
d47be6340ecd780274b98dad463749eb2d9d49fd

SHA256
a8fcd268b48c903e21500439d6754500d59d12d7d5d4e2c7ea737661fa8fe230

SHA512
ba1d2a9745b837c1f984577a5d96bff1b2c126d86fd75c7e763b085ea8440360899d383be10a7a6f31bbd87c215c3dfed82c03c15880e8f4ef336c411cb448b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe

Filesize
1.9MB

MD5
c1853d1c36dc461668c9af843d07cc58

SHA1
3c59af9da25113235365a6c08b44a3d6bfd3a1e8

SHA256
83cd3dcf4a855593ff0f594158ec9d27a8eb94172a92c4092138db7abfbc8793

SHA512
fd110a42927d580586081647d4d03f4cac6dd5934855e55e07794eec91b9d9d2e61a3d6cee2da5399966beae6cd1652b4d5583c492646dde87c824907e231463

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\exec.exe

Filesize
304KB

MD5
7f437ba23ac06e9f17bf831fe4610b7c

SHA1
0131f155fa2aee4a8d3c77cd795988f466eff6d3

SHA256
69e4ee0c49e80e9aed263df6c7a62b6896a80972002b3e71b68d7623843c01d3

SHA512
802ed8bcc7bb2651794cbbd0a0391b931b6f776551457496d9f461f7dea5d9b189bcf388151544934f72164c75d3e91680a053313e0e2f293bef120b8ccb837c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\npp.exe

Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\r.exe

Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\stealc_daval.exe

Filesize
187KB

MD5
edcfe06a0db28ab97fdff4c3d57989dc

SHA1
79e7cc304bc8c62de5c91ff9d6eb8e6c91f7ca87

SHA256
b717c966167148b7178e67727be7ac55d76d82acab88782e798e477a00abdd8b

SHA512
b96ba1852d8687bba10f38fd63cf8e99d353d84a1b6f43e207ea3fcef2e4e3d0d3c9512ec30818b0b3ddca9e1fcc6803b257fe5d45e792fe1c9f3a9ce0552996

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp936C.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4szhdib.kbm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
2.2MB

MD5
1d4b1380fd9d1bfb20fddc210cffbf88

SHA1
a2d8f046ab034ff93e7ba75f3e870bdeabe8cea0

SHA256
d5b00de89d8761566b778844db42710ae9d0e7fc55167a82fbdec25774b924d4

SHA512
bbd0b0917f1f0e282612d29b2b0ee92e3b97327ce26af538189aa6b772b7c9d6d191c300743b34f987a7af580a241c9b656ba8b18773fa77337c58cc7ab9fa1c

Download Submit
memory/280-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/280-5-0x0000000074D60000-0x0000000075511000-memory.dmp

Filesize
7.7MB

Download
memory/280-4-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/280-3-0x0000000074D60000-0x0000000075511000-memory.dmp

Filesize
7.7MB

Download
memory/280-2-0x0000000004DE0000-0x0000000004E7C000-memory.dmp

Filesize
624KB

Download
memory/280-1-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/1284-94-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-102-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-96-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-98-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-103-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-114-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-113-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-115-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-111-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-112-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-110-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-108-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-107-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-106-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-105-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-104-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-109-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-97-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-101-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-100-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-99-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-116-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-121-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-120-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-119-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-118-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-117-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-95-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-91-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-93-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-92-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-86-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/1284-85-0x00000000007B0000-0x0000000000825000-memory.dmp

Filesize
468KB

Download
memory/2200-78-0x0000000000D20000-0x0000000000F12000-memory.dmp

Filesize
1.9MB

Download
memory/2460-209-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2460-211-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3624-188-0x00000000000E0000-0x0000000000323000-memory.dmp

Filesize
2.3MB

Download
memory/3624-65-0x00000000000E0000-0x0000000000323000-memory.dmp

Filesize
2.3MB

Download
memory/3624-122-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3980-21-0x00007FF8E4EC0000-0x00007FF8E5982000-memory.dmp

Filesize
10.8MB

Download
memory/3980-20-0x00007FF8E4EC3000-0x00007FF8E4EC5000-memory.dmp

Filesize
8KB

Download
memory/3980-19-0x00007FF8E4EC0000-0x00007FF8E5982000-memory.dmp

Filesize
10.8MB

Download
memory/3980-18-0x0000000000A90000-0x0000000000AA2000-memory.dmp

Filesize
72KB

Download
memory/3980-17-0x00007FF8E4EC3000-0x00007FF8E4EC5000-memory.dmp

Filesize
8KB

Download
memory/5060-208-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/5452-257-0x00000000073F0000-0x0000000007494000-memory.dmp

Filesize
656KB

Download
memory/5452-264-0x0000000007810000-0x0000000007825000-memory.dmp

Filesize
84KB

Download
memory/5452-247-0x000000006EFF0000-0x000000006F03C000-memory.dmp

Filesize
304KB

Download
memory/5452-256-0x00000000067D0000-0x00000000067EE000-memory.dmp

Filesize
120KB

Download
memory/5452-245-0x0000000006280000-0x00000000062CC000-memory.dmp

Filesize
304KB

Download
memory/5452-258-0x0000000007C50000-0x00000000082CA000-memory.dmp

Filesize
6.5MB

Download
memory/5452-259-0x00000000075D0000-0x00000000075EA000-memory.dmp

Filesize
104KB

Download
memory/5452-260-0x0000000007630000-0x000000000763A000-memory.dmp

Filesize
40KB

Download
memory/5452-261-0x0000000007840000-0x00000000078D6000-memory.dmp

Filesize
600KB

Download
memory/5452-262-0x00000000077D0000-0x00000000077E1000-memory.dmp

Filesize
68KB

Download
memory/5452-263-0x0000000007800000-0x000000000780E000-memory.dmp

Filesize
56KB

Download
memory/5452-246-0x00000000073A0000-0x00000000073D4000-memory.dmp

Filesize
208KB

Download
memory/5452-265-0x0000000007900000-0x000000000791A000-memory.dmp

Filesize
104KB

Download
memory/5452-266-0x00000000078F0000-0x00000000078F8000-memory.dmp

Filesize
32KB

Download
memory/5452-244-0x00000000061D0000-0x00000000061EE000-memory.dmp

Filesize
120KB

Download
memory/5452-243-0x0000000005DD0000-0x0000000006127000-memory.dmp

Filesize
3.3MB

Download
memory/5452-233-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Filesize
408KB

Download
memory/5452-234-0x0000000005C30000-0x0000000005C96000-memory.dmp

Filesize
408KB

Download
memory/5452-232-0x0000000005440000-0x0000000005462000-memory.dmp

Filesize
136KB

Download
memory/5452-231-0x00000000054B0000-0x0000000005ADA000-memory.dmp

Filesize
6.2MB

Download
memory/5452-230-0x0000000002D30000-0x0000000002D66000-memory.dmp

Filesize
216KB

Download
memory/6948-290-0x0000000006260000-0x00000000063AE000-memory.dmp

Filesize
1.3MB

Download
memory/6948-305-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-297-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-295-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-293-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-292-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-291-0x0000000005EA0000-0x0000000005EBC000-memory.dmp

Filesize
112KB

Download
memory/6948-301-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-303-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6948-288-0x0000000000EC0000-0x0000000001570000-memory.dmp

Filesize
6.7MB

Download
memory/6948-289-0x0000000006030000-0x00000000061C2000-memory.dmp

Filesize
1.6MB

Download
memory/6948-299-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

Filesize
84KB

Download
memory/6972-416-0x0000000006290000-0x00000000062DC000-memory.dmp

Filesize
304KB

Download
memory/6972-414-0x00000000060C0000-0x00000000060D2000-memory.dmp

Filesize
72KB

Download
memory/6972-400-0x0000000004FF0000-0x0000000005066000-memory.dmp

Filesize
472KB

Download
memory/6972-409-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Filesize
120KB

Download
memory/6972-385-0x0000000004A80000-0x0000000004A8A000-memory.dmp

Filesize
40KB

Download
memory/6972-413-0x0000000006180000-0x000000000628A000-memory.dmp

Filesize
1.0MB

Download
memory/6972-384-0x0000000004A90000-0x0000000004B22000-memory.dmp

Filesize
584KB

Download
memory/6972-415-0x0000000006120000-0x000000000615C000-memory.dmp

Filesize
240KB

Download
memory/6972-412-0x0000000006630000-0x0000000006C48000-memory.dmp

Filesize
6.1MB

Download
memory/6972-383-0x0000000005100000-0x00000000056A6000-memory.dmp

Filesize
5.6MB

Download
memory/6972-382-0x00000000000B0000-0x0000000000102000-memory.dmp

Filesize
328KB

Download
memory/7596-433-0x0000000005EE0000-0x0000000006237000-memory.dmp

Filesize
3.3MB

Download
memory/7596-435-0x000000006C4C0000-0x000000006C50C000-memory.dmp

Filesize
304KB

Download
memory/7596-444-0x00000000076D0000-0x0000000007774000-memory.dmp

Filesize
656KB

Download
memory/7596-448-0x00000000078E0000-0x00000000078F1000-memory.dmp

Filesize
68KB

Download
memory/7596-449-0x0000000007AA0000-0x0000000007AB5000-memory.dmp

Filesize
84KB

Download