phorphiex | 55dbaec41fa7cc4224753c8859a8b836ef079e9e2c7458d639e1fe30690779fa

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

phorphiex redline 814fa discovery evasion execution infostealer loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/

http://77.91.77.92/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes

mutex
55a4er5wo
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Extracted

Family

redline

Botnet

814FA

88.99.151.68:7200

Signatures

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysarddrvs.exe

Phorphiex payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000e000000016da3-59.dat	family_phorphiex
behavioral1/files/0x00050000000193c3-186.dat	family_phorphiex
behavioral1/files/0x00050000000193e5-220.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/7880-350-0x0000000000090000-0x00000000000E2000-memory.dmp	family_redline

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3520	powershell.exe
4024	powershell.exe

Contacts a large (1549) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 20 IoCs

pid	Process
2780	t2.exe
2648	a.exe
2332	sysmablsvr.exe
1972	sysmablsvr.exe
1184	100599079.exe
1516	twztl.exe
3276	66b5b75106ac6_stealc.exe
3616	newtpp.exe
3796	tpeinf.exe
3932	t.exe
4000	sysmysldrv.exe
3436	sysarddrvs.exe
3548	855519883.exe
3272	303699632.exe
4124	707514981.exe
5820	t1.exe
6380	MePaxil.exe
6756	Legend.pif
7812	s.exe
7880	RegAsm.exe

Loads dropped DLL 27 IoCs

pid	Process
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2648	a.exe
2648	a.exe
1972	sysmablsvr.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
3796	tpeinf.exe
3796	tpeinf.exe
4000	sysmysldrv.exe
3436	sysarddrvs.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
6480	cmd.exe
2116	4363463463464363463463463.exe
2116	4363463463464363463463463.exe
6756	Legend.pif
7880	RegAsm.exe

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmysldrv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysmablsvr.exe"	a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmysldrv.exe"	newtpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	t.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
6532	tasklist.exe
6624	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 3608	3276	66b5b75106ac6_stealc.exe	40

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	t2.exe
File opened for modification	C:\Windows\sysmablsvr.exe	t2.exe
File created	C:\Windows\sysmablsvr.exe	a.exe
File created	C:\Windows\sysmysldrv.exe	newtpp.exe
File opened for modification	C:\Windows\sysmysldrv.exe	newtpp.exe
File created	C:\Windows\sysarddrvs.exe	t.exe
File opened for modification	C:\Windows\sysarddrvs.exe	t.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3452	sc.exe
3544	sc.exe
3284	sc.exe
3288	sc.exe
3316	sc.exe
3676	sc.exe
4064	sc.exe
3600	sc.exe
3544	sc.exe
3624	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5792	3608	WerFault.exe	40

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legend.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MePaxil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5b75106ac6_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmysldrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6832	schtasks.exe
6844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3520	powershell.exe
4024	powershell.exe
3608	MSBuild.exe
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
4000	sysmysldrv.exe
3436	sysarddrvs.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	4363463463464363463463463.exe
Token: SeDebugPrivilege	3276	66b5b75106ac6_stealc.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	6532	tasklist.exe
Token: SeDebugPrivilege	6624	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6756	Legend.pif
6756	Legend.pif
6756	Legend.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2780	2116	4363463463464363463463463.exe	31
PID 2116 wrote to memory of 2780	2116	4363463463464363463463463.exe	31
PID 2116 wrote to memory of 2780	2116	4363463463464363463463463.exe	31
PID 2116 wrote to memory of 2780	2116	4363463463464363463463463.exe	31
PID 2116 wrote to memory of 2648	2116	4363463463464363463463463.exe	32
PID 2116 wrote to memory of 2648	2116	4363463463464363463463463.exe	32
PID 2116 wrote to memory of 2648	2116	4363463463464363463463463.exe	32
PID 2116 wrote to memory of 2648	2116	4363463463464363463463463.exe	32
PID 2780 wrote to memory of 2332	2780	t2.exe	33
PID 2780 wrote to memory of 2332	2780	t2.exe	33
PID 2780 wrote to memory of 2332	2780	t2.exe	33
PID 2780 wrote to memory of 2332	2780	t2.exe	33
PID 2648 wrote to memory of 1972	2648	a.exe	35
PID 2648 wrote to memory of 1972	2648	a.exe	35
PID 2648 wrote to memory of 1972	2648	a.exe	35
PID 2648 wrote to memory of 1972	2648	a.exe	35
PID 1972 wrote to memory of 1184	1972	sysmablsvr.exe	37
PID 1972 wrote to memory of 1184	1972	sysmablsvr.exe	37
PID 1972 wrote to memory of 1184	1972	sysmablsvr.exe	37
PID 1972 wrote to memory of 1184	1972	sysmablsvr.exe	37
PID 2116 wrote to memory of 1516	2116	4363463463464363463463463.exe	38
PID 2116 wrote to memory of 1516	2116	4363463463464363463463463.exe	38
PID 2116 wrote to memory of 1516	2116	4363463463464363463463463.exe	38
PID 2116 wrote to memory of 1516	2116	4363463463464363463463463.exe	38
PID 2116 wrote to memory of 3276	2116	4363463463464363463463463.exe	39
PID 2116 wrote to memory of 3276	2116	4363463463464363463463463.exe	39
PID 2116 wrote to memory of 3276	2116	4363463463464363463463463.exe	39
PID 2116 wrote to memory of 3276	2116	4363463463464363463463463.exe	39
PID 2116 wrote to memory of 3616	2116	4363463463464363463463463.exe	41
PID 2116 wrote to memory of 3616	2116	4363463463464363463463463.exe	41
PID 2116 wrote to memory of 3616	2116	4363463463464363463463463.exe	41
PID 2116 wrote to memory of 3616	2116	4363463463464363463463463.exe	41
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 3276 wrote to memory of 3608	3276	66b5b75106ac6_stealc.exe	40
PID 2116 wrote to memory of 3796	2116	4363463463464363463463463.exe	42
PID 2116 wrote to memory of 3796	2116	4363463463464363463463463.exe	42
PID 2116 wrote to memory of 3796	2116	4363463463464363463463463.exe	42
PID 2116 wrote to memory of 3796	2116	4363463463464363463463463.exe	42
PID 2116 wrote to memory of 3932	2116	4363463463464363463463463.exe	43
PID 2116 wrote to memory of 3932	2116	4363463463464363463463463.exe	43
PID 2116 wrote to memory of 3932	2116	4363463463464363463463463.exe	43
PID 2116 wrote to memory of 3932	2116	4363463463464363463463463.exe	43
PID 3616 wrote to memory of 4000	3616	newtpp.exe	44
PID 3616 wrote to memory of 4000	3616	newtpp.exe	44
PID 3616 wrote to memory of 4000	3616	newtpp.exe	44
PID 3616 wrote to memory of 4000	3616	newtpp.exe	44
PID 3932 wrote to memory of 3436	3932	t.exe	46
PID 3932 wrote to memory of 3436	3932	t.exe	46
PID 3932 wrote to memory of 3436	3932	t.exe	46
PID 3932 wrote to memory of 3436	3932	t.exe	46
PID 3796 wrote to memory of 3548	3796	tpeinf.exe	47
PID 3796 wrote to memory of 3548	3796	tpeinf.exe	47
PID 3796 wrote to memory of 3548	3796	tpeinf.exe	47
PID 3796 wrote to memory of 3548	3796	tpeinf.exe	47
PID 4000 wrote to memory of 3440	4000	sysmysldrv.exe	48
PID 4000 wrote to memory of 3440	4000	sysmysldrv.exe	48

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\sysmablsvr.exe
    C:\Windows\sysmablsvr.exe
    3⤵
    - Executes dropped EXE
    PID:2332
- C:\Users\Admin\AppData\Local\Temp\Files\a.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\sysmablsvr.exe
    C:\Users\Admin\sysmablsvr.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\100599079.exe
      C:\Users\Admin\AppData\Local\Temp\100599079.exe
      4⤵
      Executes dropped EXE
      PID:1184
- C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\Files\66b5b75106ac6_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\66b5b75106ac6_stealc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 716
      4⤵
      Program crash
      PID:5792
- C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\sysmysldrv.exe
    C:\Windows\sysmysldrv.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
      4⤵
      System Location Discovery: System Language Discovery
      PID:3472
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3544
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3284
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3624
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3316
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\303699632.exe
      C:\Users\Admin\AppData\Local\Temp\303699632.exe
      4⤵
      Executes dropped EXE
      PID:3272
- C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\855519883.exe
    C:\Users\Admin\AppData\Local\Temp\855519883.exe
    3⤵
    - Executes dropped EXE
    PID:3548
- C:\Users\Admin\AppData\Local\Temp\Files\t.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\sysarddrvs.exe
    C:\Windows\sysarddrvs.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:3436
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
      4⤵
      System Location Discovery: System Language Discovery
      PID:3956
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3288
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4064
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3452
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3600
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\707514981.exe
      C:\Users\Admin\AppData\Local\Temp\707514981.exe
      4⤵
      Executes dropped EXE
      PID:4124
- C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
  2⤵
  - Executes dropped EXE
  PID:5820
- C:\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Offensive Offensive.cmd & Offensive.cmd & exit
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:6480
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6532
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6540
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6624
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6632
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 543648
      4⤵
      System Location Discovery: System Language Discovery
      PID:6664
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "BiddingVeRoutinesFilms" Bowling
      4⤵
      System Location Discovery: System Language Discovery
      PID:6676
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Suzuki + ..\Major + ..\Tit + ..\Adjust + ..\Invest + ..\Severe + ..\Sony + ..\Prefers E
      4⤵
      System Location Discovery: System Language Discovery
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\543648\Legend.pif
      Legend.pif E
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6756
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "Keyboard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6844
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "ScanGuard" /tr "wscript //B 'C:\Users\Admin\AppData\Local\ThreatGuard Innovations\ScanGuard.js'" /sc onlogon /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\543648\RegAsm.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:7880
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 15
      4⤵
      System Location Discovery: System Language Discovery
      PID:6784
- C:\Users\Admin\AppData\Local\Temp\Files\s.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
  2⤵
  - Executes dropped EXE
  PID:7812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\1[1]

Filesize
19KB

MD5
e9be5fcdbb65af72e3cc268a846608cc

SHA1
c3654860cec82d28852375bc7ad192e26b0ea240

SHA256
69d5bbd72a7c5ebb74b727849ec63898cb8672a1211bcc1750d7affdcbfc5759

SHA512
fbedc4634ab30192482878cee3d62b38d1c6a98be4ff2ef17b60238761b58fe4f0ad302beb9e35af57f3cc64b45df988c30ab9126bae4c81b66fdc2ec8399e03

Download Submit
C:\Users\Admin\AppData\Local\Temp\543648\E

Filesize
538KB

MD5
f8e0529fb48efca8c0eede34c01e0033

SHA1
85a42f025ae9a2227f2649df6652c929400a4aac

SHA256
68b1bbcf0f6f6270afb451b41f81f6f5691759493640f6e2735276877c024dcb

SHA512
b6192ad0efe9c04f803a5a14c09480d573ff94d6d50135ff85b2fa4e9ef52c4c04fcb99207be0e7fa4f3a2dba27b6d0b336e111cc3ae678a05761132dadf8f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Adjust

Filesize
50KB

MD5
35e5ab29f9dc36806b7db16d46ed7ede

SHA1
527d6aa79dca3a83dca41245240507996a1b0ae3

SHA256
c6ab18d27ef2d0e9b01a3502b9ef292ac9d5a4bd045db792d8d3b4188c30f8c1

SHA512
754c57e8fcd56f149dbfd6606c029071cae23bd9d658961b853c03830cb8150d444f1e365ed8651ab5accf4b6e5fc1184c42f5e1d1cead261eee04268152309b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bowling

Filesize
608B

MD5
1100e2dc0abbc946984508a57c2dcc6a

SHA1
a46249d3d6aebb480f6c948aff6f065ad3ce6721

SHA256
87cf4bc82402b0ee787dd23867496ee383cc24c397fe54372a0e2fcc1c6bf206

SHA512
c2c4cb619a76ee8f6ccefeb712b11a25c1c475db088aeab5dad6978536a2eca710f31a73d183062c83ce272cf0534b53c2d4f40db203a4b7a3b8bfa5e9390fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6C3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cafe

Filesize
872KB

MD5
be7ece0a176b5396ed2e80dfd1c7d424

SHA1
ea19b37edc7d7cef563094860af09900898fe467

SHA256
4d448ab30a84c345178b92911192046923db0badece1146f0adda3f0af1417d8

SHA512
ef006bad40449dca5569f113d8eebcef718f3754a5455b1bd31ef61ab59c5b096b24663da60173edb1741bd045f588823144e63b2e62b681abd7e5b95f2c906b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\t.exe

Filesize
79KB

MD5
e2e3268f813a0c5128ff8347cbaa58c8

SHA1
4952cbfbdec300c048808d79ee431972b8a7ba84

SHA256
d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

SHA512
cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe

Filesize
6KB

MD5
cfb7fbf1d4b077a0e74ed6e9aab650a8

SHA1
a91cfbcc9e67e8f4891dde04e7d003fc63b7d977

SHA256
d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0

SHA512
b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Invest

Filesize
90KB

MD5
2650bd0e98cced157856b15c55a48398

SHA1
b8b509ad22f350d600cd4ac612a5eb3d61db3f02

SHA256
f6b5de9758a1baa8f31e584bb5e5427365a7d08679931328d6ae9ddf1b6c99ec

SHA512
db3693cc106df3b097b8b3b97236819792bb04afead5e13679fdcc21765fd348502dae64eade646815fb7cd3745f190ed8d8a071f6d5f29cb36ffd08c9193e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Major

Filesize
97KB

MD5
5365ad26fbf55fbb238379160f3819ae

SHA1
6e33efe060d8fc424f5c850107ad4794c66daec1

SHA256
5749f6b429f9fbd508b810c6e99504e19036a93374d83eabd7171cb625627ae6

SHA512
861b76e0f60d055c7cf2b51d5a4aa21848664b57fa387d83e9c36c23dd0044bacb0bb8e5a8630062604871197b7050e82101c91dd2b809e8c5208eb86fa22e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Offensive

Filesize
10KB

MD5
ba741ea1fd350411ba286e3807deb915

SHA1
885f5b96f704a4e5fbefbb6c8b82274ead6ffeb0

SHA256
adcf5ed9c2a1ab99e0e91306fa3e2d828902c989046d7cff497a4b864ffac5f3

SHA512
e4f9ea218752cfe4f8a4241c7bfa8d87f2fb0fcc1c5ca679105f42a4c1bb9c692b70cea3e60cfb50cc24af2eefc2bfe80bfecd54cbcec51ef523199251efaf9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prefers

Filesize
32KB

MD5
3800b719c54c939f9c41642d3f0c0dc9

SHA1
2f4e8b5ad282ff727f23ff8b98f82427bc88d263

SHA256
d2fafbf46e5741896ca37681386c1af4f847d2bae11592be569ed41d7e50702b

SHA512
b0f73c110f28091ae5c786ce9c5970ea2d4c728abfc4aacb926892712d04a0d5bb0d912ef5cf27a19b529cfcae2bf5f63ddaa77f4e39e49f7d67ce240d9f35e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Severe

Filesize
50KB

MD5
af2b7ee3e48e5404c5b8e4af9767ab3d

SHA1
18b0119b67a01719b7e968e2296676565a273264

SHA256
5748c19741e9877d8abeb2f593a158bd39195c9c1433129ebdb6858381283aee

SHA512
2472c62e1c65d3a03a293daae3eb162b42bdfc536907f4b1bb63d86315e3540cc8fd641d2b26183cc230884b6cc74cafb805c913c09b991ba3d4699ed8ed4129

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sony

Filesize
62KB

MD5
bbdea5ac69d32176c7cf0af7749cdf12

SHA1
39c66e4bcad18e9bb4400a579d44f177daf63ecc

SHA256
8d1c9abd9b4a2f0a19f9a003280e1ffaddfd4c55b3fbef43b4aa97c7d3d280e3

SHA512
e6021102ecba902d998601f4f857f973ff24edd7012fb1c3f9fef557f966a023ab241ac3f54aeaaf887e19560a805eaf77d593cfa7efd659a137faf4dbf53704

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suzuki

Filesize
87KB

MD5
c4cf8fa43e79df7fa6259198175880f4

SHA1
e9097784729e777188629e9c7c59cb0a0c6c6cd8

SHA256
f40e0aa9ee1be08178cde5ff9c25253e70c4c08cd7311722a749be0ebfcb49eb

SHA512
786cf3a41fa4d55999fd15ce6b1f89c1189f3212b181e2e0f2b3262e24669453cc99d587b3c70ddbf098117d5b5d3e4b7bf034e288bec61672bcdc29a131642e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6E6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tit

Filesize
70KB

MD5
9ff7f4f0f216def9dd325d9b667be06e

SHA1
f2cc8a82c99dc8bc38624e7aaa31fd29047f19dd

SHA256
7639decc3f03f22ed96230e5bfb619419d2523a56cb0b6cccf6ad6c66d5219e8

SHA512
83984918784fb08d6392d5a565578d9caa60218aba2ecfe255e3d809e0f7a48f36da68aea87fbca19a12d6bd83cbcc9aa24f021b14bafda68a2b90fb58ac4b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpDD65.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
39662b87d97f37bf033befce9eb70256

SHA1
1d47840a50c96688dd03123c41bcb1c882ea3e78

SHA256
65dbfb07cb88155da75c492d5b0c5de06631d47a48c105f96fc35802dee39008

SHA512
9ff6633acfb706debe9e891912775f11d34af444c29437fe658880d0a7657d827241af19f7e95da9670650e4cd5e1a0bb2dd4d4978ae876decbf27d15f6858bd

Download Submit
\Users\Admin\AppData\Local\Temp\100599079.exe

Filesize
19KB

MD5
dce86bff5ca04db752b19245e111a636

SHA1
f1e3a56d5be946483b5eac047540a37d6af60f03

SHA256
1467e4763d7a4b66d33c01714e7ed6192c8518688a72f91bf37a51ef35095a6d

SHA512
448bd6926688f32afef0d759dcdbe10915736e51f0b4b3059d402e58d677b4ed915460809a91680bd2eb640fc830dfaeda02484157a94f1d8ce2447e3a795ef8

Download Submit
\Users\Admin\AppData\Local\Temp\543648\Legend.pif

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\Files\66b5b75106ac6_stealc.exe

Filesize
6.0MB

MD5
67d39f0cbbab44b99fffaf3a408b2088

SHA1
ab84d55834c956a7904db0061a9fe145a6e9c783

SHA256
e7ad5000fcab4b69737e7b206f7ea0fbeeb7f68443e983e924e2710b54c7e5d4

SHA512
b5ef2c31e80527bf5715db45cb859d79b16ae4361657298173dd666290d14ce3f04e366ef203f00663964c815fa101ef4a42036669412c67ac4daa020f4faab4

Download Submit
\Users\Admin\AppData\Local\Temp\Files\MePaxil.exe

Filesize
1.1MB

MD5
bbe6311c3e2fab459f729dc8cd6e3519

SHA1
b71993aafd6627e55657819826c67f64f764c77f

SHA256
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874

SHA512
33fb4936db966d0f285a48b09700716eadcdc19212c3e234f34dc0e497e55f01f493956aa86de438a3c65ba8e112d6ee1f3cd0ff9aee3cda1f686cc68dc77a47

Download Submit
\Users\Admin\AppData\Local\Temp\Files\newtpp.exe

Filesize
92KB

MD5
be9388b42333b3d4e163b0ace699897b

SHA1
4e1109772eb9cb59c557380822166fe1664403bd

SHA256
d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f

SHA512
5f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a

Download Submit
\Users\Admin\AppData\Local\Temp\Files\t2.exe

Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
memory/2116-0-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/2116-94-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/2116-84-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/2116-2-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/2116-1-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/3276-179-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-155-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-149-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-147-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-145-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-143-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-141-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-139-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-137-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-135-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-133-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-131-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-129-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-127-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-125-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-124-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-120-0x0000000000940000-0x0000000000F50000-memory.dmp

Filesize
6.1MB

Download
memory/3276-121-0x0000000005470000-0x00000000055E6000-memory.dmp

Filesize
1.5MB

Download
memory/3276-153-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-151-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-157-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-159-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-161-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-163-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-165-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-167-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-169-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-171-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-173-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-175-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-177-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-181-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-183-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/3276-122-0x0000000005230000-0x0000000005360000-memory.dmp

Filesize
1.2MB

Download
memory/3276-123-0x0000000000600000-0x000000000061C000-memory.dmp

Filesize
112KB

Download
memory/3608-193-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/3608-195-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/7880-350-0x0000000000090000-0x00000000000E2000-memory.dmp

Filesize
328KB

Download