amadey | de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04-09-2024 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
Size

1.9MB
MD5

26cdd93ab5aa02332cd33c0282beba9f
SHA1

dbe088a6a212f0bb38b01a4ba7e1b4d1e2d06438
SHA256

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab
SHA512

a8e45e60e2a4ad0ed0b8f7462f5a6abe3a7ab8a58be9762acb849adc16d09af47b7206aa4d096192a673c3e570d45c2d55853b1453b114102d51b7b753382955
SSDEEP

49152:6wsNTwnR1z6iK3VQfFMkn3mCz5wIuicZ:6w6ToDgiMknWw1

Score

10^/10

amadey cryptbot povertystealer redline stealc 1176f2 @cloudytteam default default2 fed3aa livetraffic credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

default

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

cryptbot

analforeverlovyu.top

fivev5vt.top

sevxv17pn.top

Attributes

url_path
/v1/upload.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Detect Poverty Stealer Payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000291001\[t].exe	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2724-44-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
C:\Users\Admin\AppData\Roaming\2XFdKhB9cn.exe	family_redline
behavioral2/memory/2080-121-0x0000000000C20000-0x0000000000C72000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exede925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

axplong.exede925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exeaxplong.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Executes dropped EXE 29 IoCs

Processes:

axplong.exegold.execrypteda.exeOGnF4slEZu.exe2XFdKhB9cn.exeNework.exeHkbsse.exestealc_default2.exeSet-up.exejoffer2.exeneedmoney.exesvchost015.exeAmadeus.exeruntime.exepenis.exeaxplong.exeHkbsse.exeservice123.exeservice123.exeaxplong.exeruntime.exeservice123.exeHkbsse.exekey.exe[t].exeaxplong.exeruntime.exeservice123.exeHkbsse.exe

pid	process
4732	axplong.exe
3236	gold.exe
2752	crypteda.exe
1740	OGnF4slEZu.exe
2080	2XFdKhB9cn.exe
3608	Nework.exe
756	Hkbsse.exe
4080	stealc_default2.exe
3528	Set-up.exe
2756	joffer2.exe
3972	needmoney.exe
4020	svchost015.exe
4212	Amadeus.exe
3576	runtime.exe
2636	penis.exe
3484	axplong.exe
952	Hkbsse.exe
4784	service123.exe
2960	service123.exe
568	axplong.exe
5008	runtime.exe
3068	service123.exe
2976	Hkbsse.exe
1188	key.exe
2240	[t].exe
544	axplong.exe
3696	runtime.exe
3416	service123.exe
5056	Hkbsse.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exede925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
Key opened	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Wine	axplong.exe

Loads dropped DLL 6 IoCs

Processes:

stealc_default2.exeservice123.exeservice123.exeservice123.exeservice123.exe

pid process

4080 stealc_default2.exe
4080 stealc_default2.exe
4784 service123.exe
2960 service123.exe
3068 service123.exe
3416 service123.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4080	stealc_default2.exe
4080	stealc_default2.exe
4784	service123.exe
2960	service123.exe
3068	service123.exe
3416	service123.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

runtime.exeaxplong.exeruntime.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\runtime = "C:\\Users\\Admin\\Pictures\\Lighter Tech\\runtime.exe"	runtime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\Amadeus.exe = "C:\\Users\\Admin\\1000238002\\Amadeus.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\runtime = "C:\\Users\\Admin\\Pictures\\Lighter Tech\\runtime.exe"	runtime.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exe

pid process

4560 de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
4732 axplong.exe
3484 axplong.exe
568 axplong.exe
544 axplong.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

gold.execrypteda.exeneedmoney.exeruntime.exeruntime.exe

description	pid	process	target process
PID 3236 set thread context of 2724	3236	gold.exe	RegAsm.exe
PID 2752 set thread context of 4972	2752	crypteda.exe	RegAsm.exe
PID 3972 set thread context of 4020	3972	needmoney.exe	svchost015.exe
PID 3576 set thread context of 744	3576	runtime.exe	AppLaunch.exe
PID 5008 set thread context of 3020	5008	runtime.exe	AppLaunch.exe

Drops file in Windows directory 2 IoCs

Processes:

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeNework.exe

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4608 1188 WerFault.exe key.exe

pid	pid_target	process	target process
4608	1188	WerFault.exe	key.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exesvchost015.exeschtasks.exeservice123.exestealc_default2.exeRegAsm.exeschtasks.exede925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exeAmadeus.exeAppLaunch.exeHkbsse.exeSet-up.exekey.exe[t].exeOGnF4slEZu.exejoffer2.exeneedmoney.exegold.exeRegAsm.exeNework.exepenis.exeBitLockerToGo.execrypteda.exe2XFdKhB9cn.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amadeus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	key.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[t].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OGnF4slEZu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	joffer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2XFdKhB9cn.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Set-up.exejoffer2.exestealc_default2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	joffer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	joffer2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2268 schtasks.exe
4692 schtasks.exe
2844 schtasks.exe

pid	process
2268	schtasks.exe
4692	schtasks.exe
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exestealc_default2.exeOGnF4slEZu.exeRegAsm.exe2XFdKhB9cn.exeaxplong.exepenis.exeaxplong.exeaxplong.exe

pid	process
4560	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
4560	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
4732	axplong.exe
4732	axplong.exe
4080	stealc_default2.exe
4080	stealc_default2.exe
1740	OGnF4slEZu.exe
2724	RegAsm.exe
2724	RegAsm.exe
2724	RegAsm.exe
2724	RegAsm.exe
2080	2XFdKhB9cn.exe
2080	2XFdKhB9cn.exe
2080	2XFdKhB9cn.exe
2080	2XFdKhB9cn.exe
2724	RegAsm.exe
2080	2XFdKhB9cn.exe
4080	stealc_default2.exe
4080	stealc_default2.exe
3484	axplong.exe
3484	axplong.exe
2636	penis.exe
568	axplong.exe
568	axplong.exe
544	axplong.exe
544	axplong.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

OGnF4slEZu.exeRegAsm.exe2XFdKhB9cn.exeruntime.exepenis.exeruntime.exeruntime.exe

description	pid	process
Token: SeDebugPrivilege	1740	OGnF4slEZu.exe
Token: SeBackupPrivilege	1740	OGnF4slEZu.exe
Token: SeSecurityPrivilege	1740	OGnF4slEZu.exe
Token: SeSecurityPrivilege	1740	OGnF4slEZu.exe
Token: SeSecurityPrivilege	1740	OGnF4slEZu.exe
Token: SeSecurityPrivilege	1740	OGnF4slEZu.exe
Token: SeDebugPrivilege	2724	RegAsm.exe
Token: SeDebugPrivilege	2080	2XFdKhB9cn.exe
Token: SeDebugPrivilege	3576	runtime.exe
Token: SeDebugPrivilege	2636	penis.exe
Token: SeBackupPrivilege	2636	penis.exe
Token: SeSecurityPrivilege	2636	penis.exe
Token: SeSecurityPrivilege	2636	penis.exe
Token: SeSecurityPrivilege	2636	penis.exe
Token: SeSecurityPrivilege	2636	penis.exe
Token: SeDebugPrivilege	5008	runtime.exe
Token: SeDebugPrivilege	3696	runtime.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exeaxplong.exegold.execrypteda.exeRegAsm.exeNework.exeHkbsse.exeneedmoney.exe

description	pid	process	target process
PID 4560 wrote to memory of 4732	4560	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe	axplong.exe
PID 4560 wrote to memory of 4732	4560	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe	axplong.exe
PID 4560 wrote to memory of 4732	4560	de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe	axplong.exe
PID 4732 wrote to memory of 3236	4732	axplong.exe	gold.exe
PID 4732 wrote to memory of 3236	4732	axplong.exe	gold.exe
PID 4732 wrote to memory of 3236	4732	axplong.exe	gold.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 3236 wrote to memory of 2724	3236	gold.exe	RegAsm.exe
PID 4732 wrote to memory of 2752	4732	axplong.exe	crypteda.exe
PID 4732 wrote to memory of 2752	4732	axplong.exe	crypteda.exe
PID 4732 wrote to memory of 2752	4732	axplong.exe	crypteda.exe
PID 2752 wrote to memory of 2896	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 2896	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 2896	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 2752 wrote to memory of 4972	2752	crypteda.exe	RegAsm.exe
PID 4972 wrote to memory of 1740	4972	RegAsm.exe	OGnF4slEZu.exe
PID 4972 wrote to memory of 1740	4972	RegAsm.exe	OGnF4slEZu.exe
PID 4972 wrote to memory of 1740	4972	RegAsm.exe	OGnF4slEZu.exe
PID 4972 wrote to memory of 2080	4972	RegAsm.exe	2XFdKhB9cn.exe
PID 4972 wrote to memory of 2080	4972	RegAsm.exe	2XFdKhB9cn.exe
PID 4972 wrote to memory of 2080	4972	RegAsm.exe	2XFdKhB9cn.exe
PID 4732 wrote to memory of 3608	4732	axplong.exe	Nework.exe
PID 4732 wrote to memory of 3608	4732	axplong.exe	Nework.exe
PID 4732 wrote to memory of 3608	4732	axplong.exe	Nework.exe
PID 3608 wrote to memory of 756	3608	Nework.exe	Hkbsse.exe
PID 3608 wrote to memory of 756	3608	Nework.exe	Hkbsse.exe
PID 3608 wrote to memory of 756	3608	Nework.exe	Hkbsse.exe
PID 4732 wrote to memory of 4080	4732	axplong.exe	stealc_default2.exe
PID 4732 wrote to memory of 4080	4732	axplong.exe	stealc_default2.exe
PID 4732 wrote to memory of 4080	4732	axplong.exe	stealc_default2.exe
PID 4732 wrote to memory of 3528	4732	axplong.exe	Set-up.exe
PID 4732 wrote to memory of 3528	4732	axplong.exe	Set-up.exe
PID 4732 wrote to memory of 3528	4732	axplong.exe	Set-up.exe
PID 756 wrote to memory of 2756	756	Hkbsse.exe	joffer2.exe
PID 756 wrote to memory of 2756	756	Hkbsse.exe	joffer2.exe
PID 756 wrote to memory of 2756	756	Hkbsse.exe	joffer2.exe
PID 4732 wrote to memory of 3972	4732	axplong.exe	needmoney.exe
PID 4732 wrote to memory of 3972	4732	axplong.exe	needmoney.exe
PID 4732 wrote to memory of 3972	4732	axplong.exe	needmoney.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 3972 wrote to memory of 4020	3972	needmoney.exe	svchost015.exe
PID 4732 wrote to memory of 4212	4732	axplong.exe	Amadeus.exe
PID 4732 wrote to memory of 4212	4732	axplong.exe	Amadeus.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe
"C:\Users\Admin\AppData\Local\Temp\de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4732

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Roaming\OGnF4slEZu.exe
"C:\Users\Admin\AppData\Roaming\OGnF4slEZu.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Users\Admin\AppData\Roaming\2XFdKhB9cn.exe
"C:\Users\Admin\AppData\Roaming\2XFdKhB9cn.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\1000014001\joffer2.exe
"C:\Users\Admin\AppData\Local\Temp\1000014001\joffer2.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2756

C:\Users\Admin\AppData\Local\Temp\service123.exe
"C:\Users\Admin\AppData\Local\Temp\service123.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4080

C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3528

C:\Users\Admin\AppData\Local\Temp\service123.exe
"C:\Users\Admin\AppData\Local\Temp\service123.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4784

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\svchost015.exe
C:\Users\Admin\AppData\Local\Temp\svchost015.exe
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4020

C:\Users\Admin\1000238002\Amadeus.exe
"C:\Users\Admin\1000238002\Amadeus.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4212

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
4⤵
- System Location Discovery: System Language Discovery
PID:4988

C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe
"C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- System Location Discovery: System Language Discovery
PID:744

C:\Users\Admin\AppData\Local\Temp\1000290001\key.exe
"C:\Users\Admin\AppData\Local\Temp\1000290001\key.exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 400
6⤵
- Program crash
PID:4608

C:\Users\Admin\AppData\Local\Temp\1000291001\[t].exe
"C:\Users\Admin\AppData\Local\Temp\1000291001\[t].exe"
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000294021\loli600.cmd" "
5⤵
- System Location Discovery: System Language Discovery
PID:4472

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
4⤵
PID:4840

C:\Windows\system32\schtasks.exe
schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
5⤵
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:952

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:568

C:\Users\Admin\Pictures\Lighter Tech\runtime.exe
"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" && schtasks /Create /SC MINUTE /MO 1 /TN "runtime" /TR "C:\Users\Admin\Pictures\Lighter Tech\runtime.exe" /F
2⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1188 -ip 1188
1⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:544

C:\Users\Admin\Pictures\Lighter Tech\runtime.exe
"C:\Users\Admin\Pictures\Lighter Tech\runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Users\Admin\AppData\Local\Temp\service123.exe
C:\Users\Admin\AppData\Local\Temp\/service123.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3416

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\1000238002\Amadeus.exe

Filesize
5.3MB

MD5
36a627b26fae167e6009b4950ff15805

SHA1
f3cb255ab3a524ee05c8bab7b4c01c202906b801

SHA256
a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

SHA512
2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

Filesize
313KB

MD5
2d647cf43622ed10b6d733bb5f048fc3

SHA1
6b9c5f77a9ef064a23e5018178f982570cbc64c6

SHA256
41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6

SHA512
62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

Filesize
1.1MB

MD5
8e74497aff3b9d2ddb7e7f819dfc69ba

SHA1
1d18154c206083ead2d30995ce2847cbeb6cdbc1

SHA256
d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

SHA512
9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000014001\joffer2.exe

Filesize
6.3MB

MD5
02b6cc4e6dd52253da1f1d38bbe8552f

SHA1
be4c1d603658f68b70ab0bbe0c9921553c363e0f

SHA256
bb39374ea48fca528733c580e033fb0709e5cd25d07092384bac8e72ce9da5ce

SHA512
a23b655798ccd9fa3cef04049c141271b095d0e586bcc2413baae3f95fd89341141aaf1c0b5ff9d578cb5708752fbd12be92866ed31b8c4c1cf11dbe9708a499

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
187KB

MD5
7a02aa17200aeac25a375f290a4b4c95

SHA1
7cc94ca64268a9a9451fb6b682be42374afc22fd

SHA256
836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

SHA512
f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000129001\Set-up.exe

Filesize
6.4MB

MD5
b130f5863d097c46f4a6a1e4b1846ca7

SHA1
66d042ce664842d62b56a725417c3711cf6529b3

SHA256
c047c92ca41073b9176a7d46192040dc434f7f16141af6451c6c004e6b78f9df

SHA512
8af69508ff4d3033e83c78ecf583a9dc34ede2bd715aaec9c00f0191003397270b580c65bfdd22db6bdad01229e000f6fc0d91c27b9f57ff29c1bcd3486b3315

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

Filesize
3.6MB

MD5
7e6a519688246fe1180f35fe0d25d370

SHA1
8e8719ac897dfef7305311dc216f570af40709af

SHA256
32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a

SHA512
a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000243001\runtime.exe

Filesize
44KB

MD5
b73cf29c0ea647c353e4771f0697c41f

SHA1
3e5339b80dcfbdc80d946fc630c657654ef58de7

SHA256
edd76f144bbdbfc060f7cb7e19863f89eb55863efc1a913561d812083b6306cd

SHA512
2274d4c1e0ef72dc7e73b977e315ddd5472ec35a52e3449b1f6b87336ee18ff8966fed0451d19d24293fde101e0c231a3caa08b7bd0047a18a41466c2525e2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

Filesize
552KB

MD5
03cf06e01384018ac325de8bc160b4b2

SHA1
1853505e502b392fd556a9ce6050207230cc70cd

SHA256
5ab3785b2b72eaf7edff8961eb8ff8dd3dc6cc7031bc96ceb06a899b6fb3bbbc

SHA512
be1f2cf898db93e96e8817bf2d0ab0ef0f49d5bba4efba2de4046f6b381e8eda6ff5fcfdc057b6cbc4de5b3a7b096612c1e0d6b0d395ee685b3844ba5dc0e1b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000289001\cha.exe

Filesize
301B

MD5
80e238aaf61301785fac44e9e7e21fb3

SHA1
a91d7a47b22219a33eec684cb11711fcfa9d2cab

SHA256
23eb00fc9d25042dec9a2456623a4f19c282d878ece26d4a31a732d6d76eb234

SHA512
af69d12f2d7c03ddd4c5a3b203b017ebc8e90cbdcfdc133cc789e1def1bd82ed5e7d582b5529d00e19d9298e398a15ec7180b1b4c540ff34ba87df51da104db9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000290001\key.exe

Filesize
2.3MB

MD5
4cdc368d9d4685c5800293f68703c3d0

SHA1
14ef59b435d63ee5fdabfb1016663a364e3a54da

SHA256
12fb50931a167e6e00e3eb430f6a8406e80a7649f14b1265247b56416ac919b0

SHA512
c8f9d2ba84603384b084f562c731609f9b7006237f2c58b5db9efdfc456932b23e2582f98fb1eb87e28363dc8d9ae4c0a950c9482685bb22604c66a1e6d611de

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000291001\[t].exe

Filesize
29KB

MD5
bb11aebb921c65e72e7bf5c16039fcfc

SHA1
1aaa2ae8dfc879a7d22a3ddd90fdffcfa762cf75

SHA256
9f949f62466767ca9af8a1b6e4055fcd474da5dfeb797db85b32ecbf7d807232

SHA512
be4cc82db4d0c0ddb6fd385cd6e6a385d666fa622d76aaf5a3dc6b5aa70f4cc31d08d1024184c18c5fe0fd5690773e9b4266bef00be2c7aa67f3994ccea7c220

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000294021\loli600.cmd

Filesize
6KB

MD5
307dca9c775906b8de45869cabe98fcd

SHA1
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1

SHA256
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

SHA512
80c03f7add3a33a5df7b1f1665253283550dac484d26339ecd85672fb506dce44bd0bf96275d5c41a2e7369c3b604de377b7f5985d7d0d76c7ac663d60a67a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\227988167281

Filesize
84KB

MD5
c56d6b48158f3a6d9bbe52f43b49e377

SHA1
84c2ecddec4f4fe8dc402577d96b84cc0d03bf0d

SHA256
f383fe232a9198f67ae6eaaf23653c7fa3ba8c72b241bd5684309660dd43d51e

SHA512
ce3e37b89cb6252c44ab5aa34c65386a1dad6e73565ec0a001405bd82d2b56457c54893ea70cfc4999534d25316aaeb435f5ebe944607865ef14ad445357c54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.9MB

MD5
26cdd93ab5aa02332cd33c0282beba9f

SHA1
dbe088a6a212f0bb38b01a4ba7e1b4d1e2d06438

SHA256
de925d19eb1ca5e3e5d3f222265357523f91b859a5ae30087bc588bcbcf0bdab

SHA512
a8e45e60e2a4ad0ed0b8f7462f5a6abe3a7ab8a58be9762acb849adc16d09af47b7206aa4d096192a673c3e570d45c2d55853b1453b114102d51b7b753382955

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpB90F.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\service123.exe

Filesize
300.0MB

MD5
339b96a2734577b5adc027d5d3bf8082

SHA1
f3b768f0fb4b61d3fb32a9ee2af7d2ba764b86d6

SHA256
5c328bad8d9070e8b8d5cc824277ab558b5a913763ebf195ef5ea3f41811882f

SHA512
4690cb6b7d6a413317705077df211831282de635d2d16748fb4d69cd7b8dd7b71ab6294c4f58ca1532a6a741674efdec14a67e1b319436afd9c2d74bd829f41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Roaming\2XFdKhB9cn.exe

Filesize
304KB

MD5
30f46f4476cdc27691c7fdad1c255037

SHA1
b53415af5d01f8500881c06867a49a5825172e36

SHA256
3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

SHA512
271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2227988167-2813779459-4240799794-1000\76b53b3ec448f7ccdda2063b15d2bfc3_3fe5095b-7a1d-4ea8-add0-943af5792bdf

Filesize
2KB

MD5
2c989118497f4328131a5bc5a585a6bd

SHA1
2f826ee5c3f0f93b9007348574f74db07502491a

SHA256
73ee5926ee463eebb8ce8b33b102caa8b3f31233ec69b9759a61eb8f87e2a07a

SHA512
a7185ee9f85ac4809cf7d9a13f921dff7ed0c344279a8d31a51b983c5940d1af6df0f1533e1572c2641609d48e4e2e8c7ec2f1fe2ac5477f09ef8503749b9b48

Download Submit
C:\Users\Admin\AppData\Roaming\OGnF4slEZu.exe

Filesize
544KB

MD5
88367533c12315805c059e688e7cdfe9

SHA1
64a107adcbac381c10bd9c5271c2087b7aa369ec

SHA256
c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

SHA512
7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
277d0b69ba644ae96d5f740c807b0574

SHA1
b70c38b58620ba5b9926643b7fa72d995d446e6e

SHA256
0a109b0c128b3c6a61aa8f0393f387a49fbb2b76b37573282c34e5a7e7da3228

SHA512
71723dd92f3b73c58e2afd6c952b86b053d89eff8604d1da947223dfa2f19b00fa2875ace2ecb256d698583574820a24c774ea2e48286fe87267bbd8356afe16

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
c096493fbb002c8f310fddb6153f4ad1

SHA1
2e02987aee3e6c359e6a80af4f4723e4e29d4fdf

SHA256
34cd0fc1052c96af5cd3f664a63121188e3105eb591ce35f4215d0db70ca5265

SHA512
13df4e6c8b6591266e0f4dfe03205aecdb64378396928caede64174a819a53394991a08326b8936603a5d55d752bcb71af48b1972682980950a2f816539ec4d3

Download Submit
memory/544-566-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/544-563-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/568-443-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/568-446-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/744-394-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/744-396-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/744-393-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1740-122-0x0000000000E20000-0x0000000000EAE000-memory.dmp

Filesize
568KB

Download
memory/1740-188-0x0000000008A00000-0x0000000008A66000-memory.dmp

Filesize
408KB

Download
memory/2080-121-0x0000000000C20000-0x0000000000C72000-memory.dmp

Filesize
328KB

Download
memory/2636-380-0x0000000000600000-0x0000000000690000-memory.dmp

Filesize
576KB

Download
memory/2636-385-0x00000000082C0000-0x000000000830C000-memory.dmp

Filesize
304KB

Download
memory/2724-193-0x00000000097C0000-0x0000000009810000-memory.dmp

Filesize
320KB

Download
memory/2724-68-0x0000000008A20000-0x0000000008B2A000-memory.dmp

Filesize
1.0MB

Download
memory/2724-70-0x00000000071F0000-0x000000000722C000-memory.dmp

Filesize
240KB

Download
memory/2724-47-0x00000000055F0000-0x0000000005682000-memory.dmp

Filesize
584KB

Download
memory/2724-44-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2724-48-0x0000000005780000-0x000000000578A000-memory.dmp

Filesize
40KB

Download
memory/2724-63-0x0000000006230000-0x00000000062A6000-memory.dmp

Filesize
472KB

Download
memory/2724-191-0x00000000098A0000-0x0000000009A62000-memory.dmp

Filesize
1.8MB

Download
memory/2724-192-0x0000000009FA0000-0x000000000A4CC000-memory.dmp

Filesize
5.2MB

Download
memory/2724-46-0x0000000005B00000-0x00000000060A6000-memory.dmp

Filesize
5.6MB

Download
memory/2724-64-0x00000000068D0000-0x00000000068EE000-memory.dmp

Filesize
120KB

Download
memory/2724-67-0x0000000007260000-0x0000000007878000-memory.dmp

Filesize
6.1MB

Download
memory/2724-69-0x0000000007190000-0x00000000071A2000-memory.dmp

Filesize
72KB

Download
memory/2724-71-0x0000000008B30000-0x0000000008B7C000-memory.dmp

Filesize
304KB

Download
memory/2752-90-0x0000000000B70000-0x0000000000C82000-memory.dmp

Filesize
1.1MB

Download
memory/2756-429-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/2756-382-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/2756-398-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/2960-428-0x0000000000D00000-0x0000000000D11000-memory.dmp

Filesize
68KB

Download
memory/3020-456-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3068-449-0x0000000000D00000-0x0000000000D11000-memory.dmp

Filesize
68KB

Download
memory/3236-42-0x0000000000690000-0x00000000006E4000-memory.dmp

Filesize
336KB

Download
memory/3236-41-0x000000007346E000-0x000000007346F000-memory.dmp

Filesize
4KB

Download
memory/3484-387-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/3484-384-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/3528-425-0x0000000000400000-0x000000000106C000-memory.dmp

Filesize
12.4MB

Download
memory/3528-381-0x0000000000400000-0x000000000106C000-memory.dmp

Filesize
12.4MB

Download
memory/3528-397-0x0000000000400000-0x000000000106C000-memory.dmp

Filesize
12.4MB

Download
memory/3576-392-0x000000001BAE0000-0x000000001BB50000-memory.dmp

Filesize
448KB

Download
memory/3576-391-0x000000001AE80000-0x000000001AF04000-memory.dmp

Filesize
528KB

Download
memory/3576-360-0x0000000000230000-0x0000000000242000-memory.dmp

Filesize
72KB

Download
memory/3972-322-0x0000000000400000-0x000000000079D000-memory.dmp

Filesize
3.6MB

Download
memory/4020-317-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4020-320-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4020-321-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4020-323-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4080-314-0x0000000000740000-0x0000000000983000-memory.dmp

Filesize
2.3MB

Download
memory/4080-182-0x0000000000740000-0x0000000000983000-memory.dmp

Filesize
2.3MB

Download
memory/4080-194-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4560-2-0x0000000000741000-0x000000000076F000-memory.dmp

Filesize
184KB

Download
memory/4560-3-0x0000000000740000-0x0000000000C16000-memory.dmp

Filesize
4.8MB

Download
memory/4560-0-0x0000000000740000-0x0000000000C16000-memory.dmp

Filesize
4.8MB

Download
memory/4560-4-0x0000000000740000-0x0000000000C16000-memory.dmp

Filesize
4.8MB

Download
memory/4560-1-0x0000000077AA6000-0x0000000077AA8000-memory.dmp

Filesize
8KB

Download
memory/4560-17-0x0000000000740000-0x0000000000C16000-memory.dmp

Filesize
4.8MB

Download
memory/4732-412-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-18-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-361-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-227-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-390-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-430-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-187-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-453-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-435-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-438-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-441-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-20-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-19-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4732-184-0x00000000005F0000-0x0000000000AC6000-memory.dmp

Filesize
4.8MB

Download
memory/4784-433-0x0000000000D00000-0x0000000000D11000-memory.dmp

Filesize
68KB

Download
memory/4784-434-0x0000000073620000-0x000000007375C000-memory.dmp

Filesize
1.2MB

Download
memory/4972-96-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4972-118-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4972-97-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4972-92-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4972-94-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4988-404-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5008-454-0x000000001BA70000-0x000000001BC23000-memory.dmp

Filesize
1.7MB

Download