Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 15:38
Static task
static1
Behavioral task
behavioral1
Sample
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe
Resource
win10v2004-20240802-en
General
-
Target
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe
-
Size
1.8MB
-
MD5
7a41f381dbc09e0ef8941739b28344e1
-
SHA1
b7c3534d9b056c6ee54e1fa5a0ee75fd53e10b72
-
SHA256
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
-
SHA512
325fd9567135ed23313f4de3cdf732acc429f027c65a277e07724e205a5a665494a427ab43d5b6622887476d8203cf68b609bbbca7a79293d649367e8f9cb6db
-
SSDEEP
24576:jw3P1kZ6wNEOrA8NHtjAvoPqyxxSHMfOrU6Ak+gX5HmeFmL3qKKGL7ABx0M+2naP:c3tkZ/LNHtbkUqRJ63hKQ2naoEX
Malware Config
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
LiveTraffic
95.179.250.45:26212
Extracted
redline
@CLOUDYTTEAM
65.21.18.51:45580
Extracted
stealc
default2
http://185.215.113.17
-
url_path
/2fb6c2cc8dce150a.php
Extracted
stealc
default
http://91.202.233.158
-
url_path
/e96ea2db21fa9a1b.php
Extracted
cryptbot
fivev5sb.top
-
url_path
/v1/upload.php
Extracted
redline
bundle
185.215.113.67:15206
Extracted
lumma
https://femininedspzmhu.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2528-45-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Roaming\LEql6p9zAD.exe family_redline behavioral2/memory/3324-136-0x0000000000A60000-0x0000000000AB2000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe family_redline behavioral2/memory/3140-370-0x0000000000220000-0x0000000000272000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
Processes:
RMS1.exedescription pid process target process PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE PID 1476 created 3496 1476 RMS1.exe Explorer.EXE -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
Processes:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeaxplong.exeaxplong.exeaxplong.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
axplong.exeaxplong.exe585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeaxplong.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
axplong.exeRegAsm.exeNework.exeSеtup.exebundle.exefilen8ame.exe585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation axplong.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Nework.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Sеtup.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation bundle.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation filen8ame.exe Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe -
Executes dropped EXE 24 IoCs
Processes:
axplong.exegold.execrypteda.exe95IKSfF3kv.exeLEql6p9zAD.exeNework.exeHkbsse.exestealc_default2.exeHkbsse.exeaxplong.exeSеtup.exeneedmoney.exesvchost015.exepenis.exebundle.exeacentric.exeRMS1.exeservice123.exeaxplong.exeHkbsse.exefilen8ame.exeservice123.exeAssociates.pifAssociates.pifpid process 2444 axplong.exe 2536 gold.exe 5000 crypteda.exe 4264 95IKSfF3kv.exe 3324 LEql6p9zAD.exe 4860 Nework.exe 2220 Hkbsse.exe 1940 stealc_default2.exe 1384 Hkbsse.exe 960 axplong.exe 1540 Sеtup.exe 3736 needmoney.exe 2020 svchost015.exe 1000 penis.exe 3140 bundle.exe 740 acentric.exe 1476 RMS1.exe 4860 service123.exe 4964 axplong.exe 2232 Hkbsse.exe 1556 filen8ame.exe 5984 service123.exe 5552 Associates.pif 5876 Associates.pif -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeaxplong.exeaxplong.exeaxplong.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Wine axplong.exe -
Loads dropped DLL 4 IoCs
Processes:
stealc_default2.exeservice123.exeservice123.exepid process 1940 stealc_default2.exe 1940 stealc_default2.exe 4860 service123.exe 5984 service123.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
acentric.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update" acentric.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 4276 tasklist.exe 5264 tasklist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeaxplong.exeaxplong.exeaxplong.exepid process 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe 2444 axplong.exe 960 axplong.exe 4964 axplong.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
gold.execrypteda.exeneedmoney.exeacentric.exeRMS1.exeAssociates.pifdescription pid process target process PID 2536 set thread context of 2528 2536 gold.exe RegAsm.exe PID 5000 set thread context of 2748 5000 crypteda.exe RegAsm.exe PID 3736 set thread context of 2020 3736 needmoney.exe svchost015.exe PID 740 set thread context of 5140 740 acentric.exe Explorer.exe PID 1476 set thread context of 5512 1476 RMS1.exe InstallUtil.exe PID 5552 set thread context of 5876 5552 Associates.pif Associates.pif -
Drops file in Windows directory 7 IoCs
Processes:
filen8ame.exe585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeNework.exedescription ioc process File opened for modification C:\Windows\ChipsCounted filen8ame.exe File opened for modification C:\Windows\MaximizeRepresentative filen8ame.exe File opened for modification C:\Windows\ChristmasHerbal filen8ame.exe File opened for modification C:\Windows\LadySquare filen8ame.exe File opened for modification C:\Windows\PrerequisiteCents filen8ame.exe File created C:\Windows\Tasks\axplong.job 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe File created C:\Windows\Tasks\Hkbsse.job Nework.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
svchost015.exefilen8ame.exe585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeNework.exeHkbsse.exetasklist.exeaxplong.exeExplorer.exeschtasks.execmd.exeRegAsm.exe95IKSfF3kv.exeservice123.execmd.exeRegAsm.exepenis.exeacentric.execmd.exefindstr.exetasklist.exegold.exeLEql6p9zAD.exeAssociates.pifcrypteda.exefindstr.exeneedmoney.exeSеtup.exebundle.exefindstr.exechoice.exeAssociates.pifstealc_default2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost015.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language filen8ame.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hkbsse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95IKSfF3kv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language penis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acentric.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gold.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEql6p9zAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Associates.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language needmoney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sеtup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bundle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Associates.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stealc_default2.exe -
Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
stealc_default2.exepenis.exeSеtup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 stealc_default2.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz penis.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz penis.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet penis.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier penis.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Sеtup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Sеtup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString stealc_default2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 penis.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier penis.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information penis.exe -
Processes:
RegAsm.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeaxplong.exeRegAsm.exe95IKSfF3kv.exestealc_default2.exeLEql6p9zAD.exeaxplong.exebundle.exeRMS1.exepowershell.exeaxplong.exeAssociates.pifpid process 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe 2444 axplong.exe 2444 axplong.exe 2528 RegAsm.exe 2528 RegAsm.exe 2528 RegAsm.exe 2528 RegAsm.exe 2528 RegAsm.exe 4264 95IKSfF3kv.exe 4264 95IKSfF3kv.exe 1940 stealc_default2.exe 1940 stealc_default2.exe 3324 LEql6p9zAD.exe 3324 LEql6p9zAD.exe 3324 LEql6p9zAD.exe 3324 LEql6p9zAD.exe 3324 LEql6p9zAD.exe 960 axplong.exe 960 axplong.exe 1940 stealc_default2.exe 1940 stealc_default2.exe 3140 bundle.exe 3140 bundle.exe 3140 bundle.exe 3140 bundle.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 1476 RMS1.exe 5556 powershell.exe 5556 powershell.exe 3140 bundle.exe 4964 axplong.exe 4964 axplong.exe 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
RegAsm.exe95IKSfF3kv.exeLEql6p9zAD.exeRMS1.exeacentric.exepowershell.exebundle.exetasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 2528 RegAsm.exe Token: SeDebugPrivilege 4264 95IKSfF3kv.exe Token: SeBackupPrivilege 4264 95IKSfF3kv.exe Token: SeSecurityPrivilege 4264 95IKSfF3kv.exe Token: SeSecurityPrivilege 4264 95IKSfF3kv.exe Token: SeSecurityPrivilege 4264 95IKSfF3kv.exe Token: SeSecurityPrivilege 4264 95IKSfF3kv.exe Token: SeDebugPrivilege 3324 LEql6p9zAD.exe Token: SeDebugPrivilege 1476 RMS1.exe Token: SeDebugPrivilege 740 acentric.exe Token: SeDebugPrivilege 1476 RMS1.exe Token: SeDebugPrivilege 5556 powershell.exe Token: SeDebugPrivilege 3140 bundle.exe Token: SeDebugPrivilege 4276 tasklist.exe Token: SeDebugPrivilege 5264 tasklist.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeAssociates.pifpid process 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Associates.pifpid process 5552 Associates.pif 5552 Associates.pif 5552 Associates.pif -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exeaxplong.exegold.execrypteda.exeRegAsm.exeNework.exeneedmoney.exedescription pid process target process PID 4884 wrote to memory of 2444 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe axplong.exe PID 4884 wrote to memory of 2444 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe axplong.exe PID 4884 wrote to memory of 2444 4884 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe axplong.exe PID 2444 wrote to memory of 2536 2444 axplong.exe gold.exe PID 2444 wrote to memory of 2536 2444 axplong.exe gold.exe PID 2444 wrote to memory of 2536 2444 axplong.exe gold.exe PID 2536 wrote to memory of 3572 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 3572 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 3572 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 3064 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 3064 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 3064 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2536 wrote to memory of 2528 2536 gold.exe RegAsm.exe PID 2444 wrote to memory of 5000 2444 axplong.exe crypteda.exe PID 2444 wrote to memory of 5000 2444 axplong.exe crypteda.exe PID 2444 wrote to memory of 5000 2444 axplong.exe crypteda.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 5000 wrote to memory of 2748 5000 crypteda.exe RegAsm.exe PID 2748 wrote to memory of 4264 2748 RegAsm.exe 95IKSfF3kv.exe PID 2748 wrote to memory of 4264 2748 RegAsm.exe 95IKSfF3kv.exe PID 2748 wrote to memory of 4264 2748 RegAsm.exe 95IKSfF3kv.exe PID 2748 wrote to memory of 3324 2748 RegAsm.exe LEql6p9zAD.exe PID 2748 wrote to memory of 3324 2748 RegAsm.exe LEql6p9zAD.exe PID 2748 wrote to memory of 3324 2748 RegAsm.exe LEql6p9zAD.exe PID 2444 wrote to memory of 4860 2444 axplong.exe Nework.exe PID 2444 wrote to memory of 4860 2444 axplong.exe Nework.exe PID 2444 wrote to memory of 4860 2444 axplong.exe Nework.exe PID 4860 wrote to memory of 2220 4860 Nework.exe Hkbsse.exe PID 4860 wrote to memory of 2220 4860 Nework.exe Hkbsse.exe PID 4860 wrote to memory of 2220 4860 Nework.exe Hkbsse.exe PID 2444 wrote to memory of 1940 2444 axplong.exe stealc_default2.exe PID 2444 wrote to memory of 1940 2444 axplong.exe stealc_default2.exe PID 2444 wrote to memory of 1940 2444 axplong.exe stealc_default2.exe PID 2444 wrote to memory of 1540 2444 axplong.exe Sеtup.exe PID 2444 wrote to memory of 1540 2444 axplong.exe Sеtup.exe PID 2444 wrote to memory of 1540 2444 axplong.exe Sеtup.exe PID 2444 wrote to memory of 3736 2444 axplong.exe needmoney.exe PID 2444 wrote to memory of 3736 2444 axplong.exe needmoney.exe PID 2444 wrote to memory of 3736 2444 axplong.exe needmoney.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 3736 wrote to memory of 2020 3736 needmoney.exe svchost015.exe PID 2444 wrote to memory of 1000 2444 axplong.exe penis.exe PID 2444 wrote to memory of 1000 2444 axplong.exe penis.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe"C:\Users\Admin\AppData\Local\Temp\585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵PID:3572
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵PID:3064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Roaming\95IKSfF3kv.exe"C:\Users\Admin\AppData\Roaming\95IKSfF3kv.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264 -
C:\Users\Admin\AppData\Roaming\LEql6p9zAD.exe"C:\Users\Admin\AppData\Roaming\LEql6p9zAD.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\filen8ame.exe"C:\Users\Admin\AppData\Local\Temp\filen8ame.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Investigations Investigations.bat & Investigations.bat & exit6⤵
- System Location Discovery: System Language Discovery
PID:6072 -
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa opssvc"7⤵
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5264 -
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"7⤵
- System Location Discovery: System Language Discovery
PID:5256 -
C:\Windows\SysWOW64\cmd.execmd /c md 5908197⤵
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Windows\SysWOW64\findstr.exefindstr /V "MEDICAIDGROUPSSHARPGOVERNOR" Novels7⤵
- System Location Discovery: System Language Discovery
PID:5400 -
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Sheet + ..\Drums + ..\Actually + ..\Mls + ..\Real + ..\Zoophilia + ..\Ah + ..\Opposed + ..\Affiliated y7⤵
- System Location Discovery: System Language Discovery
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\590819\Associates.pifAssociates.pif y7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\590819\Associates.pifC:\Users\Admin\AppData\Local\Temp\590819\Associates.pif8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5876 -
C:\Windows\SysWOW64\choice.exechoice /d y /t 57⤵
- System Location Discovery: System Language Discovery
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:740 -
C:\Windows\SysWOW64\Explorer.exe"C:\Windows\SysWOW64\Explorer.exe"5⤵
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5556 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5388
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5404
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5424
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5440
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5456
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5472
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5496
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:1384
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:960
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe1⤵
- Executes dropped EXE
PID:2232
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5984
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
313KB
MD52d647cf43622ed10b6d733bb5f048fc3
SHA16b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA25641426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA51262400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a
-
Filesize
1.1MB
MD58e74497aff3b9d2ddb7e7f819dfc69ba
SHA11d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA5129aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97
-
Filesize
416KB
MD5f5d7b79ee6b6da6b50e536030bcc3b59
SHA1751b555a8eede96d55395290f60adc43b28ba5e2
SHA2562f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
-
Filesize
187KB
MD57a02aa17200aeac25a375f290a4b4c95
SHA17cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
-
Filesize
6.3MB
MD545b55d1e5d2bf60cc572f541ae6fa7d1
SHA12329f56147a299bcdbf20520e626cc8253e49a8d
SHA256039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8
SHA5125483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2
-
Filesize
3.6MB
MD57e6a519688246fe1180f35fe0d25d370
SHA18e8719ac897dfef7305311dc216f570af40709af
SHA25632a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972
-
Filesize
3.5MB
MD50faa6e1a78e6bb809eb5a7cdcdf68e17
SHA1f1ba39e702710365c345ab034bcd1a6d5ec8d4ad
SHA2569d6966889f6ec503ae2bd99c666b55429d1835e538e1ac15f06c3524241c0c92
SHA512261cd43b42ccbe7b6b393d454270dd22110c062632707f73bf045f91aee0f09b4387cac8ba7a9275b1ddaa427240606f654f74224fe6fcd38c8ae40b3c4f8ee7
-
Filesize
304KB
MD530daa686c1f31cc4833bd3d7283d8cdc
SHA170f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA5129f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9
-
Filesize
454KB
MD537d198ad751d31a71acc9cb28ed0c64e
SHA18eb519b7a6df66d84c566605da9a0946717a921d
SHA2561ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA51260923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96
-
Filesize
1.4MB
MD503b1ed4c105e5f473357dad1df17cf98
SHA1faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA2566be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA5123f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765
-
Filesize
83KB
MD5957fd61147fd15349458e21ee2700e56
SHA12127f7fab30456329c5830c8ee6bf099d34030db
SHA25622204154216d96b687c364b9ca7475847963619616b95fdca6b024a3e8235c0f
SHA512bdf12ea9018d4f3a0633362fd262b9c9553cec09aa183974dc0bd9a699c02e717a58a7fdc303de44edbdd774f69c4e709fe29eecf56d1d62331d5ad17fe5190b
-
Filesize
1.8MB
MD57a41f381dbc09e0ef8941739b28344e1
SHA1b7c3534d9b056c6ee54e1fa5a0ee75fd53e10b72
SHA256585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
SHA512325fd9567135ed23313f4de3cdf732acc429f027c65a277e07724e205a5a665494a427ab43d5b6622887476d8203cf68b609bbbca7a79293d649367e8f9cb6db
-
Filesize
872KB
MD518ce19b57f43ce0a5af149c96aecc685
SHA11bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA256d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
SHA512a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
-
Filesize
647KB
MD50e69e7ffa036b111a3714e8ba7de2503
SHA167f7153234105690f026d671091774e04d34c351
SHA2567411e4d7b5ee7e09d6d8f41b6c58d557b39724cda3367614d49dbaf77ff89d47
SHA512a16a095735f978f9fa41060bca6cbd3331edb7612ea671497fa9ad950ee5e438aeeb1c96ffbd9cd7b4c22d3bb33b6f60d911c30997932b8310e0995a48fc7270
-
Filesize
82KB
MD5f5218581f47d5d88efb244c2528e9388
SHA12c925494f15dd8854b0ff25292e64dba075afc8a
SHA256446596953913b5ff8e1f4909cdd68e4740a21948b8da28b2223abd731f38f3cf
SHA51216f7b5fb8dfb306be93036697ad4b18679b6bdcf9b936e3b4ede15c39a80901a2244b7854c9beeab0a8cf25df2c106d127d8977523b54140ac75a241e823720a
-
Filesize
13KB
MD55a4bb3b58f5344ea0b6ac99794a1a409
SHA1956ac766f4faf5a8fe38b2fa11fd64832b588ea6
SHA2563f6a1e674de512477ff87efaa39a6d0158f1a394da442018f2cae16499a67164
SHA51206460ab54d087095ae5c925f5826aaf23a1012a0dad8ff50615ab9d7bc3851aa794d826d883269717484aac4686f0263c284c27986e5440eaae2c371afa76561
-
Filesize
78KB
MD5fdec53e5fc2b73fc6f3f2cebc7e7d581
SHA132be33cddaf6888589e6f579ba74553e682cb05d
SHA2562c846b30ded9be840eb62fe5f6ee78a715bbb27c8c5f13cf7ce7526fd8505278
SHA512373b289677a94955293f0a6cdfcea1c45f11034c939e5e8eee4a4e28cc3e3e12a5eff9e9d1fa1360e3e2ffd9b452428f3b62621133a3eb7386437840c1c9efd2
-
Filesize
87KB
MD5eddfe1bd56d718737082e26b663c5344
SHA119751b4253e62d8995fbf7c16686aa9a78045091
SHA25606969d045e1dedd05bf352e08e66d6b72faca7b0d6cb7a20e3a815b04aec4794
SHA512d6b8dc233eca6cd4dd8ecda267e80096e152840acd4e47ea8ab0c081fa37e17ad4aa507882aee7bb8e70000fdb46905726243e14d02987440386c1fcd9c3d8db
-
Filesize
21KB
MD5993e7c77985a64987f81795903f4ec4e
SHA19daf8b58d2aea92416b4b26d4a8c644bff2c1073
SHA25618aedca1669442af85f543f052feef6b2d70ee3f191f391930c053d1476cda76
SHA51226d2518beb0716227cacb6e5f89643b3a8ea7a095dbe741873e274fbb18de4da335dc99ca01951a7db448e5ddc29c85af895ec57f9378cec9851815648d83a5d
-
Filesize
86KB
MD5f387e0af272b3534f962510925697544
SHA12e5fddc860f180d204283ae3d8b7479a73edb7dd
SHA256076a4be5c1e943bc223adf4eb30f7543911dce2517c305af1df5f0ab012626e0
SHA5123326c69a65fc163eecf95950cfffbcca800b85c9ba99da3c921c1e54c9bd116f87302a52dade84a8af957d6182db6973e67a02359fd7c8c317c4329e511ec3e9
-
Filesize
510B
MD5fe6b3945c0591e11b27ce50ae5aa2ae5
SHA142eb0951d03f96f1be9dfd7fd3c76366c7dee311
SHA2562dd13bc773aee2738563910e316684b0cf646991fd67581dd4e129a525153af0
SHA512adff777db68feed90a6c5de04abf23e2b17f4b0bc9fd0e99cf10773ad159cf4e3cfc82f1bba9799c8e73dea613d392261e8c8be46174d0ce51672492eb6ad3f4
-
Filesize
89KB
MD579e8c0f3c8585392970467fba71bdc5c
SHA143871ae11904c036fd72e5452274b6dd33e6e4ce
SHA256c8497414d50438b6eeace3a0402f01e7d8583415daee5466f3f46ac82e55c27f
SHA512c9b52232b1b416e2d1fc9a2cc28089748f1f27fdd06bd441e1434f665d8422c6161d5fc4148ce3edb20a6106eace041eb819fe2b962fc7411e03994549b27816
-
Filesize
74KB
MD5000b4fa86996cb0beda88a400f07f96f
SHA130167f5da3bfb8f99973e347f5548325c8821954
SHA2562be9420210278b027501f7edb4e8356b00550eb01d94aab082b472fab08dc5c3
SHA512b483f78ae03c5fd2ec95a8599a676bde4096d710b51e486db68bb8fb3180a478b2536abac9ab54b733867705cfcac7fc16eb8d34cc519fcd6756b131fdb7183e
-
Filesize
64KB
MD5a333bb92009ef81ed7e36eb059292f7c
SHA1bd95783b66230cbbdd65668a99dbe2aaa7bf6dff
SHA2560241ad4bc5a549ba937fc9cde1cc4e8c01bc0ac59940611393bd2573649bc391
SHA5123f5cf884e21d3cdabcf3cd292cdead32d521ccc9ddefedb91f88ba89d903baaa7c89b21d0992a451e6b63a7632bdb92c3ee27adddd3c69d6e9fc97b2bf04ec9d
-
Filesize
872KB
MD502dfbccdf45d9f79a8e3b9eadc7c66d2
SHA100e7fdbb4466c86ca5dc6cf05623cccf52cce76c
SHA256ca236e42a79212c9fcab28217df569fc8d3875ef81e206e869b92525d9ede547
SHA512dc5d3fcc04b1d2b8fad3bd824b899f9a58bed18a708cb3df70c0822ae493dc6ba6f04bd3b57e049e749ea64c21fcd7f78c75b1c6330f0cdde6f70d7b1beb5df0
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
74KB
MD5bbb3a963db3a77c65e1419c6bb3c9992
SHA11fee713d2465910ae9740bfea48a471984ba0b54
SHA2561a4c358cb704b6d3960e9af1dce1b87aa69e41ce590f1477f5d7ef9dd8ddeeec
SHA512980e8898090779eeb14a27af28239656b219e2ef50275914d98757c368c5878b0bfe5ffa0b102f67fdeecfb618cd857566c67c392eb09538db492e9c5dd738a3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.4MB
MD50885bc5d9c2aa1895ebd5fcad13b53be
SHA1ad559563e4e21cb7354a4692b31852839b0b22d7
SHA256b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25
SHA51291c73e9a3a74624dad400c0c5b7670b977946a06344782ca859be70578e64c2f0d4fdb3eadb70821168c64929a8bfe16a18fb10ba65bcd80e14701ef8c05091f
-
Filesize
2.9MB
MD5b826dd92d78ea2526e465a34324ebeea
SHA1bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA2567824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA5121ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
-
Filesize
544KB
MD588367533c12315805c059e688e7cdfe9
SHA164a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA5127a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714
-
Filesize
304KB
MD530f46f4476cdc27691c7fdad1c255037
SHA1b53415af5d01f8500881c06867a49a5825172e36
SHA2563a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f
-
Filesize
2KB
MD5214c86c5bb09ce53497596fee3bfafbc
SHA1b6bf6ff1623e2007119c687f5e14a40bb29ddddf
SHA2569347e4b3cdada8ec28158151e363da7721579f67503d93965b84224f43b6ada3
SHA512eb4912e6ac6e492538c73a084ac657e7331ce6bb0da60a05dfeba31e62deed6a470adbf7ccb4d6575bd1c00946e846bbd253d892d38172e0ef4bcff299d7b08e
-
Filesize
2KB
MD551009d72444cb05fbcb8ef922ff5f972
SHA1267a957d2793962a195a7c35881d82edf3c3888f
SHA256631bbcd7284379288485627b96e167c094eea72403a07658de060e3c12e8f5a4
SHA5120c9073e5edb16329cad7ede2211f0f86f672889319acb2bf18e3e07ed409fe87a6ab6a8b62503589e303e1259a1bd9c2262d69730d2f1d60b051ea6c83e78a59