b5d0b945169391a9d4df8fa698472e0a7a6a51a25ac4f583db4e5b96e52c78cc

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe
Size

8.1MB
MD5

c097e06be926f7496a7c58896b9692a4
SHA1

8efebbfced6fd53f9d0f3850408bbdbf88c23d2b
SHA256

b5d0b945169391a9d4df8fa698472e0a7a6a51a25ac4f583db4e5b96e52c78cc
SHA512

c4ce0633aab7c017ab61d85e6e2837530bf8834ddcad5f9fdd4ecaaf20c8b2553fe08be416c460d5c746810e50b829f9bafbd46e26ab4179530458d224c40baf
SSDEEP

98304:PsMhTgTfuJENBHvu4PxMCURCAgTs7UHloh6K7jMy3MPm:kMxMuobUUI7Uw6KXMyY

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETE0DD.tmp	NPFInstall.exe
File created	C:\Windows\system32\DRIVERS\SETE0DD.tmp	NPFInstall.exe
File opened for modification	C:\Windows\system32\DRIVERS\npcap.sys	NPFInstall.exe

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0f000000010000002000000051296450c9049de88a6df397cfe6ee4eeb29020c6789c8db737b6c96bf2ad6a70300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\29BACAE898852AAB0BB9162881053B703B9D1005\Blob = 0f0000000100000014000000566fae728372e98b1bf31b9ed5047862c265e7bd03000000010000001400000029bacae898852aab0bb9162881053b703b9d10052000000001000000b3050000308205af30820497a00302010202100ea33b42058f115cf22cad9a60251ed4300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100aa3589076f387a937bee26ae239a04a893369c23e36a1b3bf1915c4ac9dcf80748ca9a0b6a2af963a4526c1afb527b4b37a22224674db8342ac54e15394063d5f840ec0e85472b177bcd221c60944aceb34dbac7c85ce5ddc0a981523119fab47e2eaaecc1d75f856fa79b2b55aba568be4ff5e35275710bd16897763ad0bd587cbf2b822590e3d650d20459e142556d6009d3b1234a122ab32ad60024f65d71a752584af79629599c243ded76a1bdb93ac85b581ee9bd467f7a027400e90c1c9c755c806b241eedb5a3cb94a4134121f9daea6c0afae47fbfc0ad48b891f373cacf9c397f181cd84279943deb897cb9e4e1ec8c6f3ff902fced48137b1d8d390203010001a38201eb308201e7301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e04160414e320dfc80193dc7de3c1497d425771b6558f3bdf30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100a8fec482a736990480bf2a0491006179c4aa937e9eb5b305f2d05c67949d46815370c03753562277ee6e15f585c7c5f4f3332d14fb8f0a4807bde866b20cea4c24d7e4e4edc18d3fc2a4fc6108f814f2386abf2bacb0ec61134325f9bc9cba80e79d9fab6cce802ce2424d38069bb48c556b82585c18c0ebd2cc77dca861e3e9e71e97d33f02d8a150c6f04a694ce4e260c5461fcc364c4d55812064c456fa2b1b86a70c412783a23c5c2e4560b0390c49a1e8d6e15fecf61e8881426cc3622165170e613a51f04a9f75c577d940d32a42cc5caad7a6817a605d55beb17a7500f21816372f135bc2b0252d92fa1cfe6a742570b0cc43ce882fc39e5341c7c069	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9\Blob = 0300000001000000140000004ce89794fe2d2f7e30121f10bcf76ac3ccf77ca92000000001000000c7050000308205c3308204aba003020102021009256314069e7e6a88cb823075c0d9c9300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100a88cd713346c50a5cd2a62900419f091330f9820b73b38785a8b5a25ceda8e11b71b2d11ff4b0c18cad405a2a195a6462619fa3ddf6d14466a350d1cf1c6ad48cce166fe6011a62ee62751046dd264b1cc145c4a4354537cec1ae615b6b8566a28ddf3b510fee92023dbe4190b44bb4174f94c4ec62256bd4aa5ba541ee833388db8cc411365e094ee6314eaff59ca6659bb6388300e7ffbd0f8b299889b8e3ea526f8ca926ded79eac89a6b068757ae428022e2602ec98babf5998216b0c28a709129a1300872878d9971e3130826a7d1ce894fe649a017003f07ee3c53ca0cba998fab097e573723fbd3e0ea1b742dd6d076b4c2284b93500021a7d27109630203010001a38201f8308201f4301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604140a9c208099309acdddf9c9909a03890dcd30c8ea30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038201010042368fc33025a2a1338cf35a08d00e263958f825e79b6d3af23e0e4e4cf59bc8502022d452cbba14a53274e3a12a5b01f4aee16abfcb1b28d63484a0ae1995c9759c6f0970254da8902fb479f5f7869a566aa285f2c28e50096dfd2e14a9ecf0000963c570d2338def108dfe66b1e44d22182826749871a7f3977eba4976910f1f0de866fc75b918c1a9f466fcf96ae90df932071b9c770f0f3193f8ca500abe52cc316549403a5ca5b5422d1ebffffc3cbe3b926de552f493b53c6570fdd0736550f080c2db204b03bc00ff724241581b5dfb0dff7b8f2cc28f136c19cca8bd4b3c3d81404e69f4598e7b5458e41c6f2e6622a212d28c2615565782a1f66987	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\29BACAE898852AAB0BB9162881053B703B9D1005\Blob = 03000000010000001400000029bacae898852aab0bb9162881053b703b9d10052000000001000000b3050000308205af30820497a00302010202100ea33b42058f115cf22cad9a60251ed4300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b446967694365727420455620436f6465205369676e696e67204341301e170d3230303530313030303030305a170d3231303530373132303030305a3081d231133011060b2b0601040182373c02010313025553311b3019060b2b0601040182373c020102130a43616c69666f726e6961311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e311530130603550405130c323030303130333130303133310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e0603550407130753656174746c6531193017060355040a1310496e7365637572652e436f6d204c4c433119301706035504031310496e7365637572652e436f6d204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100aa3589076f387a937bee26ae239a04a893369c23e36a1b3bf1915c4ac9dcf80748ca9a0b6a2af963a4526c1afb527b4b37a22224674db8342ac54e15394063d5f840ec0e85472b177bcd221c60944aceb34dbac7c85ce5ddc0a981523119fab47e2eaaecc1d75f856fa79b2b55aba568be4ff5e35275710bd16897763ad0bd587cbf2b822590e3d650d20459e142556d6009d3b1234a122ab32ad60024f65d71a752584af79629599c243ded76a1bdb93ac85b581ee9bd467f7a027400e90c1c9c755c806b241eedb5a3cb94a4134121f9daea6c0afae47fbfc0ad48b891f373cacf9c397f181cd84279943deb897cb9e4e1ec8c6f3ff902fced48137b1d8d390203010001a38201eb308201e7301f0603551d23041830168014ad690670fc801b16b3a918946b9402865ef7278c301d0603551d0e04160414e320dfc80193dc7de3c1497d425771b6558f3bdf30350603551d11042e302ca02a06082b06010505070803a01e301c0c1a55532d43414c49464f524e49412d323030303130333130303133300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e672d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010505000382010100a8fec482a736990480bf2a0491006179c4aa937e9eb5b305f2d05c67949d46815370c03753562277ee6e15f585c7c5f4f3332d14fb8f0a4807bde866b20cea4c24d7e4e4edc18d3fc2a4fc6108f814f2386abf2bacb0ec61134325f9bc9cba80e79d9fab6cce802ce2424d38069bb48c556b82585c18c0ebd2cc77dca861e3e9e71e97d33f02d8a150c6f04a694ce4e260c5461fcc364c4d55812064c456fa2b1b86a70c412783a23c5c2e4560b0390c49a1e8d6e15fecf61e8881426cc3622165170e613a51f04a9f75c577d940d32a42cc5caad7a6817a605d55beb17a7500f21816372f135bc2b0252d92fa1cfe6a742570b0cc43ce882fc39e5341c7c069	certutil.exe

Executes dropped EXE 7 IoCs

pid	Process
2348	chaospc.exe
3008	chaospcap.exe
1948	NPFInstall.exe
1292	NPFInstall.exe
2288	NPFInstall.exe
1516	NPFInstall.exe
1176	Process not Found

Loads dropped DLL 26 IoCs

pid	Process
2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe
2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe
2348	chaospc.exe
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
1356	Process not Found
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
992	Process not Found
3008	chaospcap.exe
3008	chaospcap.exe
2100	Process not Found
3008	chaospcap.exe
3008	chaospcap.exe
1512	Process not Found
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
3008	chaospcap.exe
2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe
2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2056	arp.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\SETC38D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\npcap.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\SETC39E.tmp	DrvInst.exe
File created	C:\Windows\system32\Npcap\Packet.dll	chaospcap.exe
File created	C:\Windows\system32\Npcap\wpcap.dll	chaospcap.exe
File created	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\SETC39E.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\WlanHelper.exe	chaospcap.exe
File created	C:\Windows\system32\NpcapHelper.exe	chaospcap.exe
File created	C:\Windows\system32\Npcap\WlanHelper.exe	chaospcap.exe
File created	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\SETC39F.tmp	DrvInst.exe
File created	C:\Windows\system32\Packet.dll	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\SETC39F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	NPFInstall.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	NPFInstall.exe
File created	C:\Windows\SysWOW64\wpcap.dll	chaospcap.exe
File created	C:\Windows\SysWOW64\Npcap\NpcapHelper.exe	chaospcap.exe
File created	C:\Windows\system32\wpcap.dll	chaospcap.exe
File created	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\SETC38D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}	DrvInst.exe
File created	C:\Windows\SysWOW64\Packet.dll	chaospcap.exe
File created	C:\Windows\system32\Npcap\NpcapHelper.exe	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\npcap.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\Npcap\wpcap.dll	chaospcap.exe
File created	C:\Windows\SysWOW64\WlanHelper.exe	chaospcap.exe
File created	C:\Windows\SysWOW64\Npcap\Packet.dll	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5f2a2287-0b2a-134b-9bc2-713135a67900}\NPCAP.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.PNF	DrvInst.exe
File created	C:\Windows\SysWOW64\NpcapHelper.exe	chaospcap.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\NPCAP.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	NPFInstall.exe
File created	C:\Windows\system32\WlanHelper.exe	chaospcap.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Npcap\LICENSE	chaospcap.exe
File created	C:\Program Files\Npcap\NPFInstall.exe	chaospcap.exe
File created	C:\Program Files\Npcap\npcap.inf	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\install.log	chaospcap.exe
File created	C:\Program Files\Npcap\npcap_wfp.inf	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe
File created	C:\Program Files\Npcap\DiagReport.bat	chaospcap.exe
File created	C:\Program Files\Npcap\npcap.cat	chaospcap.exe
File created	C:\Program Files\Npcap\CheckStatus.bat	chaospcap.exe
File created	C:\Program Files\Npcap\DiagReport.ps1	chaospcap.exe
File created	C:\Program Files\Npcap\FixInstall.bat	chaospcap.exe
File created	C:\Program Files\Npcap\Uninstall.exe	chaospcap.exe
File created	C:\Program Files\Npcap\npcap.sys	chaospcap.exe
File opened for modification	C:\Program Files\Npcap\NPFInstall.log	NPFInstall.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	NPFInstall.exe
File created	C:\Windows\INF\oem2.PNF	NPFInstall.exe
File created	C:\Windows\INF\oem0.PNF	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	NPFInstall.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem1.PNF	pnputil.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
2660	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	arp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chaospcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	route.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chaospc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000015d2e-2.dat	nsis_installer_2
behavioral1/files/0x0008000000015d6d-10.dat	nsis_installer_1
behavioral1/files/0x0008000000015d6d-10.dat	nsis_installer_2

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates	DrvInst.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2492	SCHTASKS.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1948	NPFInstall.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
476	Process not Found
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	NPFInstall.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	892	pnputil.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	2288	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	1516	NPFInstall.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeBackupPrivilege	1692	vssvc.exe
Token: SeRestorePrivilege	1692	vssvc.exe
Token: SeAuditPrivilege	1692	vssvc.exe
Token: SeBackupPrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	2728	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeRestorePrivilege	1048	DrvInst.exe
Token: SeLoadDriverPrivilege	1048	DrvInst.exe
Token: SeLoadDriverPrivilege	1048	DrvInst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2344	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	30
PID 2500 wrote to memory of 2344	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	30
PID 2500 wrote to memory of 2344	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	30
PID 2500 wrote to memory of 2344	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	30
PID 2500 wrote to memory of 2056	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	32
PID 2500 wrote to memory of 2056	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	32
PID 2500 wrote to memory of 2056	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	32
PID 2500 wrote to memory of 2056	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	32
PID 2500 wrote to memory of 2348	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	34
PID 2500 wrote to memory of 2348	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	34
PID 2500 wrote to memory of 2348	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	34
PID 2500 wrote to memory of 2348	2500	2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe	34
PID 2348 wrote to memory of 2660	2348	chaospc.exe	35
PID 2348 wrote to memory of 2660	2348	chaospc.exe	35
PID 2348 wrote to memory of 2660	2348	chaospc.exe	35
PID 2348 wrote to memory of 2660	2348	chaospc.exe	35
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 2348 wrote to memory of 3008	2348	chaospc.exe	37
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1948	3008	chaospcap.exe	38
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 1960	3008	chaospcap.exe	40
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 784	3008	chaospcap.exe	42
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 3008 wrote to memory of 1292	3008	chaospcap.exe	44
PID 1292 wrote to memory of 892	1292	NPFInstall.exe	46
PID 1292 wrote to memory of 892	1292	NPFInstall.exe	46
PID 1292 wrote to memory of 892	1292	NPFInstall.exe	46
PID 1292 wrote to memory of 892	1292	NPFInstall.exe	46
PID 1292 wrote to memory of 892	1292	NPFInstall.exe	46
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 2288	3008	chaospcap.exe	48
PID 3008 wrote to memory of 1516	3008	chaospcap.exe	50

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-13_c097e06be926f7496a7c58896b9692a4_hijackloader_poet-rat_snatch.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\route.exe
  route print
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\SysWOW64\arp.exe
  arp -a 10.127.0.1
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\chaospc.exe
  ./chaospc.exe chaos
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\reg.exe
    reg add " hkcu\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /t REG_SZ /v C:\Users\Admin\AppData\Local\Temp\chaospcap.exe /d RunAsInvoker
    3⤵
    - Access Token Manipulation: Create Process with Token
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\chaospcap.exe
    C:\Users\Admin\AppData\Local\Temp\chaospcap.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\NPFInstall.exe
      "C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\NPFInstall.exe" -n -check_dll
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\Insecure-EV.cer"
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:1960
  - - C:\Windows\SysWOW64\certutil.exe
      certutil -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\Insecure-EV-sha1.cer"
      4⤵
      Manipulates Digital Signatures
      System Location Discovery: System Language Discovery
      PID:784
  - - C:\Program Files\Npcap\NPFInstall.exe
      "C:\Program Files\Npcap\NPFInstall.exe" -n -c
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Windows\system32\pnputil.exe
        
        pnputil.exe -e
        5⤵
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
  - - C:\Program Files\Npcap\NPFInstall.exe
      "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Program Files\Npcap\NPFInstall.exe
      "C:\Program Files\Npcap\NPFInstall.exe" -n -i
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\SysWOW64\SCHTASKS.EXE
      SCHTASKS.EXE /Create /F /RU SYSTEM /SC ONSTART /TN npcapwatchdog /TR "'C:\Program Files\Npcap\CheckStatus.bat'" /NP
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2492
- - C:\Windows\SysWOW64\reg.exe
    reg delete "hkcu\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v C:\Users\Admin\AppData\Local\Temp\chaospcap.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{01dd6279-20d5-0d3f-1f7c-633ca163c75d}\NPCAP.inf" "9" "605306be3" "0000000000000558" "WinSta0\Default" "00000000000005D4" "208" "C:\Program Files\Npcap"
1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E8" "00000000000005E0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\Npcap\npcap.sys

Filesize
64KB

MD5
78f0b578a8c6d2141e0172f2458ae4f7

SHA1
acc3a363578556d5564689543d1e59e49da1eeae

SHA256
29229cc3bb89fa086320efe689f3117c233cf440fce59da57e160a2a7cfd5c55

SHA512
7319123d6cd9a1db915d6619e87049365904e8b42b8542cd50f552648302d4e660cd9fc6d546e9c3b43ad1091413652b463b7944ed2daae389eb81e357bbed9b

Download Submit
C:\Program Files\Npcap\NPCAP.inf

Filesize
8KB

MD5
99237dec17901e7a09b9cfc9c7e31608

SHA1
34b33fe24b350020b02fafe62c5849f0df114331

SHA256
79be1dba5c620ba6f7ddafaa915f10f7f388138d5d796d93575cfba45a485d10

SHA512
9ab23063f344adeede21bc49d260f41f77469c87c6bd76278317c216859e97b618accdad3590f145bd003f38bd0238138c0b3366e425b0317f4dd83fd450676b

Download Submit
C:\Program Files\Npcap\NPCAP_wfp.inf

Filesize
2KB

MD5
cfa882031d674ff0e92ce8fa0c2894b3

SHA1
86d62c5bead3684f4a638cdd506769cf95ecb4a4

SHA256
9103040803a8d100278a57543fbdb2cf1143ab2a691e8b87354e8e2faf16204c

SHA512
51f067fb350e90faa34e3e068b896966e15414cf6d99f36928eb380a41f252d2df56647e98f44e0d39cc805ae7aaa62845b991a410266ae3f6a383c31cee96b8

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
318B

MD5
7c9f9f74f306e6ca3d6f30e13d28ec52

SHA1
52055253974d73bd48d831ef8fb03feb2cbf959d

SHA256
80669fb393dc60c5c2b96f053d9cc1356f1e0a75d4bd7b88d149b2023f3a819d

SHA512
7f2768758e64f40d60eb6a871ad16a28a8dd2aa7e8d4f3c425b3a7778cdf50d7798b463a8d6af8eadef6c6b5e75b88854259c73a4b72b100ad28a3a211ff6291

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
999B

MD5
b95a2ce5b66fee0819a91ae3432cab21

SHA1
8967c84c3b3d5809d1ff3bf5e9ee76875a4dac7d

SHA256
a0dfd9632110026c140f09fffd13371d015e4ce4aca5cbafc09211acdf4436ac

SHA512
4eb5cebfba9ef082e9e5c544c73e6be270d7ce758fb48a077d88975ef9aa5ae77f2e165caf829ffa0b391d5f08aa74f48956d0509d2afcf6c00e37ed07d4e1f7

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
1KB

MD5
f26c417054a41ca2d689d8e9dcf82f7c

SHA1
c91d7c469a283fbe24f080af0090b1afdac52240

SHA256
4a08a910de10e24aa84b1b7e0caf2c1a8c13a1a2e2da2197d90289e0d6eb0bbc

SHA512
9a1048ef80410530ae0e69f0905347cd6a780d7e04ed184d156605f4506d44f5eba4cd6a76931876d8f6ab7b09f175727d8a2f2c3a57b53b1c0a944f30e93a75

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
4ab21bae0f958da1b5ab0598bc023722

SHA1
7e788f213db444d4a33b59d7a4b9f2b07db61ce8

SHA256
e468c5aa2ac1213b55a7075ec5a3b4c72a9b2c3e4d5cacb8d76a2f46b0e9000d

SHA512
6bc73afecf7dde8fefa554092663208110e1909c63bbce903afccc4f38a6063da280e22a98c0fe9072754c319401e8f0b213bd04daba5ac99e9604ea2aa7d348

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
99852231400800a6e9550fafe593543b

SHA1
5831bd0761b350e5f8deed0bfbaa57c425dbd162

SHA256
4308bcdc093bbae7e80c27a8ecb9a8987c07f1d9bb71979d56695e0f94974395

SHA512
e077744507040132ab47d0a82800c1963d0831ea745ac8c206fac645b88b3341ede1c75fb8f8eca4cba6971cf1f642ad8bc80094f9545686cd7db967d719d6bb

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
2KB

MD5
995169d41ff912dfaea03c0ea9e26c73

SHA1
5d8b4afea4ea3d3d408598504ee64be3e2b2bcc4

SHA256
85c2ec2a8e5f295a585faf2b38a007d8a0094588f0526267115a18e8dfb8e642

SHA512
4c3ce7f2da4a97aeb97ca397ccad481f6a268326050fba50763ee81d7b8c6b98eb08d1d16445c19796a9f2e119d44b958c569058a496fe1aadbd56f40b373d5c

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
3KB

MD5
019b00851bf8f0274b85170fd1bcac27

SHA1
149e41f07b1dc807a29e54627f57714cf80c3ed3

SHA256
2700b47da8589ed009502eba10374ef54598dcb1eff1c1b95ccd180dee4d101b

SHA512
72f95df02231b651a3156e68333553c003811a82650d0ce82f6ae4d2dc876122ffcdffa1ba586225f670f06f7c600fa6b39c4742bfd8d30b17642f77ba041ae0

Download Submit
C:\Program Files\Npcap\NPFInstall.log

Filesize
4KB

MD5
bec86b2aa831df3bf88a90b47514d68c

SHA1
063be4c2c10cb872d8f6c92f1420aa09f5b3db87

SHA256
b8277118954ae2c8d07fc86461b5105a6a34086bd33c2343551d3308fab9647b

SHA512
9b6620b8cc7dd340074b5a4604c7835526398b80be8922f2da0b0efdb9bb8287b77d2fb0ab96362ea548e80f1ea15a54a21477b747fce5a565d97bb102b9dd96

Download Submit
C:\Program Files\Npcap\npcap.cat

Filesize
10KB

MD5
63203752989a6cb2f2460b7762fa8258

SHA1
6affd42ca84c51bf68db2275864aba38b597406f

SHA256
283cca8dd06799b5839924a1adf1af3015a0b069fac0c3f4d03a34ad4a92abe1

SHA512
18153b7d5ad7d28c134619e8f27d133bb2da374e360774a6cdb9a8055abcd60182c0e3d5728eee8e870ede3784e5b027a10754cbe921cd717cf43f91d6158d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE082.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE094.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\Insecure-EV-sha1.cer

Filesize
1KB

MD5
6e3a097ec254863a4a1a810ffcad253a

SHA1
29bacae898852aab0bb9162881053b703b9d1005

SHA256
8e1b4bcf0bb63d58165149af6b31f771c80b1064750ebb3c326483df3ab8ebf0

SHA512
dad466fe6e87d5834837c4f0145c85c852be9e4d8301b2eeb1d2af322829b9b2913647c4ea5e70293c35260265cebc02f4f017cbb319209556f4278afcd64ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\Insecure-EV.cer

Filesize
1KB

MD5
bb381ad7f010e2e2f2f63d01c7134805

SHA1
4ce89794fe2d2f7e30121f10bcf76ac3ccf77ca9

SHA256
ed81c57dc455569ced035211a11c74110bf820df0d8b09bf23024c6f0d9baf95

SHA512
da41931dac9c463ab066eaeb830f0e3d79c62f103f2eff4d5092e99e8292f30cc16d6ffd70071af353fa986b5874dd2cf8a4d44d9f2df479574bcdbf6f5b796c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\final.ini

Filesize
309B

MD5
a2922523a6739ab48b505094f6506710

SHA1
6196dcc4bae3d3b600c43c3e9e8c6ca6edd4c80d

SHA256
7fe3df2176847905ca8edbbcb4069870ddf093ced90ee83406f6086371d28409

SHA512
b06e18a5a7511a578bff226dce436d567f3e08d27ba5bcf6ae67d90e937aad64fbbc6929e56cb8116857af658705da70a8535f55ead16887af7a48ca04194220

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\options.ini

Filesize
1KB

MD5
193f0e542a93401118e531c9ca3063a8

SHA1
c87160ad119d9df2be534cba386971c5566b7961

SHA256
e0db7582cf8520d90226f1202cc2fd607d724fcfbc5ffffad0bbdc8fe5c779b5

SHA512
fae1fd6450583838c2576fa8cdbe58de189efb3946648841c37578d0b73d2eb2aef107188212849d59cf7420df5d8c08d54c7abfeed56acf1bd8fb73558bc6f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\options.ini

Filesize
1KB

MD5
382a7779cd48ab2bd7b6d746a825b065

SHA1
6b0a9ebb8a2fc6b2d0e785133ed6079d35f6e0ed

SHA256
2dfac8fed250ccb4b039d9e1c43a3f0340f0293abe0bcc394d7a2f358073fd95

SHA512
8e0e45f0852e828d6b6d3ba8d669148b7e79cb7b018f43d9a88684da6d017aba7fc55adf02422c862577318d52e57730f99633824ebe8a7ccff6904fe7278d66

Download Submit
C:\Windows\SysWOW64\packet.dll

Filesize
171KB

MD5
fc5a4c1d57a9152c677f5cce7095662d

SHA1
454ff2c1c3e3b11652cf6a7e1beba49dd017a6e1

SHA256
8f7aa509cc980f031ab5b8666866420e33111d0f27eeb8f0a8dd33d92d4f58f7

SHA512
d9abefd761d4816efe180bac8d7a7d7bd6aef0d93c1ed946a98945693fa757387944ce75cb16dd11ef27efb70206c357beb10f79a73a081258caa14dfbd22fe7

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
376KB

MD5
8d52c81decbffb2e7f3ef8cc79c28a35

SHA1
db51968dcd91e3af59707cf4854f74d5147b722c

SHA256
a3a1a19f09a4f69bbee8656bab8886bcfd5a67902838e4b1bab391e4f2663a5d

SHA512
f15cb4416b23094a22dd57001a8968a7c1cb94f15776e972251d62223c0fb16feff0e5cf9c80eb6ea119376471848444de098647bbfeb780de9b8c4268cdf123

Download Submit
C:\Windows\System32\DriverStore\FileRepository\npcap.inf_amd64_neutral_0392b728f6f73ae3\npcap.PNF

Filesize
11KB

MD5
377e24b6f032c061a69be3c12a0909b5

SHA1
6304df45aaac20fb0a75a88707a6f5f729609751

SHA256
1d1561934a8dc71ed76c87360917273ced3cd42e6f99928c35660dd1de9255bb

SHA512
ff4eaf3558f50aa0708f3847ed3f0f75f5c5c65f91acc2fab3d8c552841c461b566e18dc6ce5e6d26d7fd5ac039038ed098423dbbfd0fce7b22212145d38e46e

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
5d1f89e682105b436acdc526ef54334c

SHA1
441a029437e94a7eae70e26f41dfa3dc2d0fc35b

SHA256
fa9bbafafd8d68bbc5b0793e8c9bcbf94fb55ea2d6b49ae72d321778abb7ad02

SHA512
386c57960ea43eda1ea0fbf8b4670c46d6de16ec65378ab42d817d40bf2a4d9bcd1ac30b6db083a19dbabb4bc5a8c3081268498c7f711870269efb821d8d2ef5

Download Submit
C:\Windows\Temp\CabC3CE.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\TarC3D1.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
\Users\Admin\AppData\Local\Temp\chaospc.exe

Filesize
1.9MB

MD5
e16fef8f8f9d64ccda412e749581c847

SHA1
dec31e41e8006fd4682344c91adfdf5e3d108ab9

SHA256
471ad500f690fa241a5fca425aeeb6a9af63ec1c450b835f2e1b870dc079d080

SHA512
be1f1a33a5ca73fda6317219b42442d5d2dd0185207df5c40f74505a5d4d8855caa036cfcc0cf85eee8578eeb5b1aa2ec8909c481dab86b210a8733bf32351bb

Download Submit
\Users\Admin\AppData\Local\Temp\chaospcap.exe

Filesize
773KB

MD5
84f1a974bb04dafbe581c66ef875def0

SHA1
20c1af092ff3d98a8b5dce69ec28d833b06b741e

SHA256
bcfbc57d41c00e40298c5c3040264e694cc8fc7da55939729aedc1041c8e92dd

SHA512
312101506ce296065cf084245506f23b2bcda955e9bdbb1747bd5dcc65432c8bb5d8abea25b459917dec0adf168ad4b513f5db7f083b9d8f0b7c41a8f5b74661

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\InstallOptions.dll

Filesize
23KB

MD5
d8bfba73978801ed5c291b847ae6ed0f

SHA1
afd973df6c0fd92372b787f2a06a02fa4c03b877

SHA256
75fca8af133756a0d36ad9b6177ef8ee01b6dd18ede216d82b2eb5f8092a84cd

SHA512
62b921725c727247b96622765caa4ddec1126980e677764f9bdb5e68eae50044747f0ee99744c44b7a7253a57e3c28a2fc19a99d479787aa4944499871db92f2

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\NPFInstall.exe

Filesize
300KB

MD5
5585d6f39e7ff907619ddf966cd57212

SHA1
894907ff9ff7e2b649cae4f63369c1d62e9c1daf

SHA256
7502f6d40863e8f1e8dac80de8a01c862261a4e81c6ec72e79dd2dc9f7671895

SHA512
d3fad4553faaef85de4bb44038fe7307f2b9168bd40d66da2942de71339426545c970c28403c5fa521634490b47be4179853604ef74d5f330a88a40845269bc4

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\SimpleSC.dll

Filesize
70KB

MD5
4a2b58bd7cab29463d9e53fcb9a252b6

SHA1
4679ba66db7989a64c41892bbb3f7cec38fb5597

SHA256
18b17999996d73fe911a8eb676c231cb0bf002174954b552f880bdabf4c78124

SHA512
e6a69b5bb52467e7b8168a3e0ad45252b196b8eaea87b91f8d3b150545ce6bc7ee586ebe1d83da6c04203a9a9bab5f4af66759ba35b73306f7962ca5b6ff2fff

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\System.dll

Filesize
19KB

MD5
6a2f80ed640b6c2458329c2d3f8d9e3f

SHA1
c6dba02a05dbf15aa5de3ac1464bc9dce995eb80

SHA256
1e981423fda8f74e9a7079675c1a6fe55c716d4c0d50fb03ea482ff7500db14b

SHA512
00d49b1874d76b150a646ac40032b34608e548cfd806642982e446619c9852a0ab5389791468651c4d51d118aad502174e7b887c2b5b6a7a3e35ddd9bd50d722

Download Submit
\Users\Admin\AppData\Local\Temp\nsjBECF.tmp\nsExec.dll

Filesize
15KB

MD5
78bda400d7b80858c014fc79bd8fc49b

SHA1
f5bb0e85ba892611cf79b3c2756e87a59e1e213c

SHA256
6bd24522cd139c978cc259d5612188053577ba9de46e2d77642bd4d19fc959d4

SHA512
95a1aced8deaad51ad7990b83f0e5768fab9e1c7aa64d9fd656baa850d81c0955b7989ce08a02fedbb8c9d77ec135b2a9d132effbfc0f8478a052095140c74cc

Download Submit
memory/3008-536-0x00000000028B0000-0x00000000028C3000-memory.dmp

Filesize
76KB

Download