rhadamanthys | 5f09dcd96fe17153060fc166c97013847c3d785c03d644749d95954c31c40d60

General

Target

RG_Catalyst.zip
Size

105.0MB
MD5

7663437ff16bb47290348c22aaa2df09
SHA1

7d6045c4dcdfba0729e854a7e5d4d6f37d962186
SHA256

5f09dcd96fe17153060fc166c97013847c3d785c03d644749d95954c31c40d60
SHA512

98f2c5409915afab97c06bd5861e98d884024d424bf9807c424cab24b167f1f29cc40b902b3c5fe5740ac4e62f8d69bc5a6fc2a399d5414cac41fd2980c035fa
SSDEEP

1572864:RDIrZ+DNnPENSLJEvbLnR3l5FtfZsxc6QmJv3b7ewVgKtXc/n7MvXYoQ2DWGmt:RDMiNtALZlN6x/Qm5HewVZtC7OXYoWG6

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

module.exe

description pid process target process

PID 232 created 2076 232 module.exe sihost.exe
Executes dropped EXE 1 IoCs

Processes:

module.exe

pid process

232 module.exe

description	pid	process	target process
PID 232 created 2076	232	module.exe	sihost.exe

pid	process
232	module.exe

Drops file in Windows directory 4 IoCs

Processes:

UserOOBEBroker.exe

description	ioc	process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

FileCoAuth.exemodule.exeopenwith.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	module.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings OpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemodule.exeopenwith.exe

pid	process
2728	msedge.exe
2728	msedge.exe
1560	msedge.exe
1560	msedge.exe
232	module.exe
232	module.exe
232	module.exe
232	module.exe
536	openwith.exe
536	openwith.exe
536	openwith.exe
536	openwith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

2432 OpenWith.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

1560 msedge.exe
1560 msedge.exe
1560 msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

OpenWith.exe

pid	process
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1560 wrote to memory of 5092	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 5092	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 1996	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2728	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2728	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe
PID 1560 wrote to memory of 2840	1560	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2076
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:536

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\RG_Catalyst.zip
1⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://temp/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe46063cb8,0x7ffe46063cc8,0x7ffe46063cd8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,17446111706305158706,630819478021595008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3404

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3856

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2432

C:\test\loader.exe
"C:\test\loader.exe"
1⤵
PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\module.exe"
  2⤵
  PID:644
- - C:\Users\Admin\AppData\Local\Temp\module.exe
    C:\Users\Admin\AppData\Local\Temp\module.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
684fd81e08c4260c0cb2aa04a3575695

SHA1
d8d7cbe538b127fca85e89e62306f0ae344e524e

SHA256
7a8683a18f36c30021fbb37ba1cff237f69b019846cf57ee92d21bdc155a14de

SHA512
7703941abb92bbf7879c1e3e89ab9d420ae182ce08599d18d5fa898a6dd5d4b31714726fe7a21cab13d45886ba5f76b1b10e79bde3d114fb2d96a7bd33ae22e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5d243351860fe8ba41ec3d8e8f74dbb

SHA1
6075964fc83c01f7e0c49b8828c9be510e745584

SHA256
51bb2be866e9c8c6501a6e912f78dd33345195cd05ff3aad551b82aab9f0344b

SHA512
1f82354c1d2639f5e42970c872d4399ce78dad84b2b50e7dc967434908624a58d8d55bb0c7b2b3970ca8c3003d957b6174051f083805e6c35235049847699b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fdb73912e8f38d957a7065ac607f44d4

SHA1
7f28fefaaa07567f76fe17cda43b8e30e6dcefca

SHA256
5b3ebadb71aee1fbb6695072726463dcdf4b35917e3e61e0da54f7b0967c485c

SHA512
3cb16fa3332baf60542dd7072e2ad5fc7329f9456bdbc1d9f268a8d98b3401973f62f77c8032510a4cdb6cba3f628158ce65383de7ed563f416f95ae637ee06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\module.exe

Filesize
5.1MB

MD5
12d8c8c95c59e45b98b2a107575b0169

SHA1
8a179831a9a5da9a64888702be744a0e837adfc3

SHA256
6d3cb7a3b8e5a1ca0288c225b8bf2a3d741f05fe1d8f3954d5e36ce13ce99355

SHA512
9b253516f3034a65232b97e58817c24ca4a0b73bf1bc141d5903a645a499cbd97c8f263a1704d54fb88998258d12a5da683090102c7dbaf1b1d98f71de9c6b6b

Download Submit
\??\pipe\LOCAL\crashpad_1560_LIHUIBPQHTCQNSVK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/232-102-0x0000000000990000-0x0000000000EBB000-memory.dmp

Filesize
5.2MB

Download
memory/232-101-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/232-100-0x0000000000990000-0x0000000000EBB000-memory.dmp

Filesize
5.2MB

Download
memory/232-103-0x0000000003FA0000-0x00000000043A0000-memory.dmp

Filesize
4.0MB

Download
memory/232-104-0x0000000003FA0000-0x00000000043A0000-memory.dmp

Filesize
4.0MB

Download
memory/232-105-0x00007FFE66660000-0x00007FFE66869000-memory.dmp

Filesize
2.0MB

Download
memory/232-107-0x0000000076530000-0x0000000076782000-memory.dmp

Filesize
2.3MB

Download
memory/232-110-0x0000000000990000-0x0000000000EBB000-memory.dmp

Filesize
5.2MB

Download
memory/536-108-0x0000000000B70000-0x0000000000B79000-memory.dmp

Filesize
36KB

Download
memory/536-112-0x00007FFE66660000-0x00007FFE66869000-memory.dmp

Filesize
2.0MB

Download
memory/536-111-0x00000000029A0000-0x0000000002DA0000-memory.dmp

Filesize
4.0MB

Download
memory/536-114-0x0000000076530000-0x0000000076782000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads