azorult | 70aa40cd97d4faca9c2e59ec8146756d6425a42074a1bb7e002e5a69586a5848

General

Target

dttcodexgigas.exe
Size

2.0MB
MD5

d991604d49d42df05201a392c7e4ac21
SHA1

8920176952310dbb18aa21656b4803b7e4042221
SHA256

70aa40cd97d4faca9c2e59ec8146756d6425a42074a1bb7e002e5a69586a5848
SHA512

273b27f97baff7ad7714165a94ee770cd5c3e7a4ba1c5256d82b856d3d7b7748bbe32d0cf408396d68f7d6889d179261cbc975357356720859851695e8c1404c
SSDEEP

24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYt:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YH

Score

10^/10

azorult quasar ebayprofiles discovery infostealer spyware trojan

Malware Config

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes

encryption_key
MWhG6wsClMX8aJM2CVXT
install_name
winsock.exe
log_directory
Logs
reconnect_delay
3000
startup_key
win defender run
subdirectory
SubDir

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Quasar RAT 3 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
	17	ip-api.com	Process not Found
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dttcodexgigas.exe
	54	ip-api.com	Process not Found

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000234a4-12.dat	family_quasar
behavioral2/memory/380-30-0x0000000000DA0000-0x0000000000DFE000-memory.dmp	family_quasar
behavioral2/files/0x00070000000234a7-46.dat	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	dttcodexgigas.exe

Executes dropped EXE 3 IoCs

pid	Process
5044	vnc.exe
380	windef.exe
2112	winsock.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	dttcodexgigas.exe
File opened (read-only)	\??\e:	dttcodexgigas.exe
File opened (read-only)	\??\i:	dttcodexgigas.exe
File opened (read-only)	\??\m:	dttcodexgigas.exe
File opened (read-only)	\??\z:	dttcodexgigas.exe
File opened (read-only)	\??\b:	dttcodexgigas.exe
File opened (read-only)	\??\h:	dttcodexgigas.exe
File opened (read-only)	\??\k:	dttcodexgigas.exe
File opened (read-only)	\??\l:	dttcodexgigas.exe
File opened (read-only)	\??\n:	dttcodexgigas.exe
File opened (read-only)	\??\p:	dttcodexgigas.exe
File opened (read-only)	\??\y:	dttcodexgigas.exe
File opened (read-only)	\??\g:	dttcodexgigas.exe
File opened (read-only)	\??\t:	dttcodexgigas.exe
File opened (read-only)	\??\v:	dttcodexgigas.exe
File opened (read-only)	\??\w:	dttcodexgigas.exe
File opened (read-only)	\??\j:	dttcodexgigas.exe
File opened (read-only)	\??\o:	dttcodexgigas.exe
File opened (read-only)	\??\q:	dttcodexgigas.exe
File opened (read-only)	\??\r:	dttcodexgigas.exe
File opened (read-only)	\??\s:	dttcodexgigas.exe
File opened (read-only)	\??\u:	dttcodexgigas.exe
File opened (read-only)	\??\x:	dttcodexgigas.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com
54	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00070000000234a7-46.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 3720	1324	dttcodexgigas.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
3120	5044	WerFault.exe	82
3028	844	WerFault.exe	105
1400	2112	WerFault.exe	95
1004	4928	WerFault.exe	121
3412	2388	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dttcodexgigas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dttcodexgigas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vnc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3888	PING.EXE
2120	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2120	PING.EXE
3888	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1564	schtasks.exe
4536	schtasks.exe
4836	schtasks.exe
4324	schtasks.exe
4416	schtasks.exe
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1324	dttcodexgigas.exe
1324	dttcodexgigas.exe
1324	dttcodexgigas.exe
1324	dttcodexgigas.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	windef.exe
Token: SeDebugPrivilege	2112	winsock.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2112	winsock.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 5044	1324	dttcodexgigas.exe	82
PID 1324 wrote to memory of 5044	1324	dttcodexgigas.exe	82
PID 1324 wrote to memory of 5044	1324	dttcodexgigas.exe	82
PID 5044 wrote to memory of 3932	5044	vnc.exe	84
PID 5044 wrote to memory of 3932	5044	vnc.exe	84
PID 1324 wrote to memory of 380	1324	dttcodexgigas.exe	85
PID 1324 wrote to memory of 380	1324	dttcodexgigas.exe	85
PID 1324 wrote to memory of 380	1324	dttcodexgigas.exe	85
PID 5044 wrote to memory of 3932	5044	vnc.exe	84
PID 1324 wrote to memory of 3720	1324	dttcodexgigas.exe	88
PID 1324 wrote to memory of 3720	1324	dttcodexgigas.exe	88
PID 1324 wrote to memory of 3720	1324	dttcodexgigas.exe	88
PID 1324 wrote to memory of 3720	1324	dttcodexgigas.exe	88
PID 1324 wrote to memory of 3720	1324	dttcodexgigas.exe	88
PID 1324 wrote to memory of 4416	1324	dttcodexgigas.exe	89
PID 1324 wrote to memory of 4416	1324	dttcodexgigas.exe	89
PID 1324 wrote to memory of 4416	1324	dttcodexgigas.exe	89
PID 380 wrote to memory of 3864	380	windef.exe	93
PID 380 wrote to memory of 3864	380	windef.exe	93
PID 380 wrote to memory of 3864	380	windef.exe	93
PID 380 wrote to memory of 2112	380	windef.exe	95
PID 380 wrote to memory of 2112	380	windef.exe	95
PID 380 wrote to memory of 2112	380	windef.exe	95
PID 2112 wrote to memory of 1564	2112	winsock.exe	96
PID 2112 wrote to memory of 1564	2112	winsock.exe	96
PID 2112 wrote to memory of 1564	2112	winsock.exe	96

C:\Users\Admin\AppData\Local\Temp\dttcodexgigas.exe
"C:\Users\Admin\AppData\Local\Temp\dttcodexgigas.exe"
1⤵
- Quasar RAT
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\vnc.exe
  "C:\Users\Admin\AppData\Local\Temp\vnc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 548
    3⤵
    - Program crash
    PID:3120
- C:\Users\Admin\AppData\Local\Temp\windef.exe
  "C:\Users\Admin\AppData\Local\Temp\windef.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3864
- - C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PqjTqHGKy3zN.bat" "
      4⤵
      PID:2552
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4384
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3888
    - - C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
        5⤵
        
        PID:4928
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4836
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HGE3PL94CTmN.bat" "
        6⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2120
        
        C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"
        7⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1756
        8⤵
        Program crash
        
        PID:3412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 2240
        6⤵
        Program crash
        
        PID:1004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 2264
      4⤵
      Program crash
      PID:1400
- C:\Users\Admin\AppData\Local\Temp\dttcodexgigas.exe
  "C:\Users\Admin\AppData\Local\Temp\dttcodexgigas.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5044 -ip 5044
1⤵
PID:2504

C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
1⤵
PID:4568
- C:\Users\Admin\AppData\Local\Temp\vnc.exe
  "C:\Users\Admin\AppData\Local\Temp\vnc.exe"
  2⤵
  PID:844
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k
    3⤵
    PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 520
    3⤵
    - Program crash
    PID:3028
- C:\Users\Admin\AppData\Local\Temp\windef.exe
  "C:\Users\Admin\AppData\Local\Temp\windef.exe"
  2⤵
  PID:1864
- C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe
  "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"
  2⤵
  PID:1528
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 844 -ip 844
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2112 -ip 2112
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4928 -ip 4928
1⤵
PID:3864

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4700

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2388 -ip 2388
1⤵
PID:4404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2064

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3580

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:448

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1416

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:4644

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:908

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4d0
1⤵
PID:2808

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1520

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2740

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:708

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:208

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\HGE3PL94CTmN.bat

Filesize
208B

MD5
a6222b40f1513722944ac154639b252b

SHA1
8ca63ef11600493337cbfdd97a8e2fe53b35bdd2

SHA256
d04c20b9a54dd55cd9f83dc4c042702d98597c25dba5cb712872b806db6d67bc

SHA512
7f670fbba56df290b921637d8b6e4471a63c5a9d5c40956b5c080ad48eac04633b100ac9c3e0ebc961085a8fc757ff47680bd6792767f60a565c2bd51e65b472

Download Submit
C:\Users\Admin\AppData\Local\Temp\PqjTqHGKy3zN.bat

Filesize
208B

MD5
fe31f200f8bb4350cc86855b27a5b24c

SHA1
6403be555b4051d0873dc3a7fc85c1276f748c6e

SHA256
3685a3a83efd026789918a6eecaab9347de3c82b293add50972f9d34c8382625

SHA512
6e6c9b84b5885295261d4f818aa42baf12d7f58dcd1f53f586552e92cec4295ed5831683f5d0d4616547871b4e69c42f9b18c2a272c562d455b0b1da15b1a161

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnc.exe

Filesize
405KB

MD5
b8ba87ee4c3fc085a2fed0d839aadce1

SHA1
b3a2e3256406330e8b1779199bb2b9865122d766

SHA256
4e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4

SHA512
7a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\windef.exe

Filesize
349KB

MD5
b4a202e03d4135484d0e730173abcc72

SHA1
01b30014545ea526c15a60931d676f9392ea0c70

SHA256
7050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9

SHA512
632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\09-17-2024

Filesize
224B

MD5
71d1c0eb3252e81da347ca0d543bd484

SHA1
cfacd356b495d82000922c5ab7694df5fa063c6a

SHA256
df2d6606529fc1bd905127a70c5acd6e929d284b807a847f79486f328b34fff6

SHA512
1fd854c3d2426bd37c7dee232b54e1be24b4645c1a7b9d1a2d5630f213fc7ba02cccb6550a02411925c1be75ce50e5635a5ca71632124706b5c8631c017b9061

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\09-17-2024

Filesize
224B

MD5
5dcd6d55ff80948adf4e4723be4fb4c6

SHA1
88eca25d740204d4dbb45e302f3a9624053ed537

SHA256
b399a2cb55c059f8b42465f564d33d9da8dea9d8fd5f3c5e8389fc4b72cda188

SHA512
46704057554d41619eb41250b2b73f09365606b1042e9aa6e248c4f75e1002008a7ab7f8d8b885666c4d6a4a51743d55c8609536333e8485a3f0e05fce6427bd

Download Submit
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe

Filesize
2.0MB

MD5
2ac268cb19239642cd8d4ceacad43fe5

SHA1
aabfaf3e8c2e82cad6779a5c993f5eb9dbf03280

SHA256
d002bf1ba985698ae151bc835a0a2512dfe39808b38a42606c6ce679e6794f1a

SHA512
fb0447c2909ab0438315dc08ff118c933871abd1b100bfa0627ae5f7e932e92aef771b8dd28f46e213fbbd759787f8a69f4b0b4acf24b77d8bd1acb503c50ab5

Download Submit
memory/380-34-0x0000000005860000-0x00000000058F2000-memory.dmp

Filesize
584KB

Download
memory/380-35-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/380-36-0x0000000006520000-0x0000000006532000-memory.dmp

Filesize
72KB

Download
memory/380-37-0x0000000006A60000-0x0000000006A9C000-memory.dmp

Filesize
240KB

Download
memory/380-33-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/380-30-0x0000000000DA0000-0x0000000000DFE000-memory.dmp

Filesize
376KB

Download
memory/380-19-0x0000000072C4E000-0x0000000072C4F000-memory.dmp

Filesize
4KB

Download
memory/1324-20-0x00000000040A0000-0x00000000040A1000-memory.dmp

Filesize
4KB

Download
memory/1528-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1528-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2112-45-0x0000000006D10000-0x0000000006D1A000-memory.dmp

Filesize
40KB

Download
memory/3720-29-0x0000000000890000-0x00000000008B0000-memory.dmp

Filesize
128KB

Download
memory/3720-21-0x0000000000890000-0x00000000008B0000-memory.dmp

Filesize
128KB

Download
memory/4568-89-0x0000000074FD0000-0x0000000074FD8000-memory.dmp

Filesize
32KB

Download
memory/4568-90-0x0000000074920000-0x0000000074D70000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads