sectoprat | f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b

Analysis

max time kernel
138s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe
Size 11.2MB
Sample240919-cbs5wsvell
SHA256 f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b
MD5 4fa734db8e9f7ce5ecd217b34ecc6969
SHA1 fbfc15ded2ebd130c92d812c26dc052561f7ff83
SHA512 76ffd5839721ba668762c4458fd8da8fa8edc656c232e5957c253acc67c599846b89bc9acda1ec8dc5b07d229e143d3deca415c528ba4c04bf9264670f74f48a
SSDEEP 196608:FfhVx6cyJczra+6msUjFD8rXPLJy5rRUlXmBPzLMAoUsJBK7iskeDqQ7poZ:FfrABJq2+6mnD8b9y9RU8zLMAoUsJBKK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sectoprat credential_access discovery persistence rat spyware stealer trojan

Malware Config

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1784-188-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	AutoIt3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp

Executes dropped EXE 4 IoCs

pid	Process
468	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
464	AutoIt3.exe
1288	AutoIt3.exe

Loads dropped DLL 2 IoCs

pid	Process
468	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\abbkkce = "\"C:\\eegeaeg\\AutoIt3.exe\" C:\\eegeaeg\\abbkkce.a3x"	AutoIt3.exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
512	tasklist.exe
3292	tasklist.exe
4044	tasklist.exe
856	tasklist.exe
528	tasklist.exe
1440	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 1784	1288	AutoIt3.exe	122

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoIt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1396	PING.EXE
3724	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AutoIt3.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1396	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
1784	MSBuild.exe
1784	MSBuild.exe
1784	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	tasklist.exe
Token: SeDebugPrivilege	3292	tasklist.exe
Token: SeDebugPrivilege	4044	tasklist.exe
Token: SeDebugPrivilege	856	tasklist.exe
Token: SeDebugPrivilege	528	tasklist.exe
Token: SeDebugPrivilege	1440	tasklist.exe
Token: SeDebugPrivilege	1784	MSBuild.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1784	MSBuild.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 468	1684	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe	82
PID 1684 wrote to memory of 468	1684	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe	82
PID 1684 wrote to memory of 468	1684	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe	82
PID 468 wrote to memory of 3768	468	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	83
PID 468 wrote to memory of 3768	468	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	83
PID 468 wrote to memory of 3768	468	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	83
PID 3768 wrote to memory of 4844	3768	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe	84
PID 3768 wrote to memory of 4844	3768	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe	84
PID 3768 wrote to memory of 4844	3768	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe	84
PID 4844 wrote to memory of 2700	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	85
PID 4844 wrote to memory of 2700	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	85
PID 2700 wrote to memory of 512	2700	cmd.exe	87
PID 2700 wrote to memory of 512	2700	cmd.exe	87
PID 2700 wrote to memory of 4916	2700	cmd.exe	88
PID 2700 wrote to memory of 4916	2700	cmd.exe	88
PID 4844 wrote to memory of 4124	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	90
PID 4844 wrote to memory of 4124	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	90
PID 4124 wrote to memory of 3292	4124	cmd.exe	92
PID 4124 wrote to memory of 3292	4124	cmd.exe	92
PID 4124 wrote to memory of 3304	4124	cmd.exe	93
PID 4124 wrote to memory of 3304	4124	cmd.exe	93
PID 4844 wrote to memory of 4340	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	94
PID 4844 wrote to memory of 4340	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	94
PID 4340 wrote to memory of 4044	4340	cmd.exe	96
PID 4340 wrote to memory of 4044	4340	cmd.exe	96
PID 4340 wrote to memory of 3340	4340	cmd.exe	97
PID 4340 wrote to memory of 3340	4340	cmd.exe	97
PID 4844 wrote to memory of 2428	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	98
PID 4844 wrote to memory of 2428	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	98
PID 2428 wrote to memory of 856	2428	cmd.exe	100
PID 2428 wrote to memory of 856	2428	cmd.exe	100
PID 2428 wrote to memory of 3080	2428	cmd.exe	101
PID 2428 wrote to memory of 3080	2428	cmd.exe	101
PID 4844 wrote to memory of 540	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	102
PID 4844 wrote to memory of 540	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	102
PID 540 wrote to memory of 528	540	cmd.exe	104
PID 540 wrote to memory of 528	540	cmd.exe	104
PID 540 wrote to memory of 1536	540	cmd.exe	105
PID 540 wrote to memory of 1536	540	cmd.exe	105
PID 4844 wrote to memory of 4400	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	106
PID 4844 wrote to memory of 4400	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	106
PID 4400 wrote to memory of 1440	4400	cmd.exe	108
PID 4400 wrote to memory of 1440	4400	cmd.exe	108
PID 4400 wrote to memory of 1312	4400	cmd.exe	109
PID 4400 wrote to memory of 1312	4400	cmd.exe	109
PID 4844 wrote to memory of 464	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	110
PID 4844 wrote to memory of 464	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	110
PID 4844 wrote to memory of 464	4844	f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp	110
PID 464 wrote to memory of 3724	464	AutoIt3.exe	117
PID 464 wrote to memory of 3724	464	AutoIt3.exe	117
PID 464 wrote to memory of 3724	464	AutoIt3.exe	117
PID 3724 wrote to memory of 1396	3724	cmd.exe	119
PID 3724 wrote to memory of 1396	3724	cmd.exe	119
PID 3724 wrote to memory of 1396	3724	cmd.exe	119
PID 3724 wrote to memory of 1288	3724	cmd.exe	121
PID 3724 wrote to memory of 1288	3724	cmd.exe	121
PID 3724 wrote to memory of 1288	3724	cmd.exe	121
PID 1288 wrote to memory of 1784	1288	AutoIt3.exe	122
PID 1288 wrote to memory of 1784	1288	AutoIt3.exe	122
PID 1288 wrote to memory of 1784	1288	AutoIt3.exe	122
PID 1288 wrote to memory of 1784	1288	AutoIt3.exe	122
PID 1288 wrote to memory of 1784	1288	AutoIt3.exe	122

C:\Users\Admin\AppData\Local\Temp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe
"C:\Users\Admin\AppData\Local\Temp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\is-3H7UE.tmp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3H7UE.tmp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp" /SL5="$70048,10740751,812544,C:\Users\Admin\AppData\Local\Temp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Users\Admin\AppData\Local\Temp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe
    "C:\Users\Admin\AppData\Local\Temp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe" /VERYSILENT /NORESTART
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\is-TKEFR.tmp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TKEFR.tmp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp" /SL5="$D0044,10740751,812544,C:\Users\Admin\AppData\Local\Temp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.exe" /VERYSILENT /NORESTART
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2700
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:512
      - C:\Windows\system32\find.exe
        
        find /I "wrsa.exe"
        6⤵
        
        PID:4916
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4124
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3292
      - C:\Windows\system32\find.exe
        
        find /I "opssvc.exe"
        6⤵
        
        PID:3304
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4340
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
      - C:\Windows\system32\find.exe
        
        find /I "avastui.exe"
        6⤵
        
        PID:3340
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
      - C:\Windows\system32\find.exe
        
        find /I "avgui.exe"
        6⤵
        
        PID:3080
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:540
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:528
      - C:\Windows\system32\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        
        PID:1536
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4400
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
      - C:\Windows\system32\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        
        PID:1312
    - - C:\Users\Admin\AppData\Local\acetiam\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Local\acetiam\\AutoIt3.exe" "C:\Users\Admin\AppData\Local\acetiam\\grayhound1..a3x"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:464
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && AutoIt3.exe C:\ProgramData\\bZmNBr.a3x && del C:\ProgramData\\bZmNBr.a3x
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\acetiam\AutoIt3.exe
        
        AutoIt3.exe C:\ProgramData\\bZmNBr.a3x
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3H7UE.tmp\f358dde7b5f896d851677a271b4d20e70cdf36a9eeb9da9b001554d65e02a71b.tmp
Size 3.1MB
SHA256 ca3de247b4d58905e04277ee2386cedaeff38a0fad1f46bfff304ba9f0710f35
MD5 81636f80b1e7c0b8f946c8ff0081436a
SHA1 9e7b01f8324e089b925cb9050ce74cd099c58370
SHA512 67432e1a56e043573bc67d904f4c735f70333b35fe6efe2bb11ee1137bdd96bdbd3ed2956dbf8314b3a15ea2b2260fb5d3904481efb96c7dbb6661a32b13a85a
SSDEEP 49152:sdJYVM+9JtzZWnoS2VC23aun8+f5KuG2OY9IG9ivyv2cLx1RQx333RP:OJYVM+LtVt3P/KuG2ONG9iqLRQx333p
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-49RA2.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

tmp7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7A.tmp
Size 20KB
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc
SSDEEP 24:TLYP1kwIrnLbXYFpFNYd+6UwcQ8ri5fB:TcPawkLLopFsU1+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9C.tmp
Size 20KB
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
SSDEEP 24:TLQbXaFpEO5bNmISHnCWmoqv6UwpQ9YH5RZ6HfB:TULOpEO5J/KnvmopUOZD8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\acetiam\AutoIt3.exe
Size 921KB
SHA256 1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48
MD5 3f58a517f1f4796225137e7659ad2adb
SHA1 e264ba0e9987b0ad0812e5dd4dd3075531cfe269
SHA512 acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634
SSDEEP 24576:MghN1a6pzWZ12+f+Qa7N4nEIRQ1hOOLkF6av8uh:vhN1aQzJD4BuTxavfh
MD5 SHA1 SHA512 SSDEEP

Submit Download

grayhound.pptx

Path C:\Users\Admin\AppData\Local\acetiam\grayhound.pptx
Size 940KB
SHA256 1841f77c752744d0054847a13cccc5851408d2e38caafcb153e37c56a01f6bac
MD5 0bc6d1c595e440233c6daa45813657a0
SHA1 3a04c1fcd93642fe7b0ad47d67c29344ebddc9a3
SHA512 0fe0b161095deaa389ca9b81e8d0b5210598d1f750cc849828bca77168a9e7be0d747ac01c0a2f1d338e2562dcad7ca372c346b575ceb481b9cd7a24da10362f
SSDEEP 12288:l6YRwL/ZyokvNDLAAiBSf+W5N3wLnSHY8lHcXAhvWLIYQ1hUqNt5+3vro32jh:lwZyokmof+Wv3wixhvW051Nt5Svro30h
MD5 SHA1 SHA512 SSDEEP

Submit Download

grayhound1..a3x

Path C:\Users\Admin\AppData\Local\acetiam\grayhound1..a3x
Size 62KB
SHA256 8674025ff9edbf37ad8d7e1af8b93bd63e0fe2e8eaea61ee6e1317c468a0e48b
MD5 647d824a19511783d1a011f8b775c1d4
SHA1 46b0213afa55d27a688e9729ac120d4574318cb5
SHA512 ed57dcb8817d329bf989b642be2244976f7725edecb5565788eb1643b81b58fd22c39dcdec827b3f7067ae844f4b62622bf8d079679df10af4f203f67efe1d1f
SSDEEP 1536:DCJYXNMZW/yZQFyPGKKLfS4f1N7D6yKwkPJOsU04m0ybd:WpQ/yZQXhr9N/ViBO5tY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-6-0x00000000031C0000-0x00000000031C1000-memory.dmp

Download

memory/468-15-0x0000000000280000-0x00000000005B4000-memory.dmp

Download

memory/1684-2-0x00000000008E1000-0x0000000000989000-memory.dmp

Download

memory/1684-17-0x00000000008E0000-0x00000000009B4000-memory.dmp

Download

memory/1684-1-0x00000000008E0000-0x00000000009B4000-memory.dmp

Download

memory/1784-187-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/1784-194-0x0000000005980000-0x000000000598A000-memory.dmp

Download

memory/1784-224-0x0000000005CC0000-0x0000000005CFC000-memory.dmp

Download

memory/1784-188-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/1784-189-0x00000000059A0000-0x0000000005A32000-memory.dmp

Download

memory/1784-190-0x0000000006040000-0x00000000065E4000-memory.dmp

Download

memory/1784-191-0x0000000005DE0000-0x0000000005FA2000-memory.dmp

Download

memory/1784-192-0x0000000005B10000-0x0000000005B86000-memory.dmp

Download

memory/1784-193-0x0000000005B90000-0x0000000005BE0000-memory.dmp

Download

memory/1784-223-0x0000000005C30000-0x0000000005C42000-memory.dmp

Download

memory/1784-195-0x0000000006C20000-0x000000000714C000-memory.dmp

Download

memory/1784-196-0x0000000006720000-0x000000000673E000-memory.dmp

Download

memory/1784-197-0x0000000006810000-0x0000000006876000-memory.dmp

Download

memory/1784-221-0x00000000084C0000-0x00000000084CA000-memory.dmp

Download

memory/3768-13-0x00000000008E0000-0x00000000009B4000-memory.dmp

Download

memory/3768-178-0x00000000008E0000-0x00000000009B4000-memory.dmp

Download

memory/4844-21-0x0000000002A30000-0x0000000002A31000-memory.dmp

Download

memory/4844-174-0x0000000000310000-0x0000000000644000-memory.dmp

Download