Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

556cc22826...aN.exe

windows7-x64

10

556cc22826...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2024, 19:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    556cc22826538cbdd3d0010ddb93bd0d97e443798a546efb99a6220f4dbe76eaN.exe

  • Size

    1.8MB

  • MD5

    b6a30c74cf4ada6ed79f9627af48a3b0

  • SHA1

    711bde1c76c6039e04a02ebbf92d54ca19e8b3d0

  • SHA256

    556cc22826538cbdd3d0010ddb93bd0d97e443798a546efb99a6220f4dbe76ea

  • SHA512

    d602f74e7e19766bbfae09a6aba8c9a58d9936019b26926dff63c2f5718f6489f9a106ca7e742fd11ae97db263308c7a768443cc6d0660b5bcc017136148b2eb

  • SSDEEP

    49152:dkSnU+QqCvJ2wn26gD3lMe6ULQpy25bZPa:dW2w26gD3lgYQpyUbR

Score
10/10
amadeyredlineremcosstealcdefault2domafed3aalivetrafficmixnewbundle2tg cloud @rlreborn admin @fatherofcarderszalupacredential_accessdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

136.244.88.135:17615

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

zalupa

C2

http://95.217.92.42:22

Attributes
  • url_path

    /7db38bfff9324bbe.php

Extracted

Family

redline

Botnet

newbundle2

C2

185.215.113.67:15206

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

remcos

Botnet

MIX

C2

liveos.zapto.org:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    music.exe

  • copy_folder

    db

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    ire

  • mouse_option

    false

  • mutex

    Rmc-GHRUZU

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 12 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 36 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1152
      • C:\Users\Admin\AppData\Local\Temp\556cc22826538cbdd3d0010ddb93bd0d97e443798a546efb99a6220f4dbe76eaN.exe
        "C:\Users\Admin\AppData\Local\Temp\556cc22826538cbdd3d0010ddb93bd0d97e443798a546efb99a6220f4dbe76eaN.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2212
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:556
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 92
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:2960
          • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3044
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3000
              • C:\Users\Admin\AppData\Roaming\X5Eoun649t.exe
                "C:\Users\Admin\AppData\Roaming\X5Eoun649t.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2484
              • C:\Users\Admin\AppData\Roaming\GxVQ9loHte.exe
                "C:\Users\Admin\AppData\Roaming\GxVQ9loHte.exe"
                6⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2936
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 52
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:2076
          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:760
          • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
            "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1532
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 748
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:1036
          • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1544
          • C:\Users\Admin\AppData\Local\Temp\1000354001\edcc7fd1b7.exe
            "C:\Users\Admin\AppData\Local\Temp\1000354001\edcc7fd1b7.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:340
          • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
            "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2468
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1044
          • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:1672
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:892
          • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
            "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:832
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c start context.exe
              5⤵
                PID:1172
                • C:\Users\Admin\AppData\Local\Temp\context.exe
                  context.exe
                  6⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:280
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                    7⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1436
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      8⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2212
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "wrsa opssvc"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2960
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      8⤵
                      • Enumerates processes with tasklist
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1896
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2492
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c md 607698
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:1696
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2572
                    • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                      Waters.pif Q
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:596
                    • C:\Windows\SysWOW64\choice.exe
                      choice /d y /t 5
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2340
            • C:\Users\Admin\AppData\Local\Temp\1000408001\DEF.exe
              "C:\Users\Admin\AppData\Local\Temp\1000408001\DEF.exe"
              4⤵
              • Adds policy Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:1952
              • C:\ProgramData\db\music.exe
                "C:\ProgramData\db\music.exe"
                5⤵
                • Adds policy Run key to start application
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:1004
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\System32\svchost.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1728
            • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
              "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2520
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:484
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2084
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa opssvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1492
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1704
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2384
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c md 607698
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:692
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /V "MaskBathroomCompositionInjection" Participants
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:836
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1580
                • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                  Waters.pif Q
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:3040
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:1660
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im "Waters.pif"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1784
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 1
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:2728
                • C:\Windows\SysWOW64\choice.exe
                  choice /d y /t 5
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1576
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3016
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2052
        • C:\Windows\SysWOW64\cmd.exe
          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
          2⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          PID:1640

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      4
      T1552

      Credentials In Files

      4
      T1552.001

      Discovery

      Process Discovery

      1
      T1057

      Query Registry

      5
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        3287450ae605c052bc99af281c3668ec

        SHA1

        d1910fcc874d79f4d1c85f3e497babf58ccede16

        SHA256

        c45308ced723ed26c82a3f710f6bdf70fd2273b531aa4f778793022cd48ff0de

        SHA512

        cb352f8b2a17fbbad73dbd7bfff3ea74eeedfc5c3079a1ee802bc833637b3a3f4e81d042c3ac09f6abf86a0526ce4585e4d4baae447f0409ae8635931c783b2b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
        Filesize

        479KB

        MD5

        c06f1b4620ae77287d760821d0cbe8b5

        SHA1

        3334d3d049b4512f2d5c06151363fbee405a8e26

        SHA256

        57b12f4cad8251939bffda4f9306a979fdc90d13e0af58002efbb4c7661770af

        SHA512

        f662c35cab41ca451735a199bde39f53b639537e6046d2e85e9314e9ef15d1047e6904cfa721ff0ac333bab5339ec59432d6ac1f612d1eb05be348b54edd7e8d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
        Filesize

        1.3MB

        MD5

        24402fc0617a2740c16ea9c81518d669

        SHA1

        a0476ef848cd11bb20f8efd06e295a0f44c956ca

        SHA256

        c02fcc32573f4546201515667154d9e51e2636af52a1790d1063183c0d012566

        SHA512

        dd90c0036a8a109c5645b481f1bd7b193fa86518183790b75dbc400416793fb8f9e7d4d4621d7c0227cbbf483758a03a94581397686b09c6f65218b651b5bc63

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        Filesize

        187KB

        MD5

        7a02aa17200aeac25a375f290a4b4c95

        SHA1

        7cc94ca64268a9a9451fb6b682be42374afc22fd

        SHA256

        836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

        SHA512

        f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
        Filesize

        307KB

        MD5

        6ead977356a0302d5712c5c72bf82b65

        SHA1

        efc7e990984a170dd352e8290fedd1d4d748851c

        SHA256

        7ee8a586b2c7b7772a44aed28b4cb7934f13f0939e2573c8adf22cda922790ce

        SHA512

        7f0b88c74179866956e2358e21e4700ed9baf1c28712ee78aea689a8027c62aa05c781984c0e3bdca83657b7d34570d5f1e670ef95c91f46f48680c07e53325a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
        Filesize

        304KB

        MD5

        58e8b2eb19704c5a59350d4ff92e5ab6

        SHA1

        171fc96dda05e7d275ec42840746258217d9caf0

        SHA256

        07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

        SHA512

        e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000354001\edcc7fd1b7.exe
        Filesize

        1.8MB

        MD5

        f18158be17b318605b14f62cc6319363

        SHA1

        ca0fc6a897495289d50fa85a3f090a7026487baf

        SHA256

        90c9b9a8f68b23d3528c87dde1e3b9bd34ebe672d7bd84a2daed468be1976930

        SHA512

        9c66aebcca70e3b4017ca02e2b50e4627f382e88a750c18f096a5f7639873dc1751f7d3d6588bc3543361b797eeaf39ee33f422e257cb57f741a821f11a69c4a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000355001\412e81a7cc.exe
        Filesize

        448KB

        MD5

        aa5e42ad30cc15c0b9891b8bc67dcbe2

        SHA1

        f3085cb0310e562b809cb46d2387aba1b325106d

        SHA256

        332a9560b06b47f684ff347879b93c64ec4ed74c4470e60b87059116691c46af

        SHA512

        32d2bd7021a48bfc095dcf74eb0d04d23531efb439bb3e68dca369918a7a9bba2d76a0dd2414484d7873e8f1fab9207cc165c0e31e55194a134d6a7c2930c3fa

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
        Filesize

        314KB

        MD5

        ff5afed0a8b802d74af1c1422c720446

        SHA1

        7135acfa641a873cb0c4c37afc49266bfeec91d8

        SHA256

        17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

        SHA512

        11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
        Filesize

        416KB

        MD5

        f5d7b79ee6b6da6b50e536030bcc3b59

        SHA1

        751b555a8eede96d55395290f60adc43b28ba5e2

        SHA256

        2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

        SHA512

        532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
        Filesize

        6KB

        MD5

        c042782226565f89ce3954489075e516

        SHA1

        256dd5ba42837a33c7aa6cb71cef33d5617117ee

        SHA256

        a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

        SHA512

        9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000408001\DEF.exe
        Filesize

        482KB

        MD5

        6520492a4e7f9bc4dfb068de1c7b6450

        SHA1

        b5c2086a01528386482826ad243c2711e04200fb

        SHA256

        94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aa

        SHA512

        dd8d2d9a22ff521496a908f7dd5de7e25c4d7fd0a56d917a0ba29a5d160a293890f5c397e1ae7bb8a7488d4795221f819d810826b5d533ad1d61e63c438b2565

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
        Filesize

        1.3MB

        MD5

        2b01c9b0c69f13da5ee7889a4b17c45e

        SHA1

        27f0c1ae0ddeddc9efac38bc473476b103fef043

        SHA256

        d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

        SHA512

        23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        Filesize

        1.8MB

        MD5

        b6a30c74cf4ada6ed79f9627af48a3b0

        SHA1

        711bde1c76c6039e04a02ebbf92d54ca19e8b3d0

        SHA256

        556cc22826538cbdd3d0010ddb93bd0d97e443798a546efb99a6220f4dbe76ea

        SHA512

        d602f74e7e19766bbfae09a6aba8c9a58d9936019b26926dff63c2f5718f6489f9a106ca7e742fd11ae97db263308c7a768443cc6d0660b5bcc017136148b2eb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\607698\Q
        Filesize

        794KB

        MD5

        7b5632dcd418bcbae2a9009dbaf85f37

        SHA1

        32aaf06166854718f0bcbb2f7173c2732cfb4d33

        SHA256

        361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4

        SHA512

        c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\CabF798.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TarF79B.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TmpE255.tmp
        Filesize

        2KB

        MD5

        1420d30f964eac2c85b2ccfe968eebce

        SHA1

        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

        SHA256

        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

        SHA512

        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

        Download Submit

      • C:\Users\Admin\AppData\Roaming\GxVQ9loHte.exe
        Filesize

        393KB

        MD5

        7d7366ab79d6d3d8d83d13a8b30de999

        SHA1

        75c6c49a6701d254c3ce184054a4a01329c1a6f3

        SHA256

        3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465

        SHA512

        64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022

        Download Submit

      • C:\Users\Public\Desktop\Google Chrome.lnk
        Filesize

        2KB

        MD5

        c3c7af35edf8faaad4f7a99f332f28fc

        SHA1

        948ae32722c638ce550f154c116fd83f05965a61

        SHA256

        392d1b50c293e77b0208a7414db4da3bde20b5e07c582ab1ec0ffe06161a2ea4

        SHA512

        420183d2138562ebef158a84ec6c3c29f019d8f3659a1f16ec3413396ca42b04b012f5dda2d78844ae8e8e32fdd3da1476edf4c4114dcbcc6e9186596cc1a291

        Download Submit

      • \ProgramData\mozglue.dll
        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        Download Submit

      • \ProgramData\nss3.dll
        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        Download Submit

      • \Users\Admin\AppData\Roaming\X5Eoun649t.exe
        Filesize

        602KB

        MD5

        e4fc58d334930a9d6572c344e5129f6b

        SHA1

        d38fbd0c4c86eee14722f40cc607e2128c01b00f

        SHA256

        973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a

        SHA512

        a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59

        Download Submit

      • memory/340-441-0x0000000001390000-0x0000000001A2A000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/340-304-0x0000000001390000-0x0000000001A2A000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/556-44-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/556-41-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/556-43-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/556-39-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/556-42-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/556-46-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/556-48-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/556-40-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/760-200-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

        Download

      • memory/760-285-0x00000000009C0000-0x0000000000C03000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/760-134-0x00000000009C0000-0x0000000000C03000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/832-400-0x0000000000800000-0x0000000000808000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1044-344-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1044-336-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1044-345-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1044-343-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1044-342-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1044-340-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1044-338-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1532-434-0x0000000000C90000-0x0000000000EF1000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1532-182-0x0000000000C90000-0x0000000000EF1000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1544-248-0x0000000000C70000-0x0000000000CC2000-memory.dmp

        Filesize

        328KB

        Download

      • memory/1728-431-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/1728-432-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/1728-433-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/1728-430-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/1728-429-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1728-435-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/1728-436-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/1728-437-0x0000000000080000-0x0000000000102000-memory.dmp

        Filesize

        520KB

        Download

      • memory/2080-16-0x00000000062F0000-0x000000000679C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2080-19-0x0000000000FC0000-0x000000000146C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2080-1-0x00000000779E0000-0x00000000779E2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2080-2-0x0000000000FC1000-0x0000000000FEF000-memory.dmp

        Filesize

        184KB

        Download

      • memory/2080-3-0x0000000000FC0000-0x000000000146C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2080-5-0x0000000000FC0000-0x000000000146C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2080-6-0x0000000000FC0000-0x000000000146C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2080-11-0x0000000000FC0000-0x000000000146C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2080-0-0x0000000000FC0000-0x000000000146C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2212-38-0x00000000009B4000-0x00000000009B5000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2468-331-0x0000000000940000-0x0000000000994000-memory.dmp

        Filesize

        336KB

        Download

      • memory/2484-122-0x00000000003E0000-0x000000000047C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/2800-20-0x0000000000AA1000-0x0000000000ACF000-memory.dmp

        Filesize

        184KB

        Download

      • memory/2800-472-0x00000000066F0000-0x0000000006D8A000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/2800-332-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-527-0x00000000066F0000-0x0000000006951000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2800-180-0x00000000066F0000-0x0000000006951000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2800-303-0x00000000066F0000-0x0000000006D8A000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/2800-181-0x00000000066F0000-0x0000000006951000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2800-526-0x00000000066F0000-0x0000000006951000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2800-524-0x00000000061D0000-0x0000000006413000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2800-24-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-135-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-17-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-302-0x00000000066F0000-0x0000000006D8A000-memory.dmp

        Filesize

        6.6MB

        Download

      • memory/2800-21-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-22-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-133-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-65-0x0000000000AA0000-0x0000000000F4C000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2800-131-0x00000000061D0000-0x0000000006413000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2800-132-0x00000000061D0000-0x0000000006413000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2936-113-0x0000000000C00000-0x0000000000C68000-memory.dmp

        Filesize

        416KB

        Download

      • memory/3000-90-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-94-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-79-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-83-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-85-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-91-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3000-87-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-81-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-93-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-110-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/3000-92-0x0000000000400000-0x0000000000531000-memory.dmp

        Filesize

        1.2MB

        Download