Analysis
- max time kernel
56s - max time network
146s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
07/10/2024, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48e040a64c6cc7db7bc79730c51d67f5.exe
Resource
win7-20240903-en
windows7-x64
31 signatures
150 seconds
General
- Target 48e040a64c6cc7db7bc79730c51d67f5.exe
- Size 1.8MB
- Sample241007-ddv8ps1emk
- SHA256 fc3286ee1ef68ef62e2dd2652d5a37b9a24bf47f2c0e81b1c4023ec0c64a7146
- MD5 48e040a64c6cc7db7bc79730c51d67f5
- SHA1 e84a71654dc5915b2ee1627854478b646bf77ac0
- SHA512 4e25bfc0d4ab743323167f3ed0ad3965d15a23df4f2e1ead1665197c43c8998638382b437043f92aaf60ffbd44c1594eaa972355b6261b7dcb2ebf2b5f6fa674
- SSDEEP 49152:g0SKAoUNAHyKgK5L4bLPafsDPT6o2hWNQrv:FSAgAHP0bLPafsf6ZwSL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
amadey
Version
-
4.42
Botnet
-
9c9aa5
C2
-
http://185.215.113.43
Attributes
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
rc4.plain
Extracted
Family
-
stealc
Botnet
-
doma
C2
-
http://185.215.113.37
Attributes
-
url_path
/e2b1563c6670f193.php
Extracted
Family
-
lumma
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 48e040a64c6cc7db7bc79730c51d67f5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7d515b6fb2.exe - Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 48e040a64c6cc7db7bc79730c51d67f5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7d515b6fb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7d515b6fb2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 48e040a64c6cc7db7bc79730c51d67f5.exe - Executes dropped EXE 4 IoCs
pid Process 2764 skotes.exe 2888 49b9e56798.exe 2464 num.exe 760 7d515b6fb2.exe - Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine 48e040a64c6cc7db7bc79730c51d67f5.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine 7d515b6fb2.exe - Loads dropped DLL 8 IoCs
pid Process 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 2764 skotes.exe 2764 skotes.exe 2764 skotes.exe 2764 skotes.exe 2764 skotes.exe 2464 num.exe 2464 num.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\num.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000336001\\num.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\7d515b6fb2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000349001\\7d515b6fb2.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\49b9e56798.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000332001\\49b9e56798.exe" skotes.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0007000000016ca0-28.dat autoit_exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 2764 skotes.exe 760 7d515b6fb2.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 48e040a64c6cc7db7bc79730c51d67f5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language num.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49b9e56798.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48e040a64c6cc7db7bc79730c51d67f5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d515b6fb2.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 num.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString num.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Kills process with taskkill 5 IoCs
pid Process 316 taskkill.exe 1548 taskkill.exe 1012 taskkill.exe 660 taskkill.exe 288 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 7d515b6fb2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 7d515b6fb2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 7d515b6fb2.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 2764 skotes.exe 2888 49b9e56798.exe 2968 chrome.exe 2968 chrome.exe 2464 num.exe 2888 49b9e56798.exe 760 7d515b6fb2.exe 2464 num.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2888 49b9e56798.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 288 taskkill.exe Token: SeDebugPrivilege 316 taskkill.exe Token: SeDebugPrivilege 1548 taskkill.exe Token: SeDebugPrivilege 1012 taskkill.exe Token: SeDebugPrivilege 660 taskkill.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe Token: SeShutdownPrivilege 2968 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2968 chrome.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe 2888 49b9e56798.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2764 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 30 PID 2424 wrote to memory of 2764 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 30 PID 2424 wrote to memory of 2764 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 30 PID 2424 wrote to memory of 2764 2424 48e040a64c6cc7db7bc79730c51d67f5.exe 30 PID 2764 wrote to memory of 2888 2764 skotes.exe 32 PID 2764 wrote to memory of 2888 2764 skotes.exe 32 PID 2764 wrote to memory of 2888 2764 skotes.exe 32 PID 2764 wrote to memory of 2888 2764 skotes.exe 32 PID 2888 wrote to memory of 288 2888 49b9e56798.exe 33 PID 2888 wrote to memory of 288 2888 49b9e56798.exe 33 PID 2888 wrote to memory of 288 2888 49b9e56798.exe 33 PID 2888 wrote to memory of 288 2888 49b9e56798.exe 33 PID 2888 wrote to memory of 316 2888 49b9e56798.exe 36 PID 2888 wrote to memory of 316 2888 49b9e56798.exe 36 PID 2888 wrote to memory of 316 2888 49b9e56798.exe 36 PID 2888 wrote to memory of 316 2888 49b9e56798.exe 36 PID 2888 wrote to memory of 1548 2888 49b9e56798.exe 38 PID 2888 wrote to memory of 1548 2888 49b9e56798.exe 38 PID 2888 wrote to memory of 1548 2888 49b9e56798.exe 38 PID 2888 wrote to memory of 1548 2888 49b9e56798.exe 38 PID 2888 wrote to memory of 1012 2888 49b9e56798.exe 40 PID 2888 wrote to memory of 1012 2888 49b9e56798.exe 40 PID 2888 wrote to memory of 1012 2888 49b9e56798.exe 40 PID 2888 wrote to memory of 1012 2888 49b9e56798.exe 40 PID 2888 wrote to memory of 660 2888 49b9e56798.exe 42 PID 2888 wrote to memory of 660 2888 49b9e56798.exe 42 PID 2888 wrote to memory of 660 2888 49b9e56798.exe 42 PID 2888 wrote to memory of 660 2888 49b9e56798.exe 42 PID 2888 wrote to memory of 2968 2888 49b9e56798.exe 44 PID 2888 wrote to memory of 2968 2888 49b9e56798.exe 44 PID 2888 wrote to memory of 2968 2888 49b9e56798.exe 44 PID 2888 wrote to memory of 2968 2888 49b9e56798.exe 44 PID 2968 wrote to memory of 856 2968 chrome.exe 45 PID 2968 wrote to memory of 856 2968 chrome.exe 45 PID 2968 wrote to memory of 856 2968 chrome.exe 45 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46 PID 2968 wrote to memory of 408 2968 chrome.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\48e040a64c6cc7db7bc79730c51d67f5.exe"C:\Users\Admin\AppData\Local\Temp\48e040a64c6cc7db7bc79730c51d67f5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1000332001\49b9e56798.exe"C:\Users\Admin\AppData\Local\Temp\1000332001\49b9e56798.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:288
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67b9758,0x7fef67b9768,0x7fef67b97785⤵PID:856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:25⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:85⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:85⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:15⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:15⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1476 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:25⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1468 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:15⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=1224,i,14850764613420466387,15959119817442335811,131072 /prefetch:85⤵PID:2560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2464
-
-
C:\Users\Admin\AppData\Local\Temp\1000349001\7d515b6fb2.exe"C:\Users\Admin\AppData\Local\Temp\1000349001\7d515b6fb2.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:352
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\107c5024-6a06-47e6-8245-d7613369603d.tmp
- Size 6KB
- SHA256 40fa68a8230a86a05aec63e3372e283d011fb1c1bf8c7ccdaeffa868d13af0b0
- MD5 9b571600933661af9cdbb9fc1cd0e35f
- SHA1 33ff2bc1802db1e0683f2265d80dc41a1b88153d
- SHA512 3616016fa9ce25a12d3cfe0de9957298bf13417b50bf376c681b8074a754c6cb096670f9203eeb9f013ee6fb6e365e48878297775cc8b42ecd65df2de758506e
- SSDEEP 96:VJaGKIp8hd8iZejovvb+y7Di+6MsmdeXCk01lKOBOzCGjVhYtjEsXt0/cg2Vup:VIGE8J6j+yy+F7k0DtGotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
- Size 16B
- SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
- MD5 aefd77f47fb84fae5ea194496b44c67a
- SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
- SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 3d5539786d236e03647fcdec81a3c47d2f8c7b2035c67de6eabdd40d3ce6b899
- MD5 989ecdb496d2cb934189b7237c49d5b7
- SHA1 c9202cda6b1cc46f435ddbe8d791d3c395a9629e
- SHA512 38711c5da726d41b86c86865d370d347573faee19c352fa8fa5a5133e2b92a1842ce072ac3fd8eadab0e72df0ad89bb831bdfdcd3ca6a118e014ef4832afceb1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 c20b10b08cdd68bf3cae5c1b8931936e55d8c3747993a3948965b545f32fae54
- MD5 2258bef2fc0dadd253e643232ed6b3b7
- SHA1 518b2a0e5c3e332d84c0b62841fa6f05661ccbd0
- SHA512 371295b3c33f1f5f49a726d98b4e0e22099cc91dc4cf069bc780f1370e5a49c8f58d40206ed8187c70ca826f590ac2ffeb78043c36019a13e144f2a3ec36ef01
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
- Size 16B
- SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
- MD5 18e723571b00fb1694a3bad6c78e4054
- SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
- SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1000332001\49b9e56798.exe
- Size 897KB
- SHA256 dcf4f1805dd7b15d4cc43003a3915a484b804654288e3a5d01e8c8cc15a021fd
- MD5 6de1e2c886ac553ec26ac814050f5ada
- SHA1 dc7c2d51395c280fd79f61a5f8cbf9f292241fad
- SHA512 ad3c6abda9bb2e3d708192f80b615abf323156d48ca10a7c5e5592f50c018e89ec746679f0f041e4c3a5d7ec4ea60915e0e2c5adfa9be3fb1c88661b168d4600
- SSDEEP 24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8a4PK:7TvC/MTQYxsWR7a4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
- Size 307KB
- SHA256 27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d
- MD5 791fcee57312d4a20cc86ae1cea8dfc4
- SHA1 04a88c60ae1539a63411fe4765e9b931e8d2d992
- SHA512 2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c
- SSDEEP 6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1000349001\7d515b6fb2.exe
- Size 1.8MB
- SHA256 7c343857fa559a62797ba9d323db74d06835a28880e3f4bb2dd623fe7d01f38c
- MD5 7804b518ce9535a798561bea1b522339
- SHA1 963d686ae99f85e567cdf912a88c1d6a63ef4542
- SHA512 a3ef990d4ea338b4a77b96d28fc3685cd916ed2d8cfcd588c48716f73c30889d27e9b2353b9343101c1d2670f496feec1b7a9e609b576c80ec750e2986311b3e
- SSDEEP 24576:KXfI6+MAK82PiJCyoW6UYnb8UM9ut87MgPisGrdwxTLcW2F873RnrDYzEL9a2HC9:KXb+x0uj6NIMUMb5K4J69YYNitfsO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab45AA.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar4ACB.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP
- Path \ProgramData\mozglue.dll
- Size 593KB
- SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
- MD5 c8fd9be83bc728cc04beffafc2907fe9
- SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
- SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
- SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
- MD5 SHA1 SHA512 SSDEEP
- Path \ProgramData\nss3.dll
- Size 2.0MB
- SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
- MD5 1cc453cdf74f31e4d913ff9c10acdde2
- SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
- SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
- SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
- Size 1.8MB
- SHA256 fc3286ee1ef68ef62e2dd2652d5a37b9a24bf47f2c0e81b1c4023ec0c64a7146
- MD5 48e040a64c6cc7db7bc79730c51d67f5
- SHA1 e84a71654dc5915b2ee1627854478b646bf77ac0
- SHA512 4e25bfc0d4ab743323167f3ed0ad3965d15a23df4f2e1ead1665197c43c8998638382b437043f92aaf60ffbd44c1594eaa972355b6261b7dcb2ebf2b5f6fa674
- SSDEEP 49152:g0SKAoUNAHyKgK5L4bLPafsDPT6o2hWNQrv:FSAgAHP0bLPafsf6ZwSL
- MD5 SHA1 SHA512 SSDEEP