plugx | d64e5a258078f6655b3aa40e7bb897ff9856151b4adcdd1f5723a8b9e02bb88a

General

Target

29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Size

257KB
MD5

29f0bc408d724050e92230285592be7f
SHA1

d31fca6aea10ed571d2ffce375cfd27b6d0871f3
SHA256

d64e5a258078f6655b3aa40e7bb897ff9856151b4adcdd1f5723a8b9e02bb88a
SHA512

24b5ff00b7dc75e292ee104e1d9176e25c45df3907470ec2795754c026c2db02023249cffacc0757fdd10882d1ba26488350e0bbd29b4b6e5feebce5fafe9f89
SSDEEP

6144:S0L10u6oC8DyzBcniBdBuGoEim9N1vXp:S0Z0jV8DacnchJ

Score

10^/10

plugx discovery trojan

Malware Config

Signatures

Detects PlugX payload 22 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2968-2-0x00000000002A0000-0x00000000002DC000-memory.dmp	family_plugx
behavioral1/memory/1844-23-0x00000000001B0000-0x00000000001EC000-memory.dmp	family_plugx
behavioral1/memory/2796-28-0x00000000004C0000-0x00000000004FC000-memory.dmp	family_plugx
behavioral1/memory/1844-38-0x00000000001B0000-0x00000000001EC000-memory.dmp	family_plugx
behavioral1/memory/2792-37-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2968-35-0x00000000002A0000-0x00000000002DC000-memory.dmp	family_plugx
behavioral1/memory/2792-54-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-53-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-52-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-40-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2796-58-0x00000000004C0000-0x00000000004FC000-memory.dmp	family_plugx
behavioral1/memory/2792-63-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-59-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-57-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/1844-66-0x00000000001B0000-0x00000000001EC000-memory.dmp	family_plugx
behavioral1/memory/2792-67-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-68-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/1484-76-0x0000000000480000-0x00000000004BC000-memory.dmp	family_plugx
behavioral1/memory/1484-79-0x0000000000480000-0x00000000004BC000-memory.dmp	family_plugx
behavioral1/memory/1484-78-0x0000000000480000-0x00000000004BC000-memory.dmp	family_plugx
behavioral1/memory/2792-80-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx
behavioral1/memory/2792-84-0x00000000002D0000-0x000000000030C000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Deletes itself 1 IoCs

Processes:

rc.exe

pid process

1844 rc.exe
Executes dropped EXE 2 IoCs

Processes:

rc.exerc.exe

pid process

1844 rc.exe
2796 rc.exe
Loads dropped DLL 4 IoCs

Processes:

29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exerc.exe

pid process

2968 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
2968 29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
1844 rc.exe
2796 rc.exe

pid	process
1844	rc.exe

pid	process
1844	rc.exe
2796	rc.exe

pid	process
2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
1844	rc.exe
2796	rc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

svchost.exemsiexec.exe29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exerc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rc.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\fe-29-98-08-e9-ca	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = b0c71278421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = f0ea8880421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = f0ab6b91421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = 50e8d599421adb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = d0fe16b3421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = f0ab6b91421adb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = 90e1136e421adb01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDetectedUrl	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = d0fe16b3421adb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = 3067a16f421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = b0c71278421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = b02440a2421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = 70c2acaa421adb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = f0ea8880421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = 5027f388421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = 50e8d599421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = b02440a2421adb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = 90e1136e421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca\WpadDecisionTime = 3067a16f421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = 5027f388421adb01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionTime = 70c2acaa421adb01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-29-98-08-e9-ca	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9174E6ED-9E4B-4C4D-B99A-77BD2D1DE58C}\WpadDecisionReason = "1"	svchost.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 39003300380036003000300046003800320038003700300044003600360031000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exemsiexec.exe

pid	process
2792	svchost.exe
2792	svchost.exe
2792	svchost.exe
2792	svchost.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
2792	svchost.exe
2792	svchost.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
2792	svchost.exe
2792	svchost.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
2792	svchost.exe
2792	svchost.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
2792	svchost.exe
2792	svchost.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
1484	msiexec.exe
2792	svchost.exe
2792	svchost.exe
1484	msiexec.exe
1484	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exemsiexec.exe

pid process

2792 svchost.exe
1484 msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exerc.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Token: SeTcbPrivilege	2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
Token: SeDebugPrivilege	1844	rc.exe
Token: SeTcbPrivilege	1844	rc.exe
Token: SeDebugPrivilege	2796	rc.exe
Token: SeTcbPrivilege	2796	rc.exe
Token: SeDebugPrivilege	2792	svchost.exe
Token: SeTcbPrivilege	2792	svchost.exe
Token: SeDebugPrivilege	1484	msiexec.exe
Token: SeTcbPrivilege	1484	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

29f0bc408d724050e92230285592be7f_JaffaCakes118.exerc.exesvchost.exe

description	pid	process	target process
PID 2968 wrote to memory of 1844	2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	rc.exe
PID 2968 wrote to memory of 1844	2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	rc.exe
PID 2968 wrote to memory of 1844	2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	rc.exe
PID 2968 wrote to memory of 1844	2968	29f0bc408d724050e92230285592be7f_JaffaCakes118.exe	rc.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2796 wrote to memory of 2792	2796	rc.exe	svchost.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe
PID 2792 wrote to memory of 1484	2792	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\29f0bc408d724050e92230285592be7f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29f0bc408d724050e92230285592be7f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\ProgramData\SxS\rc.exe
  "C:\ProgramData\SxS\rc.exe" 100 2968
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1844

C:\ProgramData\SxS\rc.exe
"C:\ProgramData\SxS\rc.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 2792
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\bug.log

Filesize
622B

MD5
9e8e6057b530364a68d5958293d7c027

SHA1
6fc35b63664862f8bd3998ef9d1afbaa426a6434

SHA256
b3ebaa9bb70029fffa67155f57ab193d0172782e56b32206dbefa019a3e6e27b

SHA512
9764fc2d1c5a190ef06f7ad3a19c546bca6d370d9841a19b4b78c031efc39487f7d52174a03ba555e7e09f8f83bc0f6d9c563f6fb74c47cba5045ac7f7944444

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
764B

MD5
f23d606fdb65d9821fb013c22fcec461

SHA1
60b9817f04c003225014e84ff15f1866a00dd60c

SHA256
7a23427ae8c553b799a44d73f6dffa1c0f9f0433537c49335188564f06c95b36

SHA512
8243977158f3c0162c8fe14400f51f0b6ce2cc2d42b777777cc4b19767067a161cb917b32f3ab442998e640e66ac84d576dc1247e25aa7c3c9afc10b88a42e25

Download Submit
C:\ProgramData\SxS\rc.hlp

Filesize
167KB

MD5
d63ded61435f458b8e22f8bca68393f0

SHA1
8a828124d6b66f35018954226194ad2048ca46e9

SHA256
1a865b1a682fba71276f0bfaf454846663dc7e18680271ebd346ccdef3b4b54c

SHA512
e19befc0cfbf8e3b2ebbf88fea76a83d5cb989775ce35600fc50084e3f932da9dc5b786e17ce8374fd68f21eaa9f8bef9a6e278a6a88f4261c63b934405f3707

Download Submit
\ProgramData\SxS\rc.exe

Filesize
67KB

MD5
3560bc05de9f7ef2df54495a4c6774f8

SHA1
7f64b41b320913ecc10bbe251fe1f169c5520d20

SHA256
83be17ad26522c9e0e6b28c8638c6548908baeb1e945db77b747ff85e74fea3c

SHA512
1ca4533b00800d0c68560983993dfccc600e1405583cb597fbb5c7248f81b6399d9976857a945453e5cf7e2778ae1e3f28c69c6af1d09bf8b7166c71d4b94740

Download Submit
\ProgramData\SxS\rcdll.dll

Filesize
4KB

MD5
950d81456a42e1c39a6660554501f91e

SHA1
bf673d59936c221736fdf55fc4f1816bff6e5dfd

SHA256
85ff99a6e80c0b86cca82ee28610411edcb8b703b4d8e3fd91bfd4938b7c3180

SHA512
90963d5b1c1072ce3e681d8a59fdd3e9547db53204ae1798e44afd3bf91907c26f9d3f793c566ee0dd2811fed9db7ffe0815e6edf11aa8da6b7ca52bd41a34ee

Download Submit
memory/1484-79-0x0000000000480000-0x00000000004BC000-memory.dmp

Filesize
240KB

Download
memory/1484-77-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1484-78-0x0000000000480000-0x00000000004BC000-memory.dmp

Filesize
240KB

Download
memory/1484-76-0x0000000000480000-0x00000000004BC000-memory.dmp

Filesize
240KB

Download
memory/1484-75-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1844-23-0x00000000001B0000-0x00000000001EC000-memory.dmp

Filesize
240KB

Download
memory/1844-22-0x00000000002A0000-0x00000000003A0000-memory.dmp

Filesize
1024KB

Download
memory/1844-38-0x00000000001B0000-0x00000000001EC000-memory.dmp

Filesize
240KB

Download
memory/1844-66-0x00000000001B0000-0x00000000001EC000-memory.dmp

Filesize
240KB

Download
memory/2792-51-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2792-33-0x00000000000A0000-0x00000000000C9000-memory.dmp

Filesize
164KB

Download
memory/2792-53-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-52-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-84-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-40-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-80-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-31-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2792-63-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-59-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-57-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-36-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2792-67-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-68-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-37-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2792-34-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download
memory/2792-54-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2796-28-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/2796-58-0x00000000004C0000-0x00000000004FC000-memory.dmp

Filesize
240KB

Download
memory/2968-35-0x00000000002A0000-0x00000000002DC000-memory.dmp

Filesize
240KB

Download
memory/2968-2-0x00000000002A0000-0x00000000002DC000-memory.dmp

Filesize
240KB

Download
memory/2968-0-0x0000000000170000-0x000000000019A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads