raccoon | 29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
Size

916KB
MD5

507d8b23a93c2f5832c2585f1a6b602d
SHA1

657ccb76cf81e45114364e8ee287dce0257bc835
SHA256

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514
SHA512

f7a3aa549267e6d84d0664ad152bf46ec87c606bc74e29750f2a5725a8fa0aef23f87362eee11cf9c6c7855d30c3592baa77f38975d47ab351d04ff64c6528ac
SSDEEP

24576:pAT8QE+kEVNpJc7Ycw4Th7k16ThM5dJ5Om46EYjdnx+Z3:pAI+bNpJc7Yc7dXUxOm46Fnx+Z3

Score

10^/10

raccoon redline vidar 1521 1571 5 5076357887 76426c3f362f5a47a469f0e9d8bc3eef afb5c633c4650f69312baef49db9dfa4 nam3 discovery infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

vidar

Version

53.8

Botnet

1571

https://t.me/spmhaus

https://c.im/@tiagoa33

Attributes

profile_id
1571

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

vidar

Version

53.8

Botnet

1521

http://62.204.41.126:80

Attributes

profile_id
1521

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://193.56.146.177

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

http://45.95.11.158/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/files/0x0007000000019470-49.dat	family_redline
behavioral1/files/0x0005000000019fd4-60.dat	family_redline
behavioral1/files/0x0005000000019fdd-70.dat	family_redline
behavioral1/memory/2572-85-0x00000000008F0000-0x0000000000910000-memory.dmp	family_redline
behavioral1/memory/2496-84-0x00000000001E0000-0x0000000000224000-memory.dmp	family_redline
behavioral1/memory/716-83-0x0000000001050000-0x0000000001070000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 7 IoCs

pid	Process
1804	F0geI.exe
2564	kukurzka9000.exe
2572	namdoitntn.exe
2324	real.exe
2496	safert44.exe
716	jshainx.exe
1760	me.exe

Loads dropped DLL 11 IoCs

pid	Process
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
24	iplogger.org
25	iplogger.org
27	iplogger.org
28	iplogger.org
4	iplogger.org
22	iplogger.org
21	iplogger.org
26	iplogger.org
29	iplogger.org
19	iplogger.org
20	iplogger.org

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\me.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	real.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kukurzka9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	namdoitntn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	safert44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jshainx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0geI.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D4D8531-90A0-11EF-8B1E-52DE62627832} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D419E51-90A0-11EF-8B1E-52DE62627832} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D48C271-90A0-11EF-8B1E-52DE62627832} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e7a6e4ac24db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000060cb501e0cd58798d96edcee87ba381c2e3af5607bdb2f46fd2a3cee9747b502000000000e8000000002000020000000e4873385e36f852e50b54dc11f57b81d681adf218d484236f35d572feb76bdb590000000fb5b1b87521ab83678ce475c21df19449c7c0fb6ef8b2ad384d4b2d9200aa1fbe6d5f272f4cedef0cdeabcc101a10dfea3efdcb1b120845b71d8d3f7450af4d0060d14c8a644e0e3105974c50d491658ca041a9f524d9ddd55544340795094f66fdb3ec186946542afc797c37c146297307a10b073cad7a0ee674c48a04bc1e68d00c26f53dd2c20fba493923406e15940000000148fa5089f506808faf1b85a32354d711714498147794c6c0d25ca65175d84b806b6380bb5575e74d14eaa4ec8fc39e6080a2a1aee1593eef1c66cd00ab4f02c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2692	iexplore.exe
3052	iexplore.exe
2720	iexplore.exe
2668	iexplore.exe
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
3052	iexplore.exe
3052	iexplore.exe
2720	iexplore.exe
2720	iexplore.exe
2868	iexplore.exe
2868	iexplore.exe
2668	iexplore.exe
2668	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
548	IEXPLORE.EXE
548	IEXPLORE.EXE
548	IEXPLORE.EXE
548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3052	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2872 wrote to memory of 3052	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2872 wrote to memory of 3052	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2872 wrote to memory of 3052	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2872 wrote to memory of 2692	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2872 wrote to memory of 2692	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2872 wrote to memory of 2692	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2872 wrote to memory of 2692	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2872 wrote to memory of 2868	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2872 wrote to memory of 2868	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2872 wrote to memory of 2868	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2872 wrote to memory of 2868	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2872 wrote to memory of 2720	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2872 wrote to memory of 2720	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2872 wrote to memory of 2720	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2872 wrote to memory of 2720	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2872 wrote to memory of 2668	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2872 wrote to memory of 2668	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2872 wrote to memory of 2668	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2872 wrote to memory of 2668	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2872 wrote to memory of 1804	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2872 wrote to memory of 1804	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2872 wrote to memory of 1804	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2872 wrote to memory of 1804	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2872 wrote to memory of 2564	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2872 wrote to memory of 2564	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2872 wrote to memory of 2564	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2872 wrote to memory of 2564	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2692 wrote to memory of 2288	2692	iexplore.exe	37
PID 2692 wrote to memory of 2288	2692	iexplore.exe	37
PID 2692 wrote to memory of 2288	2692	iexplore.exe	37
PID 2692 wrote to memory of 2288	2692	iexplore.exe	37
PID 2872 wrote to memory of 2572	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2872 wrote to memory of 2572	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2872 wrote to memory of 2572	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2872 wrote to memory of 2572	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 3052 wrote to memory of 2704	3052	iexplore.exe	39
PID 3052 wrote to memory of 2704	3052	iexplore.exe	39
PID 3052 wrote to memory of 2704	3052	iexplore.exe	39
PID 3052 wrote to memory of 2704	3052	iexplore.exe	39
PID 2872 wrote to memory of 2324	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2872 wrote to memory of 2324	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2872 wrote to memory of 2324	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2872 wrote to memory of 2324	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2872 wrote to memory of 2496	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2872 wrote to memory of 2496	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2872 wrote to memory of 2496	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2872 wrote to memory of 2496	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2720 wrote to memory of 2632	2720	iexplore.exe	42
PID 2720 wrote to memory of 2632	2720	iexplore.exe	42
PID 2720 wrote to memory of 2632	2720	iexplore.exe	42
PID 2720 wrote to memory of 2632	2720	iexplore.exe	42
PID 2872 wrote to memory of 716	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	43
PID 2872 wrote to memory of 716	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	43
PID 2872 wrote to memory of 716	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	43
PID 2872 wrote to memory of 716	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	43
PID 2868 wrote to memory of 548	2868	iexplore.exe	44
PID 2868 wrote to memory of 548	2868	iexplore.exe	44
PID 2868 wrote to memory of 548	2868	iexplore.exe	44
PID 2868 wrote to memory of 548	2868	iexplore.exe	44
PID 2872 wrote to memory of 1760	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	45
PID 2872 wrote to memory of 1760	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	45
PID 2872 wrote to memory of 1760	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	45
PID 2872 wrote to memory of 1760	2872	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	45

C:\Users\Admin\AppData\Local\Temp\29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
"C:\Users\Admin\AppData\Local\Temp\29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2704
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2288
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:548
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2632
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nN6Z4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2668
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1408
- C:\Program Files (x86)\Company\NewProduct\F0geI.exe
  "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1804
- C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
  "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2564
- C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
  "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Program Files (x86)\Company\NewProduct\real.exe
  "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Program Files (x86)\Company\NewProduct\safert44.exe
  "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2496
- C:\Program Files (x86)\Company\NewProduct\jshainx.exe
  "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:716
- C:\Program Files (x86)\Company\NewProduct\me.exe
  "C:\Program Files (x86)\Company\NewProduct\me.exe"
  2⤵
  - Executes dropped EXE
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\me.exe

Filesize
274KB

MD5
2eee4c301ce357df8f235957fcb774b3

SHA1
f9fd1eac58b5f40475269a1e8eb1675227e2389c

SHA256
66cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1

SHA512
590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc

Download Submit
C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
724fdfa076faa1c7d8bba495ef7a4e28

SHA1
f02173a1e469bbe6a4ab5be86932b442fce5e81a

SHA256
4e20543da067cc2f1b5f266daecd6c0c58ae8198677abdbd687ecffafc382758

SHA512
27dc091240ecdb933a37189c9b3adee06969895ee6ee2eb213c603c7659ef8c1e83457f45973cbc34c93ca0a4e5a9731863e6ed5e5536a6106f8fdc1c0e6a340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
151e5188ea0f7fec99bbc6de28cd635c

SHA1
a7a6ec4f083d43c1e7d00ce9bde2c52f996ebe31

SHA256
8f0aefbae28d388e23bf79183973dd71f9713a33d0f63f903304a635ae02befc

SHA512
5e2e93757438d03fb4b0f5dd723ea0a42cea98e3b0e23dcdc196271c15586c06b173ff3e8e0f7f99d6fa942ae8787fc646652d20c5ea9e64e7e22423dfa335d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2e1bbd58c256131854db49bb599a7aa

SHA1
74cf48288ab7dbbdbfc83bde9c5ff3cf81d5de11

SHA256
a165297d85b77e339305bc8f41270c02cdf513a02288d5116f2f69205b91049c

SHA512
220ccea539f5d486dc5487670767ed5bab933e66e886f98a0c8361ffd63e05484094bbcf0650dc385783930f6082c1f013ff1512212b75a857d0a272847aa384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
730d2364d23f5b18986c67bab6e115a7

SHA1
fa44bb356f2af88bfe9327a903e8ecdcff814d14

SHA256
4a96208e05f9c3a776d8a4de01523a1a80e6168dcbb43c3beda22949d0920e21

SHA512
4cf4ac166ed675136e5fdd79371308a97e3fddc55fb82c4e6ea7260eca5d94c244c8b2e13b7225dcc4ea11617d48bd040f296e4c186d2a351eb8e0c04b649921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b439631cc54dba88a136f7ec707f090a

SHA1
d8a2d1ee5a4de8384d5df212fae8e09d349b4b22

SHA256
a6365a8d8b294f49241c53501c7a7b72584b0d1ef8ab5323a5e2682eb6fc6a19

SHA512
d02d546bfdd3a45928a73cd5ae7a445585eba6152b54860907e469fd325ee8698c4e57ea0cc6cbdee9231dd9e61ccacdf06577a6ba1d5e1f4844a2be11c2568c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba0da4bf51a38a1587736b9ae647ff15

SHA1
3dec0e9cfb2e3fd342687fcdd98a96df887b799b

SHA256
73eb67bcf081cea5761f02d90802d3959dd66c7c7a5d4d96c91c1aa64cc30cb9

SHA512
0339bee74c8efe96c774df0b25794aaf802cf2699c4371106c1067bae199c79ba5bab2e6bf01a6912f68c21e1f96064398c1a88c207b0aa5edda17ddd483af8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a320237029c75b47bad47021df45564a

SHA1
f2a242fe49c14bb3d6d4807131d7d1484aee2042

SHA256
a8699da80c2dd29a259cc0b0102ea2a2b6e21ae335a090f6e0509ca71ecfb19d

SHA512
40c8974167b48d1f3c3f67592885e4f1c9a567a543b28889e2427af6d97813dc918807ecec1d37cdbea8f9ac4ba9bff715940a0a7c54ded793506bd2333f4fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4588aa2e7beb08f0153dbd88e8780470

SHA1
3a40640dafc42cf90c8dce3e58a68db0971e7512

SHA256
43234f02e9b3ad4005e8c77b7d2a6c631ef9da6129d7f497a79560cea6cec51d

SHA512
dc7d45ad93502be1f9a89eea122f18f22c5b09dfb9ca5bbd1ea445977ef15662d31d96dceac22a6a6b46b17e09ce0328e86f1d19f9d621bb0ba9a59a45b85cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6daa326666af6b830139c5735778621

SHA1
15a226740b92d0fd68d1d3feacd6984aaa919bf5

SHA256
0e28c740c3c8ccc76d5f9993bc29fd43db10f28f07eaffd94ff8221a0641e9bf

SHA512
199828f77e14a84e9ceab40feede3d0ff5a5ec2468b8efcf5d029ee3550128054c231f3d31e16e1609758cab86c2ddc33bdf8b6a1363dbc1a0bdb7de58693dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4a353bcfd0f05a380ccaf5d73b3bbca

SHA1
5d8f6f26a860f96500d1ba13a9357eee43858439

SHA256
1fbdb8e7acfcf7803f08775970ef8267d8a843c17736412c07d8420fd9369515

SHA512
84e21c49e98b55666f10a04bdd60b171bba5d9c65f5b05cf2d20a388661b47fa9dfe296473115167586fb02028526f710abd6a373f588671f5c0a79c3e7e6127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d77714088cd1b2530b817433641e546

SHA1
c25b99e75dd6fb9f40cea300027cdda180b400c3

SHA256
26a1dbfa9fc50d157d52e2018c54ac1e15a411b6359d00bb289e2eab8dffb76b

SHA512
14a4e75e76f092f418330c4f6a3776dba326f7031df04d667ac76514b64feebf08ddd0ffafb8ec6370b41f9f9e1e5172455857d3f13edf9843dc635a51d0f102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e9d642161968f6dd7ca2d6bc0200bea

SHA1
31a4a47f3b0f93974c5797c364e02ef533692c00

SHA256
7d7457e23453e23914a187f18a7fd02371b7b097a44731173938ed1df9878ef2

SHA512
bf3a517f873625c028620784f94b2f21d7f3e11926a216e0d309a910c56b07cccc35382b7cf84a648aef973e3e7a5c5cc05eaa8f779ce23e20360ca5409e87c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d88e433329ee9ce80cf867c6c86708

SHA1
eedbde84143e2f004fc21b2eed8f4cefa1c96400

SHA256
77a538b6629091c7024c9cfd303d985eef67c5568012bbf8c4209f699e80616a

SHA512
fc6ee47579a6bd161a71a3936975977d1ff1c79ba995c0af30665392337ede83a5a4744cdb9d8c2689fdb05e25b434d7bd7dfd189efd2e07e1898dc8ca75b760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f0c8a700a9edc58cba8fcf4cf9b0a1a

SHA1
adb2c524d51bfc4063df7b36fac605dcaef62774

SHA256
b64f83374ab34b40d137b906f15f4a60b8306f3ca69367d3d9fc6ea4e90a78cd

SHA512
39ff9bebaea28a711d03dc35f00c2850f4e13fc5f7640c9d7bc56081cce780e8f8271092cf5b9ead4ab4f6001f47ce2b4dac347e3c65814e514d83539146c72b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9401e162a9bfa9213d9cb556be8c23b5

SHA1
aba05becb48975af2f4494146a55ed6b0b45bfb5

SHA256
015510a121923e09fc9c5091bf6452d692f1ee54adf194262ee75a847c676395

SHA512
8848ac0d2badb4742b9ff2e5327f6f642bb53688a6960db8b5d78f48c985c0735d7264c50d703b57d0d244f1172b7674a038557a7ea38dd00da959c2a03fb039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8301a454838f178b28934e1960f3c2d2

SHA1
02a22c67079e3c6e7d954c9dfe5922b5181d6519

SHA256
acbe245f79aa164b8f91438e94a2faa4debc32e46ceb7e2612dd5238382e9357

SHA512
111940efbec5b88316957a7f59bda43525bf64be7edc00adc1292ca4470c496805f220454be75e33e209e1bda4d9a825e1b991d75bf9d4df85a5f4437aae9138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fd6c97e84e01d785bf63fd359651db8

SHA1
502a3ad6418e66e821c86ac24c4fed294ed4da5e

SHA256
7c549fd123722967d1e00b06a42eae444ea666ad32d9376e18a9f0c79cf0fd4a

SHA512
44b4dc41360db76e07d9cde8053a44d32237e6c3ea249287a2e8ca40800d24833ec8b51227d3ddaef342d8aa289e58d8584b39493e8f6cd6c2180b9e53594789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12f325dc11b6a0d69ed124d3278c8dbc

SHA1
0939908afabdc23df1ef2b67c3c3eb491e6e4909

SHA256
bed60bea2e5295bfcca973d00e6eff5e6408264b5b032566ee5c821ca1697c76

SHA512
cae01deaf3b132e44e0140576afc15f1f5b20cbfb9862b0be0e172c5034cd6560c0b342b0485af1741287916f242f1d4a3566718a7c891ca9df12e312c337225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cf19b6822d3431f16c42305a7ce3bd9

SHA1
4e5bd25fcb3aed4e954f7503f7e6aeb883a94fae

SHA256
353b01eb4977049bafd8cce099a8656f89f990d9031aa7908afef65c9fe1ee75

SHA512
0c44c3282e4a10a139b3a8699605b274a23ef3ad24049bf13fc22ccb4ad745fb6aea1508cd5129fa98c4172ba96e5b4329981406aa88c63231dc7355ad1aff3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d508cfd232afeb4b6a6a8b8799e3c439

SHA1
282d1a020f9eec3ff189aba78f8b6bb1b447f323

SHA256
ace4c5928efd48166c0144be79be977d3773ff15f115c7e3ebb5cbd46bbe77ff

SHA512
b90b45ebf5c05096838d3645cdd18e22fb8df8b074e0edfa6021fce7bd1b60d0956e1caa824a59557721d828d7c9ad9acc7eeabbd5a743deada4cc76f87c64cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
545712265c593f095929d000efb62141

SHA1
aa05222cc91a988e0953a4657e60a97c7abe163d

SHA256
9601bf781541f1f36e928c8b155fe2a857d3f772fdc57b4fcc890cc72cd171a0

SHA512
8a4181c3b867620f9346284821ddeffdd6c1859260754166a2beee83ca7ca88985d693a08ad35c3812762138795a23c74bd3f8a62322f4d4c3d8db18f59aea50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
aeefbc26cb2e0d984abdb98060e7d290

SHA1
84de2cb59e907fd63aff16a132d466140c79c4dc

SHA256
7778f451b2058f2fc76ee91b37347bec623947c92423df046358d404eca19868

SHA512
e400fe63ac871b7d58673455e6513a99e3c33ec85f2bd484c9b4fa49966dd0715f7c8b9a99f91fb0011a6cd28f387dddbe5a1785ac7150f7b4a5a2f35d9b2011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
5331e8f9c37bc0aaaf363fc031860a55

SHA1
b314ed544f9108903c3baba8733a5d741874099a

SHA256
7226303200ae8abb97132422822a14f608b2b14df648219f5194f61c72bbd0c1

SHA512
c42747bd980f0a4ef90b41555da105886f4f4b4a442cac170e56d877280525b84db999f3c050b615e77e93fe830fda18c95e340a06af289f5bea46a3af51035b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
821030105fd346dafc85278478b09265

SHA1
4c9db0edf5290c47baff78babbde89c57bd51956

SHA256
1db1ae443f788b64ffa50456be6d915258bf1a5f2ffc2bcd1d1d970e615b9df2

SHA512
720b384a8e1106bc57f116449feee6d251bd57614941501d19dd0e9bc6110f3ea80c86adb6e10f8eed23451c13347eb3bbf2280a28dc1d6f6e0607df8f3feed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0D419E51-90A0-11EF-8B1E-52DE62627832}.dat

Filesize
4KB

MD5
ad7f3aeacfa97be72eb783ed5dbb5202

SHA1
cb511bdfb094c19c966d3290306aa25e800e3f90

SHA256
9b861431bccb0251d3ca34a66276b36c2459062b26c5f653f4eb2d60397c521c

SHA512
9e46399f79c2849b70d019546f2cbde7c5640cb998d2f3b7424eab93fe9efe816fbb85aa279d880533e01f275a98a1afdf99e89aa44a84de082460ddbd3432fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0D48C271-90A0-11EF-8B1E-52DE62627832}.dat

Filesize
5KB

MD5
4b8b6452ca7a2eca40de49cc5d154354

SHA1
cc37ecf23dc7c7fa87e4a14a82f7ace6ffe31ecc

SHA256
e0b473b62525d1807faefbdb2cbe91fc7c35920c429f24b6b53196ea0c63cfea

SHA512
baa1c5895f0923169fbd424b544503d8b3792c2d42aa3508b326b4831f933c05baa958a4099f771280a72a690bfaac402546d1ceff043a486a6fb61718d54be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0D4DAC41-90A0-11EF-8B1E-52DE62627832}.dat

Filesize
3KB

MD5
ebabc0b2c3354bfe82a9a312021fa10a

SHA1
6392530a1e6aafc46ace5d677cf3c80c7ee41237

SHA256
28ea42a89e8daed702e8e940766f5369acae65088949bbdfa9653ad9100fa639

SHA512
dfdda0564598c14c1beaee05f5c69fb6637bedfdf6144c18a0baee9da36393bb3025fe2feb71929c9f3d404f632da4c6037e76bbf2c413b9ad402f3861d92169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\1A4aK4[1].png

Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\favicon[2].png

Filesize
2KB

MD5
18c023bc439b446f91bf942270882422

SHA1
768d59e3085976dba252232a65a4af562675f782

SHA256
e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482

SHA512
a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab758D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75B0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Program Files (x86)\Company\NewProduct\F0geI.exe

Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Filesize
669KB

MD5
b5942a0be0b72e121dadb762044f38cc

SHA1
885909607a9747c11eac6cc47b775ad947980c5e

SHA256
c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1

SHA512
d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe

Filesize
275KB

MD5
a2414bb5522d3844b6c9a84537d7ce43

SHA1
56c91fc4fe09ce07320c03f186f3d5d293a6089d

SHA256
31f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173

SHA512
408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60

Download Submit
\Program Files (x86)\Company\NewProduct\safert44.exe

Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
memory/716-83-0x0000000001050000-0x0000000001070000-memory.dmp

Filesize
128KB

Download
memory/1804-413-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2496-87-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2496-84-0x00000000001E0000-0x0000000000224000-memory.dmp

Filesize
272KB

Download
memory/2564-194-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/2572-85-0x00000000008F0000-0x0000000000910000-memory.dmp

Filesize
128KB

Download
memory/2872-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads