raccoon | 29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514

Resubmissions

24-10-2024 19:39

241024-ydfs8s1hqn 10

22-10-2024 18:15

241022-wvzassxhmc 10

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
Size

916KB
MD5

507d8b23a93c2f5832c2585f1a6b602d
SHA1

657ccb76cf81e45114364e8ee287dce0257bc835
SHA256

29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514
SHA512

f7a3aa549267e6d84d0664ad152bf46ec87c606bc74e29750f2a5725a8fa0aef23f87362eee11cf9c6c7855d30c3592baa77f38975d47ab351d04ff64c6528ac
SSDEEP

24576:pAT8QE+kEVNpJc7Ycw4Th7k16ThM5dJ5Om46EYjdnx+Z3:pAI+bNpJc7Yc7dXUxOm46Fnx+Z3

Score

10^/10

raccoon redline vidar 1521 1571 5 5076357887 76426c3f362f5a47a469f0e9d8bc3eef afb5c633c4650f69312baef49db9dfa4 nam3 discovery infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

103.89.90.61:34589

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

vidar

Version

53.8

Botnet

1571

https://t.me/spmhaus

https://c.im/@tiagoa33

Attributes

profile_id
1571

Extracted

Family

redline

Botnet

5076357887

195.54.170.157:16525

Attributes

auth_value
0dfaff60271d374d0c206d19883e06f3

Extracted

Family

redline

Botnet

176.113.115.146:9582

Attributes

auth_value
d38b30c1ccd6c1e5088d9e5bd9e51b0f

Extracted

Family

vidar

Version

53.8

Botnet

1521

http://62.204.41.126:80

Attributes

profile_id
1521

Extracted

Family

raccoon

Botnet

afb5c633c4650f69312baef49db9dfa4

http://193.56.146.177

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Extracted

Family

raccoon

Botnet

76426c3f362f5a47a469f0e9d8bc3eef

http://45.95.11.158/

Attributes

user_agent
mozzzzzzzzzzz

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/files/0x00080000000175f7-45.dat	family_redline
behavioral1/files/0x0005000000019274-69.dat	family_redline
behavioral1/files/0x0005000000019261-68.dat	family_redline
behavioral1/memory/336-81-0x0000000001340000-0x0000000001384000-memory.dmp	family_redline
behavioral1/memory/1620-83-0x00000000002D0000-0x00000000002F0000-memory.dmp	family_redline
behavioral1/memory/2652-82-0x0000000000DD0000-0x0000000000DF0000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Executes dropped EXE 7 IoCs

pid	Process
2984	F0geI.exe
1028	kukurzka9000.exe
2652	namdoitntn.exe
864	real.exe
336	safert44.exe
1620	jshainx.exe
572	me.exe

Loads dropped DLL 11 IoCs

pid	Process
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
23	iplogger.org
26	iplogger.org
18	iplogger.org
19	iplogger.org
21	iplogger.org
22	iplogger.org
25	iplogger.org
6	iplogger.org
17	iplogger.org
20	iplogger.org
24	iplogger.org

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jshainx.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\me.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\F0geI.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\real.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\safert44.exe	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kukurzka9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	namdoitntn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	safert44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0geI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jshainx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	me.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99397A31-90A1-11EF-9A25-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c084fa6fae24db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2332	iexplore.exe
2820	iexplore.exe
2904	iexplore.exe
2664	iexplore.exe
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
2904	iexplore.exe
2904	iexplore.exe
2136	iexplore.exe
2136	iexplore.exe
2820	iexplore.exe
2820	iexplore.exe
2664	iexplore.exe
2664	iexplore.exe
1820	IEXPLORE.EXE
1820	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2136	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2168 wrote to memory of 2136	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2168 wrote to memory of 2136	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2168 wrote to memory of 2136	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	30
PID 2168 wrote to memory of 2904	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2168 wrote to memory of 2904	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2168 wrote to memory of 2904	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2168 wrote to memory of 2904	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	31
PID 2168 wrote to memory of 2820	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2168 wrote to memory of 2820	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2168 wrote to memory of 2820	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2168 wrote to memory of 2820	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	32
PID 2168 wrote to memory of 2332	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2168 wrote to memory of 2332	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2168 wrote to memory of 2332	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2168 wrote to memory of 2332	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	33
PID 2168 wrote to memory of 2664	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2168 wrote to memory of 2664	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2168 wrote to memory of 2664	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2168 wrote to memory of 2664	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	34
PID 2168 wrote to memory of 2984	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2168 wrote to memory of 2984	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2168 wrote to memory of 2984	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2168 wrote to memory of 2984	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	35
PID 2168 wrote to memory of 1028	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2168 wrote to memory of 1028	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2168 wrote to memory of 1028	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2168 wrote to memory of 1028	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	36
PID 2168 wrote to memory of 2652	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	37
PID 2168 wrote to memory of 2652	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	37
PID 2168 wrote to memory of 2652	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	37
PID 2168 wrote to memory of 2652	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	37
PID 2168 wrote to memory of 864	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2168 wrote to memory of 864	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2168 wrote to memory of 864	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2168 wrote to memory of 864	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	38
PID 2168 wrote to memory of 336	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	39
PID 2168 wrote to memory of 336	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	39
PID 2168 wrote to memory of 336	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	39
PID 2168 wrote to memory of 336	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	39
PID 2168 wrote to memory of 1620	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2168 wrote to memory of 1620	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2168 wrote to memory of 1620	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2168 wrote to memory of 1620	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	40
PID 2168 wrote to memory of 572	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2168 wrote to memory of 572	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2168 wrote to memory of 572	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2168 wrote to memory of 572	2168	29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe	41
PID 2332 wrote to memory of 1820	2332	iexplore.exe	42
PID 2332 wrote to memory of 1820	2332	iexplore.exe	42
PID 2332 wrote to memory of 1820	2332	iexplore.exe	42
PID 2332 wrote to memory of 1820	2332	iexplore.exe	42
PID 2904 wrote to memory of 2792	2904	iexplore.exe	43
PID 2904 wrote to memory of 2792	2904	iexplore.exe	43
PID 2904 wrote to memory of 2792	2904	iexplore.exe	43
PID 2904 wrote to memory of 2792	2904	iexplore.exe	43
PID 2136 wrote to memory of 2244	2136	iexplore.exe	44
PID 2136 wrote to memory of 2244	2136	iexplore.exe	44
PID 2136 wrote to memory of 2244	2136	iexplore.exe	44
PID 2136 wrote to memory of 2244	2136	iexplore.exe	44
PID 2820 wrote to memory of 1992	2820	iexplore.exe	45
PID 2820 wrote to memory of 1992	2820	iexplore.exe	45
PID 2820 wrote to memory of 1992	2820	iexplore.exe	45
PID 2820 wrote to memory of 1992	2820	iexplore.exe	45

C:\Users\Admin\AppData\Local\Temp\29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe
"C:\Users\Admin\AppData\Local\Temp\29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2244
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2792
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1992
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1820
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nN6Z4
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2664
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2388
- C:\Program Files (x86)\Company\NewProduct\F0geI.exe
  "C:\Program Files (x86)\Company\NewProduct\F0geI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
  "C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1028
- C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
  "C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2652
- C:\Program Files (x86)\Company\NewProduct\real.exe
  "C:\Program Files (x86)\Company\NewProduct\real.exe"
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Program Files (x86)\Company\NewProduct\safert44.exe
  "C:\Program Files (x86)\Company\NewProduct\safert44.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:336
- C:\Program Files (x86)\Company\NewProduct\jshainx.exe
  "C:\Program Files (x86)\Company\NewProduct\jshainx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1620
- C:\Program Files (x86)\Company\NewProduct\me.exe
  "C:\Program Files (x86)\Company\NewProduct\me.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

Filesize
339KB

MD5
501e0f6fa90340e3d7ff26f276cd582e

SHA1
1bce4a6153f71719e786f8f612fbfcd23d3e130a

SHA256
f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b

SHA512
dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

Download Submit
C:\Program Files (x86)\Company\NewProduct\jshainx.exe

Filesize
107KB

MD5
2647a5be31a41a39bf2497125018dbce

SHA1
a1ac856b9d6556f5bb3370f0342914eb7cbb8840

SHA256
84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665

SHA512
68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

Download Submit
C:\Program Files (x86)\Company\NewProduct\safert44.exe

Filesize
246KB

MD5
414ffd7094c0f50662ffa508ca43b7d0

SHA1
6ec67bd53da2ff3d5538a3afcc6797af1e5a53fb

SHA256
d3fb9c24b34c113992c5c658f6a11f9620da2e49d12d1acabe871e1bea7846ee

SHA512
c6527077b4822c062e32c39be06e285916b501a358991d120a469f5da1e13d282685ca7ca3fa938292d5beef073fbea42ff9ba96fa5c395f057f7c964608a399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5282bce0e39307297a96d1e3174d9fd7

SHA1
e24bdebaf63b0fe0c4c5c54beb849420691298b1

SHA256
95ec19ce4f0443fe2f84884fcd2061f762c1f8fa26232eabab12cf1f7a981010

SHA512
7cd2c01e5d21ca012c24e03c999db30c3b1be9ea44fbbe940f183b8b3a503b2fe8f854d81e692084cb3bbc75bab450aae3ca5896e93b2abb9da9295a93e5de42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
3ed976f550717114378c611214f5c077

SHA1
d8cf09c887690562d806641e6d78fb3a855b009e

SHA256
3f48ec58d24e94e4c1e89adabf0a58a964fc2c13b57ecda5aa60943e5e4e4c2f

SHA512
7e78d2f64d039daa526149774cd29cefd1da4683a5d5e3535e370251e95fe7e2004e8fbad39d52516d9a2b0f8ca387fa24f9dd3780e99a71818f79b68ca29f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfd2dc9f2a4661d942cf171dab926567

SHA1
0fbfb07b56e1021046daf60d83894483e42f0603

SHA256
f67b9aab635460bb0947573757eabc99b7e71e583b9003948b2a19bdc5430811

SHA512
882855c5395bf6f30aea37d41d1041213875b909f9ebbbcb18fdd4baff2f5f0393b2ef8bea7021c6f46766027ea8566639dfed7efbb053006b5897352a1834db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9685aaa2643a438a11b14527bf086d93

SHA1
a2aa4e2d8a0c18f3e38ddadd183d4b6e4836a85a

SHA256
d545a41d5798948f237c5527ea59cb50541c0fe535640dbcd82505973a06378b

SHA512
976e22da7d2ba5f6f15ae3eec0f299de3f1d168ff8457636b7cb6a7d2f98d1f4d01ff91e1e41a29588971d926886afcc2755d43014d120c0e88283f7d3ec8dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a0029da8e154a78907272e145ee90a1

SHA1
a862114789121c80ff4a9e198b46a13a31a98a70

SHA256
418eedb65bc1cb83d65b496483842a56fc00ad8650625d9f8a5f676f5efd3275

SHA512
7489bdce28b85fc28545db87b3d71b1690978fcb7ad5acd7fb7d5c6108c7ca5a542a5e8eea060b9af7e2452ad73b3b03af3bc8ca97abb5e335d06a5ded1f9e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2072747ae843abad141e1439258077e7

SHA1
a830158d38dd712cf161543611533829e2e815e0

SHA256
9e4a60683dffb0a3941336e1ae0d14f3110e3a0ed4558be290a3573efcd94363

SHA512
1c75d3db9f59c405e67dc6236dc5ab910f879e3b73b1458ab826f9a3350c7f83ff24a387cf7dbd56ab2acb3747d7b14ac4913dd7eb1c2a29fb2f671f7c642928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ecd86db107fa2bd63be75e21d917332

SHA1
da750e5a4b18a702e0cf641182a7f76cd195a477

SHA256
a666590c0e87ed499b1c992d28f82c74d99008f83d423cc7a4524af911b8ebe8

SHA512
9e1e66419e38977196144cc061f9b4534a95ecbc712c1eceed5b3d4ce5b4378aa3c31afcf932ebb9e25e75b9eb256c867b02d9b6cd341a134c3a05ee55f68e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad22fb734cf2aa8f4ab40d98999203ce

SHA1
eba34083bf887bdca380987d0c84bc4219341708

SHA256
e1d81882f11ffa5956b09deb0a50ff07c2c2468e482ae8d2dd3407fe8c49e227

SHA512
4f2704297143a9c7efec7a2ac8f2a36bcfa008430fa8ea06e15806ed5a2ab39973e0b52f4e2bd292bd16f76779bc397da2895251a763721cd3b78ac7a2a30882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c25638d16bcb0a70c64a279423984b

SHA1
b218b5bd0649089160e33ab32f1caebb632cb1c6

SHA256
5810c4d906221304e9698f6eaa41897c957139b28d5511445a838a221e234d0b

SHA512
54728508fbcc30a80efafaffdefdebbdf458318dadec76aeeaca838c5fa02d0086d985a810f99c9daedbae63a109e22e15c0920c2c65d7dedf711bdecba60e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd7a1150e226eb3b2f15c228d3a727c4

SHA1
722a09f040ec7001be62b54aba435f976ca08f0d

SHA256
3746603ba75029e980a250ff44ae37594953deed3896d2b367c766d04985894e

SHA512
62877f1f1c8c9c3342a9c977d73438ca8b180bdfdfe73c4476cf9f54a56b233470ec1e3a135c4b5579cf317c42a2a4787e8f22e7affb4f97bea3ced90b39ca8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fdfad7ab6cad362eff52386cdd94255

SHA1
c40085240c90023b325b3b5166ad841279cf524d

SHA256
ee6bce018670941fcc33ee7f7c9fea7d8f45bec0b818e0a0262452f8c8930ab5

SHA512
0eef6c814f1309a4af4ddb7acad626fddcafb5b90a968c617a045001adebe09327d11bbbd2b4368ba4057006cfababec5391b74f5f1ec192dc7890fcaeac68cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62ca7474b12a6a6d1a61f2f07b821581

SHA1
10a3a774455090d72e6ea1dee20a5b64d5394541

SHA256
ea4c8b5d0b991b04901dff74b656b255ab8602e2641250b7c45a7876b0ef7dfb

SHA512
f561896139ac5df2564d541010f2bee48f5e35919c1624970055d82b9305a10493117c7886daa97f504666af09a5220ff03ab5274d5261e2bbf91a3527cb6054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949144374e69c81202926b8cceb1aace

SHA1
58f6cbc91d94260cd9fea124c3a0f5965c4d7ee7

SHA256
a7bca833205eeb628fabf3f40187f67ab4c0b539b675d4748809418d5f0dcee0

SHA512
8035b791ed4d2146f0bab8880f19ab98166f54bdb0f07d0ee915b6b49282d91fb398990704c9fa7673f45485dfc1adbe658c5c4b0034b18e9c7940a2e0ef6a92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7443a14dad7717268c64842e81084c96

SHA1
0013d2587da1b9eb6e79111db9707df4d3960ca2

SHA256
7c330e596edbfa4a88b2c48e57117c1e2bf26852fb15f3c8f51f333b6905caf1

SHA512
d6d5388865f9b86ac40bd3c74d7e0f24e69ca4728ee5f21b43a0dd0575c13ae19c432c916d429252793a3b4f86ec6e319c6caa235e6383e4a1182a94b72fbf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01f5a68b589f8a916bd1ae64b3697f48

SHA1
0e033fa0ff4793d805b09d27fa8a7cb64fdb2ba5

SHA256
f3b5d0edd453267c6806650869b39394eaae265992226ebe49dc9f7fc6075cd9

SHA512
fd4cb018cbef18db5457eeed0edffff32040e8454865c7dfff117c4b04f65db8a06cce7958eee47cfddf70d2ebc222d92dcb84619805d9ebaba2a4c1e699e854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dfced985e8f293fae69f9d0e8708613

SHA1
931e9c9f567949120d178bce0de37ae5a31c05b7

SHA256
a2f0553abb9be59d3507314f2492acee98320f912baadaff9d01bdd97e926548

SHA512
0dbea314fd4866f5dc772f22f641083e88886ebc2523e0efb8fcfc9d8811a27a4d39bd420c1aafa1d59e1c1f49719f9c9386fe3584889b6b5f72128f63badc46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb5353626cacc7f592c1b30ead695dd8

SHA1
092fa1d267a11daaba465a5d3c4aa9b2bb63c5d0

SHA256
19f59c2c756b744972b4f601eb4ec45aae752e78d77ae863785f74a460a302de

SHA512
527431078579074f019734c5e1de7cdc956807976bed54ca00e94fea9cc2647e003648f52ec6156ba5ed11071907bb8b5e0601bd30f82dc32d1c0d80b39b7768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c59ca85cc350c5ff4798d516f565a9eb

SHA1
41ca63c41554b729152184004109f40e380bd39f

SHA256
15bdb4bfd5270c328424edb0209cac3ad64a019d1ac59e66714971938d6687f5

SHA512
3259b0fa0ce2727eefe7e79c9927ab6067aca9f945f8b440ca17174f014176d68901d980b4485e0be41dfe5a65fecbf3fb09ba7486c007d3d43bbfd8a5f40e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4de52febd9f815138e8a68d6c5348e68

SHA1
c31c843f493feff02163f4e35a12c12147ef1d0d

SHA256
d5e8ef8c9d35af390c168efbec1c3d4cb3d255d9a9cdf41aef707e2b659eeb1a

SHA512
5266c8b1c0fab373bdb983bffe96ec90c505cadafe75c34df82d1ccfefcb8741f4c8554d17a64ab42a0f40ac7fba251c143fafcf91b0481b1432d06e9693e42a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bae26e4b7b825f04c4af513a1e77337

SHA1
968092835b82db2470d488507b9a1c0e738a3b04

SHA256
81fb54085b9c53caf35f5c8df4191836e6b7960e50c5a5af10b2f83bc1339d84

SHA512
9d90d01dc0ae40d6b51d0773aa9db9b635bf4248d970c054411983af26d8238bc098f5126f95fbcfb504b7e1881b65766181cdd07233eaa23365f34ed1c48f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bc80b5a973096149f18d852f2543b3d

SHA1
3b74b65ea04c3d3467a400583d14aba5c86286ab

SHA256
16b7da5185357c39a0ec5834417029172c1e3528bff6567f524062a0aecb5fc8

SHA512
3976747068d5bb21052cb443a501c61155b4e71b767648a1ae8bff4225dad57e9d6b57b52550ecd92e83c6137af2eed3116808c98f15226bf9f9542126c25d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3caa9e9d26eec60e8c1c954a9b19fb35

SHA1
8f89d6c9760682cbc74854571c8bb414ed7850ef

SHA256
6dbb2e422937f5330a866ff60e5624cdeb6bbf5fc352efda03c0c416c10e0bae

SHA512
8054575ed24c68c7e58634ce9e014820ac8674a13204904f7368041fba982e9ce5650ff6df61d8943d22eb4f64220862258faa7233af406cac85720d1b60c13a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5306c99a39ceb022c5e1db9463d48af6

SHA1
242111c847bd73cbbe255b72c705fa539f7b6b0b

SHA256
a8082447e9e8cbe6f0bd82d653e1d847d46a372f4644f19cfccdb7dc19c7805f

SHA512
90ffb1a397eeb86e31efae5598a8a394155f68aa0fff7ca6200b22ad619c253b2c1db89324a0c3a0203712c8703f33bd47b29f1d17eecfcee9a801935e63b01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
c94712767cba7c981dbf462934d80fb1

SHA1
f90c3f2b0d64d7fff9ae1c5dbd09efdf68299d5d

SHA256
a353b3a074004d5ed46035238bca345eac55beb829ef5124d87c44533db9864a

SHA512
37fe8a01eba17fd1133872acbd36ef6bd993b6603804ac94bd37f4fd8d1f681ea852eb397d215e83ea662ee2f57481bb5de24319e17e2aeece93abb903aa4944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
292fb4a5775380dad91eadbdf80a7d34

SHA1
d0b6c97235f42adbd7d05998f8a356c99be6c0fb

SHA256
82825a55855f2b228c6fd5a7d2cb169dad873bd6a568a5229cec88837fabfdb3

SHA512
7e23a1997c2dc3142377907c37fe3e972319e65a5c1dc032f7b44ccf6b3c843bb21541ae444ef83659035db869a5f75206e8bd09f6f2106d6380d91b006999a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7011cfbcc58640484b77867d35626832

SHA1
f346e190a18ce9096fd137c216c7c1ba74b1fc98

SHA256
57b8125211e5925ddb02498351258b0e094a9c999994b68262a7aafd59e864e2

SHA512
4e01c904e1dc6f24adab992319f4402b9884d2100126abc055c00d9ce1beabeff23a23df7d24744b356eed74114e953d17dc0f909cffd3539eef8d0e9cdc5378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{99325611-90A1-11EF-9A25-6E295C7D81A3}.dat

Filesize
3KB

MD5
9bb4f615f1e4649efbc3c6205a73b1f5

SHA1
bbd7aaa8f93ad5534a8b442a84d4be35ebe4cf7c

SHA256
b508574568a8f0bc8e80f46ae8f1ddf072e2fd3db60498e5489c98cf2b8f575a

SHA512
6147df6559582068f8d2bc61f256a851339382e715a28660c7dafb8f91aea86179ba5663a1f2401d83212ae3f3221a613197b5a1fc509a4d46c28bc845359597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{99325611-90A1-11EF-9A25-6E295C7D81A3}.dat

Filesize
5KB

MD5
b84352b7008a13a126d63f021a0cac4d

SHA1
cc64baffaf13581318a620e8293280d5f99ccc6b

SHA256
3ba9c4767d6428792c2ff092249153258d42b21680ec360928b3683155c77b02

SHA512
8b360e87887fbf173ee59711856c63b1b3893aef9c548e38a6e236036ac28049efd4d16ca492b2ae0209b44998fff03e37b15a19010eaf750221c740f6fa3b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{993BDB91-90A1-11EF-9A25-6E295C7D81A3}.dat

Filesize
5KB

MD5
258e2169a0d6581e640cc52fb7af206e

SHA1
9e12413c5d66084c2e1b24ce4e6040fe2e3c0b58

SHA256
b56a4d044b68042d93b7b341d1c3ca1e92bfb27791f3ff7eca2c538c05dbc55e

SHA512
eed7d28fee30ba3791b7b1d2e85771d96e6aaee2786c6a58f4aee85b1237307fea66c241965ac89f4a79f2cde8f0c259261f3ca506fc50c5b6fcdee2eb911142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{993E3CF1-90A1-11EF-9A25-6E295C7D81A3}.dat

Filesize
5KB

MD5
eb7a39d06c822a643af9fc8b80be299f

SHA1
2d917d2c2af080ab41f1ced34a20946a2a599067

SHA256
ef0dd8f68b65f29bc05838bc0a5fa421e7126f081b633533fc81d5d29e5509ae

SHA512
038a6a6a3be3e8be72d44360471806980e5a222d160d2944d1c8516cd9f690a3d04e30b06144c1879ae60ac7c9b22f146a840dea4119c4495a5089d3a6f5368f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\gsz3hkd\imagestore.dat

Filesize
2KB

MD5
169c9734d82f06dfd6f9a0d5bfca6dc4

SHA1
fdb077a9f52b84b4c6f4f802f1f5e7636dca0cf7

SHA256
1b8d9141516bc277f6c529d52749fa3c46c2040f4d3c2bce1005d5bb61e10585

SHA512
f39c197ddb96a283b0bd75844e8c746208ec59241fe65f9902499abd64f58b7d1b3b816377391aa85651e3de196b5ead61fd6b46200ad6bb9e934ea059446493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\gsz3hkd\imagestore.dat

Filesize
8KB

MD5
da6ceebf40ef3e7d87f847d8972cb236

SHA1
315e16a7bbe8008438b0a859767825acaa20865d

SHA256
d728c4443b63c71671d8fa55fa7010fb41d7144cb3f78d49ccf6998fb7627be1

SHA512
c68b2b2f5ae101814c848b89cc2010fae48a7784fc2c7d81fdba05c819be3771d5ef08acb947b2c743244ae0697941191467d2e2761f8c31b8a6e127a2d2bcf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\1nN6Z4[1].png

Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\favicon[1].png

Filesize
2KB

MD5
18c023bc439b446f91bf942270882422

SHA1
768d59e3085976dba252232a65a4af562675f782

SHA256
e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482

SHA512
a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFB9E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFBB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6GCMX1F9.txt

Filesize
251B

MD5
f859914116a0fa6ccc7a5a870b261833

SHA1
eaa8e115a0b564a1f627d8edbc7f0523e204034f

SHA256
ec987c4e69fe107ea999f7a3738783fa8854e7049ecba1a1a180687e63f700ae

SHA512
55a254be71c2940d28eaaaf3e3d7fb7fd45a3885bb78b61641e1b51b2b55658959773da4a876e68b8e187f0c3547416f4c43ac37c6768ffe25e04fcd60f0b70f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BJH69GSD.txt

Filesize
169B

MD5
88a133c3c0307193bb49ecaf7b0d0546

SHA1
9468ef50350f5e4e41ed9d98bdb79aefe8bde756

SHA256
1e9bd16e7475d6cc8e92890674f20336f3bccdfdbbdaa2127d54d4734b35ba41

SHA512
0c49530b001232d868009c9bfb64f46af53e460784c5675fe241a6903cf507597fa533c1a7f4002d3c7f49adc73bc8d50886a7b31e72821c0731510189d5e6f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EQD3WHHR.txt

Filesize
333B

MD5
bb9c2b89c1685e7cd59b73dedb1b97e7

SHA1
44d7f70119d152fc1a3f8bc7eef6e0a8a0dfc5f0

SHA256
8d4e8d3e18892a62bd313a264287e85c9d39589908d2c9bb14c102d40ee51410

SHA512
c351e845fb3a277b92d46c0edf591695ca56dfe06ebcd09bb09b67ea96b0b27e6656f1686d1a7ccea1fa9f5fdeebd1670fe67cf889a366cc6bbd947843ba9351

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PLLN1D94.txt

Filesize
415B

MD5
b46036c3f55b30a4d89c894f3f0b7903

SHA1
3f3f3645f349ee91572f117801f466942bd3e288

SHA256
28ec082ebaa283e4482da0120703a51b182cc6c9e93b3a03f057ebda6c339767

SHA512
96915dd8b4e8690def115ee1bc8403865d8e87681de0baa60d9833d2ce52989999a13f0c77f9d4773a5dfb03c12392d23d8309e05c53ae1c615d7bcaef3a76d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V1MJUNFZ.txt

Filesize
497B

MD5
10a8a2308da459050906357bedcd3b74

SHA1
45ca14dc95868de3c9f19b1422a2dc0235e2d80a

SHA256
fde3a4c0488bf754da6e188bd00b677535f9919da01253caa150f25098bbd83a

SHA512
9e1c7d4d9412cbf8fbb35cc62d9aaec1feab1e85219d17814c2042a53ed4bd6dd5a485802f69d3f2d855f22554da50c6c5de975915b6c00397a2c304101c8803

Download Submit
\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

Filesize
669KB

MD5
b5942a0be0b72e121dadb762044f38cc

SHA1
885909607a9747c11eac6cc47b775ad947980c5e

SHA256
c565dd409f6d17997285f6fcecf851c56ddc3129c2a777529e8470290565ace1

SHA512
d2a916738fca01b6b5a27639fbefcc7406e79f8493d8f69015c60d07d0341ab8aa8e4e3ab50208161b7398bef62b9837e11524ffefc502b9f09efc011974e3e7

Download Submit
\Program Files (x86)\Company\NewProduct\me.exe

Filesize
274KB

MD5
2eee4c301ce357df8f235957fcb774b3

SHA1
f9fd1eac58b5f40475269a1e8eb1675227e2389c

SHA256
66cc79df9054fda09648b64a230427d4a574f8349de871e922fbd20432b431f1

SHA512
590589c3f8ee16f12539b943ba04402771372fe7748fb689c03b5681466ec8d3f3778007224e0a7fac1413f188aaee59a754cad2d0194af1130a8ad3191466fc

Download Submit
\Program Files (x86)\Company\NewProduct\namdoitntn.exe

Filesize
107KB

MD5
bbd8ea73b7626e0ca5b91d355df39b7f

SHA1
66e298653beb7f652eb44922010910ced6242879

SHA256
1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e

SHA512
625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

Download Submit
\Program Files (x86)\Company\NewProduct\real.exe

Filesize
275KB

MD5
a2414bb5522d3844b6c9a84537d7ce43

SHA1
56c91fc4fe09ce07320c03f186f3d5d293a6089d

SHA256
31f4715777f3be6a4a7b34baf25ebfc7af32dd9a2aae826fc73dca6c44fda173

SHA512
408ebb002b3bdb77dc243ced28d852801e68e5ff0dbfa450d3e91b89311fe6a3e8473e749619c285c1a5427d8a117350a3798435ed38b56d1a230f0ae270ec60

Download Submit
memory/336-88-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/336-81-0x0000000001340000-0x0000000001384000-memory.dmp

Filesize
272KB

Download
memory/1028-89-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1620-83-0x00000000002D0000-0x00000000002F0000-memory.dmp

Filesize
128KB

Download
memory/2168-79-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-82-0x0000000000DD0000-0x0000000000DF0000-memory.dmp

Filesize
128KB

Download
memory/2984-682-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads