Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows7-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
33DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows7-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
395560f1a46...f9.dll
windows10-2004-x64
3Archive.zi...3e.exe
windows7-x64
8Archive.zi...3e.exe
windows10-2004-x64
8Resubmissions
05-11-2024 03:18
241105-dtxrgatbpg 10Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 03:18
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
0di3x.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
2c01b007729230c415420ad641ad92eb.exe
-
Size
1.3MB
-
MD5
daef338f9c47d5394b7e1e60ce38d02d
-
SHA1
c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e
-
SHA256
5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58
-
SHA512
d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4
-
SSDEEP
24576:W85y6Jwdt8jtWoJpXWHALGX+C1Co3aP8jvuC7g6zwm4m53Sb21SR:HXsSGuC/MIvuC5kFm53Sy1SR
Malware Config
Signatures
-
Hawkeye family
-
Detected Nirsoft tools 13 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral11/memory/1952-109-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/1952-108-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/1952-107-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/1952-104-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/1952-102-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral11/memory/1260-121-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1260-124-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1260-122-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1260-125-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral11/memory/1552-127-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral11/memory/1552-129-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral11/memory/1552-126-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral11/memory/1552-134-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
NirSoft MailPassView 9 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral11/memory/1952-109-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/1952-108-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/1952-107-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/1952-104-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/1952-102-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral11/memory/1260-121-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral11/memory/1260-124-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral11/memory/1260-122-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral11/memory/1260-125-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 9 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral11/memory/1952-109-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/1952-108-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/1952-107-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/1952-104-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/1952-102-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral11/memory/1552-127-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral11/memory/1552-129-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral11/memory/1552-126-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral11/memory/1552-134-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Executes dropped EXE 2 IoCs
pid Process 2744 odm.exe 1736 odm.exe -
Loads dropped DLL 5 IoCs
pid Process 2272 2c01b007729230c415420ad641ad92eb.exe 2272 2c01b007729230c415420ad641ad92eb.exe 2272 2c01b007729230c415420ad641ad92eb.exe 2272 2c01b007729230c415420ad641ad92eb.exe 2744 odm.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex" odm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex" RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1736 set thread context of 1952 1736 odm.exe 34 PID 1736 set thread context of 2036 1736 odm.exe 35 PID 1952 set thread context of 1260 1952 RegSvcs.exe 37 PID 1952 set thread context of 1552 1952 RegSvcs.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c01b007729230c415420ad641ad92eb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language odm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 odm.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe 2036 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2852 DllHost.exe 2852 DllHost.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2272 wrote to memory of 2744 2272 2c01b007729230c415420ad641ad92eb.exe 32 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 2744 wrote to memory of 1736 2744 odm.exe 33 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 1952 1736 odm.exe 34 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1736 wrote to memory of 2036 1736 odm.exe 35 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1260 1952 RegSvcs.exe 37 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38 PID 1952 wrote to memory of 1552 1952 RegSvcs.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Roaming\wou\odm.exe"C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Roaming\wou\odm.exeC:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YNCOJ3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1260
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
- System Location Discovery: System Language Discovery
PID:1552
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeC:\Users\Admin\AppData\Roaming\wou\YNCOJ4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
91KB
MD59375872d82fbfe00eb4f6e608aa170d8
SHA1b6d6f7059c025075141293cc0c1f80c1063ef75b
SHA256a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9
SHA512f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863
-
Filesize
1KB
MD5f6efac00916f3425d6079ae5a956df11
SHA13153abfe46186c1186882f67444c82c544615fb7
SHA2561e866a8f06f125fa1c439f9cb00199be827e74b87eae12368bd1e2cf7ab28728
SHA5120ba766d5816057941ad9afc80f7b20620b0120411357fe2b97ab0a425b32d4309396ed4866c8b23c92893ed68971c4a8a8c6f25ffa411ba0c70b602a63bd4743
-
Filesize
1.2MB
MD5a5f2dcee6a2a6047aa8fdde1ae2ce290
SHA17a082661c9a3431cd89ed4d9959178d60b9570f7
SHA2567da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625
SHA512e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a
-
Filesize
4B
MD5098f6bcd4621d373cade4e832627b4f6
SHA1a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA2569f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
SHA512ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
-
Filesize
16KB
MD56285049d1e4f854943856164652da8d8
SHA1f29c791ddb940be594bfb431eca7d4cb6d9e2688
SHA2560aeb7e8a131b53991567db463519ea005d41ddd1f227a744d4f7066805ce684f
SHA5122bb954a07f82c19b26d745ac19cd66e6eb82c525db0bd6e9e6880b0077465897d7fc49521d40361262c9dccdba4de6cead5b7d8dc09a9beaae2d668537097291
-
Filesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
