arkei | 4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe
Size 2.3MB
Sample241108-3e8mvs1paz
SHA256 4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e
MD5 aa25a6dbf0319ac7466e5e4c8b7ee4a3
SHA1 f5cfc23ae0d2785f5aae32a07eaf15f9cfc4ac24
SHA512 ccd6232ae5918110ef911fbd27de2619cc2a1cbf1b08029b4953166bdaaa2ba087d418726e612dc84afc803e1cc95229834e1b0c91696471b8b08e4c6ff080df
SSDEEP 49152:J84+V9pjc8VJiy7jHrpb3KPyT5cRIdesz1E:JEV9Rv7jLpjKKVGIdZ1E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

arkei redline 11/13 default ошибка discovery infostealer persistence stealer upx

Malware Config

Extracted

Family

arkei

Botnet

Default

188.212.124.13/lYWcN6H7B1.php

Extracted

Family

redline

Botnet

ОШИБКА

185.183.32.161:45391

Attributes

auth_value
d18b47a36849f89352e431c80fc6cb5d

Extracted

Family

redline

Botnet

11/13

94.103.9.133:1169

Attributes

auth_value
b69e61a3d7a039daa16500dfdc1eaa12

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Arkei family
arkei
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/1104-94-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/3104-105-0x0000000001000000-0x0000000001038000-memory.dmp	family_redline

Redline family
redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe

Executes dropped EXE 11 IoCs

pid	Process
1004	MarsBuild_2021-11-14_11-20.exe
3800	clean.exe
3812	OQTGVRp.exe
4444	clean.exe
4432	QdUPABU.exe
1084	Udi.exe.com
2940	Forma.exe.com
1116	Udi.exe.com
2916	Forma.exe.com
1104	RegAsm.exe
3104	RegAsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	OQTGVRp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	QdUPABU.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 1104	1116	Udi.exe.com	127
PID 2916 set thread context of 3104	2916	Forma.exe.com	128

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d000000023b23-20.dat	upx
behavioral2/memory/3800-32-0x0000000000E90000-0x0000000000FD3000-memory.dmp	upx
behavioral2/memory/3800-35-0x0000000000E90000-0x0000000000FD3000-memory.dmp	upx
behavioral2/memory/4444-49-0x0000000000E90000-0x0000000000FD3000-memory.dmp	upx
behavioral2/memory/4444-51-0x0000000000E90000-0x0000000000FD3000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	1004	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Udi.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OQTGVRp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	makecab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Forma.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Udi.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarsBuild_2021-11-14_11-20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	makecab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Forma.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QdUPABU.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3256	PING.EXE
3688	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
3256	PING.EXE
3688	PING.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1084	Udi.exe.com
2940	Forma.exe.com
1084	Udi.exe.com
2940	Forma.exe.com
1084	Udi.exe.com
2940	Forma.exe.com
1116	Udi.exe.com
1116	Udi.exe.com
1116	Udi.exe.com
2916	Forma.exe.com
2916	Forma.exe.com
2916	Forma.exe.com

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1084	Udi.exe.com
2940	Forma.exe.com
1084	Udi.exe.com
2940	Forma.exe.com
1084	Udi.exe.com
2940	Forma.exe.com
1116	Udi.exe.com
1116	Udi.exe.com
1116	Udi.exe.com
2916	Forma.exe.com
2916	Forma.exe.com
2916	Forma.exe.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1004	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	86
PID 4524 wrote to memory of 1004	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	86
PID 4524 wrote to memory of 1004	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	86
PID 4524 wrote to memory of 3800	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	88
PID 4524 wrote to memory of 3800	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	88
PID 4524 wrote to memory of 3812	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	89
PID 4524 wrote to memory of 3812	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	89
PID 4524 wrote to memory of 3812	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	89
PID 4524 wrote to memory of 4444	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	90
PID 4524 wrote to memory of 4444	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	90
PID 4524 wrote to memory of 4432	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	91
PID 4524 wrote to memory of 4432	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	91
PID 4524 wrote to memory of 4432	4524	4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe	91
PID 3812 wrote to memory of 4820	3812	OQTGVRp.exe	92
PID 3812 wrote to memory of 4820	3812	OQTGVRp.exe	92
PID 3812 wrote to memory of 4820	3812	OQTGVRp.exe	92
PID 4432 wrote to memory of 1104	4432	QdUPABU.exe	94
PID 4432 wrote to memory of 1104	4432	QdUPABU.exe	94
PID 4432 wrote to memory of 1104	4432	QdUPABU.exe	94
PID 4432 wrote to memory of 3232	4432	QdUPABU.exe	96
PID 4432 wrote to memory of 3232	4432	QdUPABU.exe	96
PID 4432 wrote to memory of 3232	4432	QdUPABU.exe	96
PID 3812 wrote to memory of 5112	3812	OQTGVRp.exe	98
PID 3812 wrote to memory of 5112	3812	OQTGVRp.exe	98
PID 3812 wrote to memory of 5112	3812	OQTGVRp.exe	98
PID 3232 wrote to memory of 4800	3232	cmd.exe	100
PID 3232 wrote to memory of 4800	3232	cmd.exe	100
PID 3232 wrote to memory of 4800	3232	cmd.exe	100
PID 4800 wrote to memory of 4064	4800	cmd.exe	101
PID 4800 wrote to memory of 4064	4800	cmd.exe	101
PID 4800 wrote to memory of 4064	4800	cmd.exe	101
PID 5112 wrote to memory of 844	5112	cmd.exe	102
PID 5112 wrote to memory of 844	5112	cmd.exe	102
PID 5112 wrote to memory of 844	5112	cmd.exe	102
PID 844 wrote to memory of 4872	844	cmd.exe	104
PID 844 wrote to memory of 4872	844	cmd.exe	104
PID 844 wrote to memory of 4872	844	cmd.exe	104
PID 4800 wrote to memory of 1084	4800	cmd.exe	103
PID 4800 wrote to memory of 1084	4800	cmd.exe	103
PID 4800 wrote to memory of 1084	4800	cmd.exe	103
PID 4800 wrote to memory of 3256	4800	cmd.exe	105
PID 4800 wrote to memory of 3256	4800	cmd.exe	105
PID 4800 wrote to memory of 3256	4800	cmd.exe	105
PID 844 wrote to memory of 2940	844	cmd.exe	106
PID 844 wrote to memory of 2940	844	cmd.exe	106
PID 844 wrote to memory of 2940	844	cmd.exe	106
PID 844 wrote to memory of 3688	844	cmd.exe	107
PID 844 wrote to memory of 3688	844	cmd.exe	107
PID 844 wrote to memory of 3688	844	cmd.exe	107
PID 1084 wrote to memory of 1116	1084	Udi.exe.com	108
PID 1084 wrote to memory of 1116	1084	Udi.exe.com	108
PID 1084 wrote to memory of 1116	1084	Udi.exe.com	108
PID 2940 wrote to memory of 2916	2940	Forma.exe.com	109
PID 2940 wrote to memory of 2916	2940	Forma.exe.com	109
PID 2940 wrote to memory of 2916	2940	Forma.exe.com	109
PID 1116 wrote to memory of 1104	1116	Udi.exe.com	127
PID 1116 wrote to memory of 1104	1116	Udi.exe.com	127
PID 1116 wrote to memory of 1104	1116	Udi.exe.com	127
PID 1116 wrote to memory of 1104	1116	Udi.exe.com	127
PID 1116 wrote to memory of 1104	1116	Udi.exe.com	127
PID 2916 wrote to memory of 3104	2916	Forma.exe.com	128
PID 2916 wrote to memory of 3104	2916	Forma.exe.com	128
PID 2916 wrote to memory of 3104	2916	Forma.exe.com	128
PID 2916 wrote to memory of 3104	2916	Forma.exe.com	128

C:\Users\Admin\AppData\Local\Temp\4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe
"C:\Users\Admin\AppData\Local\Temp\4ef41d48509cbc289c46f9b252d780ea1abd83e849c42a47bf7b481b79fead7e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\MarsBuild_2021-11-14_11-20.exe
  "C:\Users\Admin\AppData\Local\Temp\MarsBuild_2021-11-14_11-20.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 548
    3⤵
    - Program crash
    PID:4832
- C:\Users\Admin\AppData\Local\Temp\clean.exe
  "C:\Users\Admin\AppData\Local\Temp\clean.exe"
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe
  "C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\makecab.exe
    makecab
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cmd < Duro.potx
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^JdynOpYGXnWkzSuDQWhFskbJYxaqZbxLWAnCRclynOJXkaaxpyDmJmtnSvAxQXHArlfSxDLxLiiDBmnGwYRUUVevcZJcVQgAupUqemqFzoNBaA$" Due.potx
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
        
        Forma.exe.com b
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Forma.exe.com b
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3104
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3688
- C:\Users\Admin\AppData\Local\Temp\clean.exe
  "C:\Users\Admin\AppData\Local\Temp\clean.exe"
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe
  "C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\makecab.exe
    makecab
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cmd < Aggrava.accdt
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^ShpzYFLbYRfWJuFRXyNbzLysSxWtdBORrgKocLRwRlexRlxdHPIcxtdioSAEIHivrnSxvvvjgLGoIKmHZGvBSzvYYDqDljzlrGszaqTlaviIninbaTFelFEKwTcTvTew$" Pie.accdt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
        
        Udi.exe.com k
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com k
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1104
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1004 -ip 1004
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Due.potx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Due.potx
Size 872KB
SHA256 3e6fff185ac509106bed8e02969acc2c272f65300249e66b5a504c92d4a58d0e
MD5 6684f94034e10a93758e2c22c75f1613
SHA1 25b7d85449caa642beafcf488f1af1fb745ad0ca
SHA512 43141e2a5f1cd92cff9a63e1af68d9a1af458ae8f5f7b489172d06e21fe103793a045ed4ee613b4618b42665c5d644d058c0ac78d19d0ef55cf5936201cfd1fb
SSDEEP 12288:jpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:jT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Duro.potx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Duro.potx
Size 334B
SHA256 a9a4218d1a194894aaf6b487c502a24f0f84041a20e720a4a719201ffc31ae02
MD5 32672958dfe282494f18f8be6b5daea8
SHA1 29eb8689b235ffc001286410039ff1399b9e3d33
SHA512 05a7c2ee83b6284df5f072ba493a0b90e315e54c786ee22b159e3d1197335c72f8b637ddf2e1c7884c4275e0ebc553d68492ae2ed42b43d11c0010808e5dc5f4
MD5 SHA1 SHA512

Submit Download

Era.potx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Era.potx
Size 931KB
SHA256 b1263474b5adfaa1419a51ebd697ddcb05ff89bc6c037e08d376994f4550957b
MD5 016c737a43c6e6e2cb7abf7d85c5057d
SHA1 e68f088fa89473aa3cc032429bcc62b4b0f61116
SHA512 ebba96e749127d7678bae1d47cd00a287812a49840da72932f97e8469e49a3eb01b0c198aa69ae42c03211cfed275c77fdf086679433dc8c55ea60b1ccf3c607
SSDEEP 6144:8r2sRpi8ioO/cXTmkiGx52pfVr6evLNX4aCCCe5:2fYEXTmVjvzNX4qH5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aggrava.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Aggrava.accdt
Size 343B
SHA256 edd2efdd14116825ff18d706aad2bd716382acbe678eda85c5057bd257b1a02e
MD5 ea7b73c99c39a859e7e8b0a815570986
SHA1 bd74eb1f49d26a461060f131683021750889a65f
SHA512 167288428c40eab8e1864bf7db8e70721790763bed0db598af1da860950839058255f58398a61070fbafeea575d9557ec7c6d5b9c424b217602968a40cdf34d9
MD5 SHA1 SHA512

Submit Download

Migliore.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Migliore.accdt
Size 909KB
SHA256 797bdb0508bf241ccc4beff1da822e26b5113592556fbbf53623ec2f0c432ec7
MD5 d9119aa074bfaff410bb7a4139146a19
SHA1 74ea5a967fcba2dde0b27de519dbaf1ef7028636
SHA512 1187f6c0f0f9488bfd57129622b24e747b54a50cb1141bc7fc9e1d62e9a80c415efa85c7322d3391a88fb9e9b8335daabf0e258d3896f2eba571e9e7fbba32b6
SSDEEP 12288:T80p0A4Ayw1vwC9Ks12EJUKlU6cB/3iikI:TrNSGG9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pie.accdt

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pie.accdt
Size 872KB
SHA256 d83dd02bf0531d87e4b1af3a68cd601b21d33e2a9e77bc7e8cf1753f77b10438
MD5 a172c86dab6bebb6c82410c1f1c1567d
SHA1 56a171dfe8137793f45640fc31b3a159f5a84c7d
SHA512 107df456743e3e793ca75e2c5e7bfad1ee1801cae03636dec2539cd4c4995b601c3d79118ad0874c6caf8293d1812bf31d459549f7925cb814e30bad4fc30896
SSDEEP 12288:wpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:wT3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe
Size 63KB
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Udi.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Udi.exe.com
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

MarsBuild_2021-11-14_11-20.exe

Path C:\Users\Admin\AppData\Local\Temp\MarsBuild_2021-11-14_11-20.exe
Size 263KB
SHA256 19c5b1b8a2cdb858835234cebf962a73492f843b6e434b7e5c11d16ddcf09a62
MD5 3d58b1c286a8d5deb900c56210d19611
SHA1 f3a8e5a0fabe01268c9c99e981208e36d210900b
SHA512 3ed1ed8756d3aee5cc271b4850905dd02e6f1e5b8ba0bb3df004636af5fcb49380ae594774bb0984f8de485e6bfa1307d981aedd7a65bb558598e971fdce1530
SSDEEP 6144:SW328u1+4yl+JbGNkQ8k0b7ITsq7igavwVf:SMru1+oJyNkQO79
MD5 SHA1 SHA512 SSDEEP

Submit Download

OQTGVRp.exe

Path C:\Users\Admin\AppData\Local\Temp\OQTGVRp.exe
Size 819KB
SHA256 9300234fb143a410b3fc3fa0e0631a6a15f563a086af6854d0917ae5653ff0f5
MD5 ae5b62f74b751690528b1158da869f4b
SHA1 9ba07ae06ba49b16fa32dfdd51df33ae771597f4
SHA512 ba5fd421118e296b9678cbabc19419db1645dbf4c403e5d20cc29a6a2e6e41b71a18e4779004dd79c2f8ede2f13ca9d7ebd5717954cb92bc990d338b77a6e3a2
SSDEEP 24576:CdGaRbDxj/RRwvzNyQvDrX41Dw4eRcy2UsXV5RJ8axQ:1aRbDF+vDrIi4ccvUeRJ8ax
MD5 SHA1 SHA512 SSDEEP

Submit Download

QdUPABU.exe

Path C:\Users\Admin\AppData\Local\Temp\QdUPABU.exe
Size 808KB
SHA256 0f20bd03381fabc111c319d58c04e5c8c4fdf4a12fbfed2ae5b0d13b8964ff7b
MD5 6a537efb426fe0de4d613615a82fa729
SHA1 ed5acfd81d01a5804df26cb259793e532992f07a
SHA512 bbdc5c3ffd04bc2e35b6cb476dd05315db9d6673edea1b7beafbf70544d4f4a54652213c149362dd8392fddb47d341ee9b17e109d0f8fd8286fceca7abf17ba5
SSDEEP 24576:a13uSe390/3v6k+UZOAqC78sBex9rTt6:UeB390n6TAs/X
MD5 SHA1 SHA512 SSDEEP

Submit Download

clean.exe

Path C:\Users\Admin\AppData\Local\Temp\clean.exe
Size 309KB
SHA256 c1570c01feaf033c8d7697a7a873b77754b22aa67e0ca0499ed22095b651d2af
MD5 374a47aa60ba4ef1c2306be2949f0849
SHA1 612fedf2475d75d3805d9801f00de1111591b7cc
SHA512 ecb64e77cbca48ae129c08c93565c937a336c7f0016d19a12b76aee8e2508f21615ee1c104123ed5b5dc5e0e077bc81ac8c7042285e778b855a009b6087fad9d
SSDEEP 6144:PxzfeGqnHyMmjV/6/Sa+OUClz4nlxCaAtRlGwbpHX9Vk7RoRcVl:PxLy/GwSaqCdWxCHRkwiScV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1004-91-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1004-90-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1104-94-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1104-98-0x0000000004FC0000-0x00000000055D8000-memory.dmp

Download

memory/1104-99-0x0000000004A20000-0x0000000004A32000-memory.dmp

Download

memory/1104-100-0x0000000004C50000-0x0000000004D5A000-memory.dmp

Download

memory/1104-101-0x0000000004BD0000-0x0000000004C0C000-memory.dmp

Download

memory/1104-102-0x0000000004EE0000-0x0000000004F2C000-memory.dmp

Download

memory/3104-105-0x0000000001000000-0x0000000001038000-memory.dmp

Download

memory/3800-32-0x0000000000E90000-0x0000000000FD3000-memory.dmp

Download

memory/3800-35-0x0000000000E90000-0x0000000000FD3000-memory.dmp

Download

memory/4444-51-0x0000000000E90000-0x0000000000FD3000-memory.dmp

Download

memory/4444-49-0x0000000000E90000-0x0000000000FD3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads