287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe
Size 1.3MB
Sample241109-269hsstkhs
SHA256 287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4
MD5 275de84f560d510ece370b3e70bced10
SHA1 e39d9d21c0378cf435e258bafa8b3ededce4cbc8
SHA512 e8c0976ffdbf9150a536c08868edb9a9a013583a5783561cd768d6ef7415fd7bdeecb0059af420060daece4966af22102ed1a06f50b424cbfe3c270985ac814f
SSDEEP 24576:IRmJkcoQricOIQxiZY1iaenGjcew+gu8PP8jkP8Sv/7JvbMvjGcDk:tJZoQrbTFZY1iaeaceRguyP8N67B7c4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Keily.vbs	Keily.exe

Executes dropped EXE 64 IoCs

pid	Process
1436	Keily.exe
980	Keily.exe
3680	Keily.exe
2804	Keily.exe
1212	Keily.exe
1488	Keily.exe
4792	Keily.exe
2248	Keily.exe
4712	Keily.exe
4012	Keily.exe
3824	Keily.exe
2508	Keily.exe
3456	Keily.exe
2512	Keily.exe
3004	Keily.exe
3644	Keily.exe
1616	Keily.exe
4996	Keily.exe
2084	Keily.exe
2820	Keily.exe
4804	Keily.exe
2276	Keily.exe
2888	Keily.exe
1628	Keily.exe
860	Keily.exe
3204	Keily.exe
4172	Keily.exe
1760	Keily.exe
3468	Keily.exe
1924	Keily.exe
2028	Keily.exe
804	Keily.exe
1012	Keily.exe
1596	Keily.exe
1264	Keily.exe
4828	Keily.exe
3824	Keily.exe
4820	Keily.exe
4372	Keily.exe
4040	Keily.exe
1300	Keily.exe
3456	Keily.exe
1352	Keily.exe
4244	Keily.exe
2460	Keily.exe
4432	Keily.exe
1872	Keily.exe
2916	Keily.exe
4608	Keily.exe
2084	Keily.exe
1112	Keily.exe
1612	Keily.exe
3040	Keily.exe
3540	Keily.exe
2340	Keily.exe
4976	Keily.exe
860	Keily.exe
2484	Keily.exe
2696	Keily.exe
2188	Keily.exe
2984	Keily.exe
1212	Keily.exe
3468	Keily.exe
3488	Keily.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d000000023b4c-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keily.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1436	2116	287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe	86
PID 2116 wrote to memory of 1436	2116	287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe	86
PID 2116 wrote to memory of 1436	2116	287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe	86
PID 1436 wrote to memory of 980	1436	Keily.exe	88
PID 1436 wrote to memory of 980	1436	Keily.exe	88
PID 1436 wrote to memory of 980	1436	Keily.exe	88
PID 980 wrote to memory of 3680	980	Keily.exe	91
PID 980 wrote to memory of 3680	980	Keily.exe	91
PID 980 wrote to memory of 3680	980	Keily.exe	91
PID 3680 wrote to memory of 2804	3680	Keily.exe	93
PID 3680 wrote to memory of 2804	3680	Keily.exe	93
PID 3680 wrote to memory of 2804	3680	Keily.exe	93
PID 2804 wrote to memory of 1212	2804	Keily.exe	97
PID 2804 wrote to memory of 1212	2804	Keily.exe	97
PID 2804 wrote to memory of 1212	2804	Keily.exe	97
PID 1212 wrote to memory of 1488	1212	Keily.exe	98
PID 1212 wrote to memory of 1488	1212	Keily.exe	98
PID 1212 wrote to memory of 1488	1212	Keily.exe	98
PID 1488 wrote to memory of 4792	1488	Keily.exe	101
PID 1488 wrote to memory of 4792	1488	Keily.exe	101
PID 1488 wrote to memory of 4792	1488	Keily.exe	101
PID 4792 wrote to memory of 2248	4792	Keily.exe	102
PID 4792 wrote to memory of 2248	4792	Keily.exe	102
PID 4792 wrote to memory of 2248	4792	Keily.exe	102
PID 2248 wrote to memory of 4712	2248	Keily.exe	103
PID 2248 wrote to memory of 4712	2248	Keily.exe	103
PID 2248 wrote to memory of 4712	2248	Keily.exe	103
PID 4712 wrote to memory of 4012	4712	Keily.exe	107
PID 4712 wrote to memory of 4012	4712	Keily.exe	107
PID 4712 wrote to memory of 4012	4712	Keily.exe	107
PID 4012 wrote to memory of 3824	4012	Keily.exe	109
PID 4012 wrote to memory of 3824	4012	Keily.exe	109
PID 4012 wrote to memory of 3824	4012	Keily.exe	109
PID 3824 wrote to memory of 2508	3824	Keily.exe	110
PID 3824 wrote to memory of 2508	3824	Keily.exe	110
PID 3824 wrote to memory of 2508	3824	Keily.exe	110
PID 2508 wrote to memory of 3456	2508	Keily.exe	111
PID 2508 wrote to memory of 3456	2508	Keily.exe	111
PID 2508 wrote to memory of 3456	2508	Keily.exe	111
PID 3456 wrote to memory of 2512	3456	Keily.exe	112
PID 3456 wrote to memory of 2512	3456	Keily.exe	112
PID 3456 wrote to memory of 2512	3456	Keily.exe	112
PID 2512 wrote to memory of 3004	2512	Keily.exe	113
PID 2512 wrote to memory of 3004	2512	Keily.exe	113
PID 2512 wrote to memory of 3004	2512	Keily.exe	113
PID 3004 wrote to memory of 3644	3004	Keily.exe	114
PID 3004 wrote to memory of 3644	3004	Keily.exe	114
PID 3004 wrote to memory of 3644	3004	Keily.exe	114
PID 3644 wrote to memory of 1616	3644	Keily.exe	115
PID 3644 wrote to memory of 1616	3644	Keily.exe	115
PID 3644 wrote to memory of 1616	3644	Keily.exe	115
PID 1616 wrote to memory of 4996	1616	Keily.exe	116
PID 1616 wrote to memory of 4996	1616	Keily.exe	116
PID 1616 wrote to memory of 4996	1616	Keily.exe	116
PID 4996 wrote to memory of 2084	4996	Keily.exe	117
PID 4996 wrote to memory of 2084	4996	Keily.exe	117
PID 4996 wrote to memory of 2084	4996	Keily.exe	117
PID 2084 wrote to memory of 2820	2084	Keily.exe	118
PID 2084 wrote to memory of 2820	2084	Keily.exe	118
PID 2084 wrote to memory of 2820	2084	Keily.exe	118
PID 2820 wrote to memory of 4804	2820	Keily.exe	119
PID 2820 wrote to memory of 4804	2820	Keily.exe	119
PID 2820 wrote to memory of 4804	2820	Keily.exe	119
PID 4804 wrote to memory of 2276	4804	Keily.exe	120

C:\Users\Admin\AppData\Local\Temp\287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe
"C:\Users\Admin\AppData\Local\Temp\287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\tilthead\Keily.exe
  "C:\Users\Admin\AppData\Local\Temp\287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4N.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\tilthead\Keily.exe
    "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Users\Admin\AppData\Local\tilthead\Keily.exe
      "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        25⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        26⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        29⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        31⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        32⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:804
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        34⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        40⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        42⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        44⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        47⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        48⤵
        Executes dropped EXE
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        53⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        54⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        55⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        56⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        58⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        59⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        60⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        61⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        63⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        65⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        67⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        68⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        70⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        71⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        73⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        76⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        81⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        86⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        87⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:532
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        90⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        91⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        93⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        94⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        96⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        99⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        100⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        104⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        105⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        106⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        107⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        110⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        111⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        115⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        118⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        120⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        122⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        123⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\tilthead\Keily.exe
        
        "C:\Users\Admin\AppData\Local\tilthead\Keily.exe"
        124⤵
        
        PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spado

Path C:\Users\Admin\AppData\Local\Temp\spado
Size 280KB
SHA256 1ed634233697b03ea4449078ce813693b83184003a73677a5325158d0243587d
MD5 6d81340c287a14f5c92a791fabc69061
SHA1 790b18df7bae8d52f7ac683df7d7a6bc13b0e3f3
SHA512 d52b339c1c21c7e4bd289f8ea5b7390496f5d4bee738e242cdb6264a5bb3b69fd39e14eb9973df69fc3641f1f5682849d34b534e7f31acb19498a83aff1179f1
SSDEEP 6144:xdMmaJ37jcnMo7xQnMJQ+t/X3jFq+dlV+2GixRBXWE:PMN/cnVQnMm+t/pVjVX1WE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Keily.exe

Path C:\Users\Admin\AppData\Local\tilthead\Keily.exe
Size 1.3MB
SHA256 287082fd744aa716778ca113be9cccb38b71672e31252befc6a862aad83fadc4
MD5 275de84f560d510ece370b3e70bced10
SHA1 e39d9d21c0378cf435e258bafa8b3ededce4cbc8
SHA512 e8c0976ffdbf9150a536c08868edb9a9a013583a5783561cd768d6ef7415fd7bdeecb0059af420060daece4966af22102ed1a06f50b424cbfe3c270985ac814f
SSDEEP 24576:IRmJkcoQricOIQxiZY1iaenGjcew+gu8PP8jkP8Sv/7JvbMvjGcDk:tJZoQrbTFZY1iaeaceRguyP8N67B7c4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/980-16-0x0000000003DD0000-0x0000000003FD0000-memory.dmp

Download

memory/1436-10-0x0000000003F70000-0x0000000004170000-memory.dmp

Download

memory/2116-2-0x0000000004190000-0x0000000004390000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads