Overview

overview

10

Static

static

3

New Text Document.exe

windows7-x64

1

New Text Document.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2024, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Text Document.exe
  • Size 4KB
  • Sample241114-aec7qs1hkd
  • SHA256 98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vipkeyloggeraspackv2collectioncredential_accessdiscoveryevasionexecutionkeyloggerpersistencepyinstallerspywarestealerupx

Malware Config

Extracted

Family

  • vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
  • Looks up external IP address via web service 17 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 62 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Users\Admin\AppData\Local\Temp\a\mk.exe
      "C:\Users\Admin\AppData\Local\Temp\a\mk.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvkf.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\a\mk.exe'; $s.Save()"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
    • C:\Users\Admin\AppData\Local\Temp\a\crypted2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\a\crypted2.exe
        "C:\Users\Admin\AppData\Local\Temp\a\crypted2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 288
        3⤵
        • Program crash
        PID:1740
    • C:\Users\Admin\AppData\Local\Temp\a\random.exe
      "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Windows\system32\cmd.exe
          cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\enters.exe"
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Suspicious use of WriteProcessMemory
          PID:2592
          • C:\Windows\system32\PING.EXE
            ping localhost -n 1
            5⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2124
          • C:\Users\Admin\AppData\Local\enters.exe
            C:\Users\Admin\AppData\Local\enters.exe
            5⤵
            • Executes dropped EXE
            PID:3432
    • C:\Users\Admin\AppData\Local\Temp\a\blhbZrtqbLg6O1K.exe
      "C:\Users\Admin\AppData\Local\Temp\a\blhbZrtqbLg6O1K.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\blhbZrtqbLg6O1K.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4388
      • C:\Users\Admin\AppData\Local\Temp\a\blhbZrtqbLg6O1K.exe
        "C:\Users\Admin\AppData\Local\Temp\a\blhbZrtqbLg6O1K.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1768
    • C:\Users\Admin\AppData\Local\Temp\a\Payload.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Payload.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\a\Payload.exe
        "C:\Users\Admin\AppData\Local\Temp\a\Payload.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1036
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          4⤵
            PID:924
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            4⤵
              PID:1000
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1584
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1440
        • C:\Users\Admin\AppData\Local\Temp\a\tacticalagent-v2.8.0-windows-amd64.exe
          "C:\Users\Admin\AppData\Local\Temp\a\tacticalagent-v2.8.0-windows-amd64.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Users\Admin\AppData\Local\Temp\is-P9IBP.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-P9IBP.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$11017A,3652845,825344,C:\Users\Admin\AppData\Local\Temp\a\tacticalagent-v2.8.0-windows-amd64.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1132
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:4544
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 2
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3440
              • C:\Windows\SysWOW64\net.exe
                net stop tacticalrpc
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1064
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop tacticalrpc
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:1708
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c net stop tacticalagent
              4⤵
              • System Location Discovery: System Language Discovery
              PID:808
              • C:\Windows\SysWOW64\net.exe
                net stop tacticalagent
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1548
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop tacticalagent
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:372
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
              4⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:464
              • C:\Windows\SysWOW64\PING.EXE
                ping 127.0.0.1 -n 2
                5⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2736
              • C:\Windows\SysWOW64\net.exe
                net stop tacticalrmm
                5⤵
                • System Location Discovery: System Language Discovery
                PID:544
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop tacticalrmm
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3944
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3336
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /F /IM tacticalrmm.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4344
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c sc delete tacticalagent
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3504
              • C:\Windows\SysWOW64\sc.exe
                sc delete tacticalagent
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2072
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c sc delete tacticalrpc
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3620
              • C:\Windows\SysWOW64\sc.exe
                sc delete tacticalrpc
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4268
            • C:\Program Files\TacticalAgent\tacticalrmm.exe
              "C:\Program Files\TacticalAgent\tacticalrmm.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2252
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c tacticalrmm.exe -m installsvc
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4320
              • C:\Program Files\TacticalAgent\tacticalrmm.exe
                tacticalrmm.exe -m installsvc
                5⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:724
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c net start tacticalrmm
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3264
              • C:\Windows\SysWOW64\net.exe
                net start tacticalrmm
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4528
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start tacticalrmm
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:560
        • C:\Users\Admin\AppData\Local\Temp\a\UNICO-Venta3401005.exe
          "C:\Users\Admin\AppData\Local\Temp\a\UNICO-Venta3401005.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3116
          • C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe
            "C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:1548
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Archivos de programa\UNICO - Ventas\ODBC.cmd" "
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2396
        • C:\Users\Admin\AppData\Local\Temp\a\shttpsr_mg.exe
          "C:\Users\Admin\AppData\Local\Temp\a\shttpsr_mg.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5068 -ip 5068
        1⤵
          PID:4520

        Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              4
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Query Registry

              2
              T1012

              Remote System Discovery

              1
              T1018

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Email Collection

              1
              T1114

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ODBC_VEN.exe
              • Path C:\Archivos de programa\Unico - Ventas\ODBC_VEN.exe
              • Size 968KB
              • SHA256 acda53d2a8f0d67a56e49b4f93d4f95e19e6ac7e35da9ba281314c67f4ef4671
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              odbc.ini
              • Path C:\Archivos de programa\Unico - Ventas\odbc.ini
              • Size 234B
              • SHA256 5cdf5c3ac6274a8098856150572ddd3484f3c8039dc303a003e009d51c32de74
              • MD5 SHA1 SHA512
              Submit Download

              odbc.ini
              • Path C:\Archivos de programa\Unico - Ventas\odbc.ini
              • Size 234B
              • SHA256 55b82d79e9e84a44e4c917bc8efc180a47e4d30f53bc966648cd491c0b575c6e
              • MD5 SHA1 SHA512
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\VCRUNTIME140.dll
              • Size 106KB
              • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\_bz2.pyd
              • Size 82KB
              • SHA256 403e76fe18515a5ea3227cf5f919aa2f32ac3233853c9fb71627f2251c554d09
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\_ctypes.pyd
              • Size 120KB
              • SHA256 e28d4e46e5d10b5fdcf0292f91e8fd767e33473116247cd5d577e4554d7a4c0c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\_lzma.pyd
              • Size 155KB
              • SHA256 ad0440ca6998e18f5cc917d088af3fea2c0ff0febce2b5e2b6c0f1370f6e87b1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-console-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-console-l1-1-0.dll
              • Size 21KB
              • SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-datetime-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-datetime-l1-1-0.dll
              • Size 21KB
              • SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-debug-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-debug-l1-1-0.dll
              • Size 21KB
              • SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-errorhandling-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-errorhandling-l1-1-0.dll
              • Size 21KB
              • SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-file-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-file-l1-1-0.dll
              • Size 25KB
              • SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-file-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-file-l1-2-0.dll
              • Size 21KB
              • SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-file-l2-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-file-l2-1-0.dll
              • Size 18KB
              • SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-handle-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-handle-l1-1-0.dll
              • Size 21KB
              • SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-heap-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-heap-l1-1-0.dll
              • Size 21KB
              • SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-interlocked-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-interlocked-l1-1-0.dll
              • Size 21KB
              • SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-libraryloader-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-libraryloader-l1-1-0.dll
              • Size 21KB
              • SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-localization-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-localization-l1-2-0.dll
              • Size 21KB
              • SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-memory-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-memory-l1-1-0.dll
              • Size 21KB
              • SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-namedpipe-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-namedpipe-l1-1-0.dll
              • Size 21KB
              • SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-processenvironment-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-processenvironment-l1-1-0.dll
              • Size 21KB
              • SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-processthreads-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-processthreads-l1-1-0.dll
              • Size 21KB
              • SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-processthreads-l1-1-1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-processthreads-l1-1-1.dll
              • Size 21KB
              • SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-profile-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-profile-l1-1-0.dll
              • Size 21KB
              • SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-rtlsupport-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-rtlsupport-l1-1-0.dll
              • Size 21KB
              • SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-string-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-string-l1-1-0.dll
              • Size 21KB
              • SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-synch-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-synch-l1-1-0.dll
              • Size 21KB
              • SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-synch-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-synch-l1-2-0.dll
              • Size 21KB
              • SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-sysinfo-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-sysinfo-l1-1-0.dll
              • Size 21KB
              • SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-timezone-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-timezone-l1-1-0.dll
              • Size 21KB
              • SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-util-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-core-util-l1-1-0.dll
              • Size 21KB
              • SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-conio-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-conio-l1-1-0.dll
              • Size 21KB
              • SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-convert-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-convert-l1-1-0.dll
              • Size 25KB
              • SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-environment-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-environment-l1-1-0.dll
              • Size 21KB
              • SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-filesystem-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-filesystem-l1-1-0.dll
              • Size 21KB
              • SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-heap-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-heap-l1-1-0.dll
              • Size 21KB
              • SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-locale-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-locale-l1-1-0.dll
              • Size 21KB
              • SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-math-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\api-ms-win-crt-math-l1-1-0.dll
              • Size 29KB
              • SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\base_library.zip
              • Size 1.4MB
              • SHA256 4c21adbcc2a8d8adc1d4b693017c6276b03cb505bb810f46709d75ac3fb77668
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              python3.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\python3.DLL
              • Size 65KB
              • SHA256 e45452efa356db874f2e5ff08c9cc0fe22528609e5d341f8fb67ba48885ab77d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              python311.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\python311.dll
              • Size 5.5MB
              • SHA256 53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ucrtbase.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI11962\ucrtbase.dll
              • Size 992KB
              • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              __PSScriptPolicyTest_oknmatst.t3l.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oknmatst.t3l.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512
              Submit Download

              02.08.2022.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
              • Size 208KB
              • SHA256 0580a91455de960968d476ed6c128eadc7e30e49f1638f2a08efed8424f2eb37
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Payload.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\Payload.exe
              • Size 25.0MB
              • SHA256 24c7c6cc3124b20c717ac485e263193e351f0ab2e672b353b38688ba218bda9a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              UNICO-Venta3401005.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\UNICO-Venta3401005.exe
              • Size 10.4MB
              • SHA256 d50b291f2cbd21c11648a5722030b4e8f398b1683cec9c3ffdcac7580c7604d0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              blhbZrtqbLg6O1K.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\blhbZrtqbLg6O1K.exe
              • Size 716KB
              • SHA256 1964409e74e36bbbf384ed0b794965452fd60942e53e5ca3339d763c77c69e18
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              crypted2.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\crypted2.exe
              • Size 2.7MB
              • SHA256 d9fba27655b90106c566310bbaaabfca48c0d74db5c29cb6eb075fa105fd24a9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              mk.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\mk.exe
              • Size 8.9MB
              • SHA256 095a2046d9a3aeeefc290dc43793f58ba6ab884a30d1743d04c9b5423234ccdd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              random.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\random.exe
              • Size 3.5MB
              • SHA256 0deda950a821dbc7181325ed1b2ffc2a970ea268f1c99d3ed1e5330f362ba37e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              shttpsr_mg.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\shttpsr_mg.exe
              • Size 186KB
              • SHA256 68fbb7d4c5af27b3941f4db758e2007decdd35849ab025a9e06d2ad4718b8b63
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              tacticalagent-v2.8.0-windows-amd64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\a\tacticalagent-v2.8.0-windows-amd64.exe
              • Size 4.3MB
              • SHA256 d6c7bdab07151678b713a02efe7ad5281b194b0d5b538061bdafdf2c4ca1fdaa
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              lxcook.txt
              • Path C:\Users\Admin\AppData\Local\Temp\lxcook.txt
              • Size 1KB
              • SHA256 c8af73d935e7dac30747ebbabcdb54d16729ef54a4b172cc6e3495278d86e453
              • MD5 SHA1 SHA512
              Submit Download

              lxpassw.txt
              • Path C:\Users\Admin\AppData\Local\Temp\lxpassw.txt
              • Size 22B
              • SHA256 c032c342da12f1a530347ce33b632c62ac63a2300ab58bab6d38e9459140eabb
              • MD5 SHA1 SHA512
              Submit Download

              Templxjovlmwyc.db
              • Path C:\Users\Admin\AppData\Local\Templxjovlmwyc.db
              • Size 20KB
              • SHA256 1e47ee7b6c95a7e46177192a7a0214d8509744c2d26fd2b5a94d2ccc28c42b3e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Templxmpkzinjd.db
              • Path C:\Users\Admin\AppData\Local\Templxmpkzinjd.db
              • Size 40KB
              • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/1108-464-0x0000023F3C3E0000-0x0000023F3C402000-memory.dmp
              Download

              memory/1132-588-0x0000000000400000-0x0000000000712000-memory.dmp
              Download

              memory/1132-584-0x0000000000400000-0x0000000000712000-memory.dmp
              Download

              memory/1548-1038-0x00000000043B0000-0x0000000004462000-memory.dmp
              Download

              memory/1548-1015-0x00000000043B0000-0x0000000004462000-memory.dmp
              Download

              memory/1548-1057-0x0000000000400000-0x00000000005C6000-memory.dmp
              Download

              memory/1548-1054-0x00000000043B0000-0x0000000004462000-memory.dmp
              Download

              memory/1548-1037-0x0000000000400000-0x00000000005C6000-memory.dmp
              Download

              memory/1548-1049-0x0000000000400000-0x00000000005C6000-memory.dmp
              Download

              memory/1548-1045-0x0000000000400000-0x00000000005C6000-memory.dmp
              Download

              memory/1548-1041-0x0000000000400000-0x00000000005C6000-memory.dmp
              Download

              memory/1548-1053-0x0000000000400000-0x00000000005C6000-memory.dmp
              Download

              memory/1708-1036-0x0000000000400000-0x000000000047D000-memory.dmp
              Download

              memory/1708-693-0x0000000000400000-0x000000000047D000-memory.dmp
              Download

              memory/1768-326-0x0000000000400000-0x0000000000448000-memory.dmp
              Download

              memory/1768-451-0x00000000068F0000-0x0000000006AB2000-memory.dmp
              Download

              memory/1768-456-0x0000000006790000-0x00000000067E0000-memory.dmp
              Download

              memory/2836-29-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp
              Download

              memory/2836-0-0x0000000000F00000-0x0000000000F08000-memory.dmp
              Download

              memory/2836-1-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp
              Download

              memory/2836-2-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp
              Download

              memory/2836-30-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp
              Download

              memory/3116-1034-0x0000000000400000-0x0000000000420000-memory.dmp
              Download

              memory/3400-28-0x0000000000F00000-0x00000000011BF000-memory.dmp
              Download

              memory/3400-24-0x0000000000400000-0x0000000000459000-memory.dmp
              Download

              memory/3400-27-0x0000000000400000-0x0000000000459000-memory.dmp
              Download

              memory/3980-324-0x0000000006670000-0x00000000066FE000-memory.dmp
              Download

              memory/3980-63-0x0000000007DD0000-0x0000000007E78000-memory.dmp
              Download

              memory/3980-325-0x00000000068F0000-0x000000000698C000-memory.dmp
              Download

              memory/3980-54-0x0000000000920000-0x00000000009DA000-memory.dmp
              Download

              memory/3980-58-0x00000000059C0000-0x0000000005F64000-memory.dmp
              Download

              memory/3980-59-0x0000000005410000-0x00000000054A2000-memory.dmp
              Download

              memory/3980-61-0x00000000053D0000-0x00000000053DA000-memory.dmp
              Download

              memory/3980-64-0x00000000057A0000-0x00000000057B2000-memory.dmp
              Download

              memory/3988-572-0x0000000000400000-0x00000000004D7000-memory.dmp
              Download

              memory/3988-583-0x0000000000400000-0x00000000004D7000-memory.dmp
              Download

              memory/3988-589-0x0000000000400000-0x00000000004D7000-memory.dmp
              Download

              memory/3996-457-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/3996-445-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/3996-551-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/3996-65-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/3996-14-0x0000000000D50000-0x0000000000D51000-memory.dmp
              Download

              memory/3996-1051-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/3996-577-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/3996-1039-0x0000000000400000-0x0000000000CF2000-memory.dmp
              Download

              memory/4388-365-0x0000000007240000-0x0000000007251000-memory.dmp
              Download

              memory/4388-342-0x0000000005910000-0x0000000005C64000-memory.dmp
              Download

              memory/4388-363-0x00000000070B0000-0x00000000070BA000-memory.dmp
              Download

              memory/4388-362-0x0000000007040000-0x000000000705A000-memory.dmp
              Download

              memory/4388-361-0x0000000007680000-0x0000000007CFA000-memory.dmp
              Download

              memory/4388-360-0x0000000006F00000-0x0000000006FA3000-memory.dmp
              Download

              memory/4388-359-0x0000000006ED0000-0x0000000006EEE000-memory.dmp
              Download

              memory/4388-348-0x00000000062E0000-0x0000000006312000-memory.dmp
              Download

              memory/4388-349-0x00000000749F0000-0x0000000074A3C000-memory.dmp
              Download

              memory/4388-347-0x0000000005DA0000-0x0000000005DEC000-memory.dmp
              Download

              memory/4388-346-0x0000000005D20000-0x0000000005D3E000-memory.dmp
              Download

              memory/4388-364-0x00000000072C0000-0x0000000007356000-memory.dmp
              Download

              memory/4388-331-0x00000000055C0000-0x0000000005626000-memory.dmp
              Download

              memory/4388-332-0x00000000056A0000-0x0000000005706000-memory.dmp
              Download

              memory/4388-366-0x0000000007270000-0x000000000727E000-memory.dmp
              Download

              memory/4388-330-0x0000000004E10000-0x0000000004E32000-memory.dmp
              Download

              memory/4388-329-0x0000000004F20000-0x0000000005548000-memory.dmp
              Download

              memory/4388-328-0x00000000023F0000-0x0000000002426000-memory.dmp
              Download

              memory/4388-367-0x0000000007280000-0x0000000007294000-memory.dmp
              Download

              memory/4388-368-0x0000000007380000-0x000000000739A000-memory.dmp
              Download

              memory/4388-369-0x0000000007360000-0x0000000007368000-memory.dmp
              Download

              memory/5068-23-0x0000000001123000-0x0000000001124000-memory.dmp
              Download