exelastealer | 516f36909316473913107bf8a3672e6586e5091eff66a3f9d698817f626b8a8f

Analysis

max time kernel
69s
max time network
71s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
05-12-2024 22:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Sniper 17.11.24/Roblox Sniper/snipemania.exe
Size

10.8MB
MD5

77ae59ba29b4f49eb0e79f5cee225ddf
SHA1

b6b8f720cb86be6ce9c8f866be783b44f6fbfb26
SHA256

f6e9058833929bb527520291381b258da8cae37db65cdecd95d06971b93daa9a
SHA512

eb08371ba4b060f4d03337d1611d999947137a5a6bedef1bee1548e013bf796c44aa4b1cb06594afc44b787135745ba22b66ad26c604dffd6a9cd523dfd6781f
SSDEEP

196608:8UXm51flz2Jp5UfLuiB6yavnlPzf+JiJCsVMvHTynKFDhSiJSamx:eh2Jp5MlBRavnlPSa7WvuexXmx

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4624	netsh.exe
4800	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1060	cmd.exe
1268	powershell.exe

Loads dropped DLL 31 IoCs

pid	Process
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe
3772	snipemania.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	discord.com
10	discord.com
11	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4712	cmd.exe
4852	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5036	tasklist.exe
1508	tasklist.exe
1012	tasklist.exe
4688	tasklist.exe
3192	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2396	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002ab15-46.dat	upx
behavioral1/memory/3772-50-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp	upx
behavioral1/files/0x001900000002aad4-52.dat	upx
behavioral1/files/0x001c00000002aadb-73.dat	upx
behavioral1/memory/3772-79-0x00007FFA45900000-0x00007FFA4590F000-memory.dmp	upx
behavioral1/files/0x001c00000002aae1-77.dat	upx
behavioral1/files/0x001900000002aae0-76.dat	upx
behavioral1/files/0x001900000002aadd-75.dat	upx
behavioral1/files/0x001900000002aadc-74.dat	upx
behavioral1/files/0x001c00000002aad5-69.dat	upx
behavioral1/files/0x001900000002aad1-68.dat	upx
behavioral1/files/0x001900000002aad0-67.dat	upx
behavioral1/files/0x001c00000002aacf-66.dat	upx
behavioral1/files/0x001900000002ab18-65.dat	upx
behavioral1/files/0x001900000002ab17-64.dat	upx
behavioral1/files/0x001900000002ab16-63.dat	upx
behavioral1/files/0x001900000002ab13-62.dat	upx
behavioral1/files/0x001900000002ab10-61.dat	upx
behavioral1/files/0x001900000002ab0e-60.dat	upx
behavioral1/files/0x001900000002ab0f-59.dat	upx
behavioral1/files/0x001900000002aada-72.dat	upx
behavioral1/files/0x001900000002aad7-71.dat	upx
behavioral1/files/0x001900000002aad6-70.dat	upx
behavioral1/memory/3772-58-0x00007FFA40200000-0x00007FFA40223000-memory.dmp	upx
behavioral1/memory/3772-81-0x00007FFA41640000-0x00007FFA41659000-memory.dmp	upx
behavioral1/memory/3772-83-0x00007FFA458C0000-0x00007FFA458CD000-memory.dmp	upx
behavioral1/memory/3772-85-0x00007FFA41580000-0x00007FFA41599000-memory.dmp	upx
behavioral1/memory/3772-87-0x00007FFA401D0000-0x00007FFA401FD000-memory.dmp	upx
behavioral1/memory/3772-89-0x00007FFA401A0000-0x00007FFA401C3000-memory.dmp	upx
behavioral1/memory/3772-91-0x00007FFA3C350000-0x00007FFA3C4BF000-memory.dmp	upx
behavioral1/memory/3772-93-0x00007FFA3FC30000-0x00007FFA3FC5E000-memory.dmp	upx
behavioral1/memory/3772-97-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp	upx
behavioral1/memory/3772-98-0x00007FFA3C120000-0x00007FFA3C1D8000-memory.dmp	upx
behavioral1/memory/3772-101-0x00007FFA40200000-0x00007FFA40223000-memory.dmp	upx
behavioral1/memory/3772-100-0x00007FFA3B8D0000-0x00007FFA3BC45000-memory.dmp	upx
behavioral1/memory/3772-103-0x00007FFA3FC10000-0x00007FFA3FC25000-memory.dmp	upx
behavioral1/memory/3772-105-0x00007FFA41640000-0x00007FFA41659000-memory.dmp	upx
behavioral1/files/0x001900000002ab12-107.dat	upx
behavioral1/memory/3772-106-0x00007FFA3FBF0000-0x00007FFA3FC02000-memory.dmp	upx
behavioral1/memory/3772-109-0x00007FFA458C0000-0x00007FFA458CD000-memory.dmp	upx
behavioral1/memory/3772-110-0x00007FFA3FBD0000-0x00007FFA3FBE4000-memory.dmp	upx
behavioral1/memory/3772-112-0x00007FFA41580000-0x00007FFA41599000-memory.dmp	upx
behavioral1/memory/3772-113-0x00007FFA3C580000-0x00007FFA3C594000-memory.dmp	upx
behavioral1/memory/3772-115-0x00007FFA401D0000-0x00007FFA401FD000-memory.dmp	upx
behavioral1/memory/3772-116-0x00007FFA3C000000-0x00007FFA3C11C000-memory.dmp	upx
behavioral1/files/0x001900000002ab1a-117.dat	upx
behavioral1/memory/3772-120-0x00007FFA3C320000-0x00007FFA3C342000-memory.dmp	upx
behavioral1/memory/3772-119-0x00007FFA401A0000-0x00007FFA401C3000-memory.dmp	upx
behavioral1/files/0x001900000002aae6-121.dat	upx
behavioral1/files/0x001900000002aae8-123.dat	upx
behavioral1/memory/3772-126-0x00007FFA3C350000-0x00007FFA3C4BF000-memory.dmp	upx
behavioral1/memory/3772-129-0x00007FFA3FC30000-0x00007FFA3FC5E000-memory.dmp	upx
behavioral1/memory/3772-128-0x00007FFA3C2E0000-0x00007FFA3C2F9000-memory.dmp	upx
behavioral1/memory/3772-131-0x00007FFA3C120000-0x00007FFA3C1D8000-memory.dmp	upx
behavioral1/files/0x001900000002aae9-133.dat	upx
behavioral1/memory/3772-127-0x00007FFA3C300000-0x00007FFA3C317000-memory.dmp	upx
behavioral1/files/0x001c00000002aae7-130.dat	upx
behavioral1/files/0x001900000002ab0d-135.dat	upx
behavioral1/memory/3772-140-0x00007FFA3BF70000-0x00007FFA3BF8E000-memory.dmp	upx
behavioral1/memory/3772-142-0x00007FFA3BF90000-0x00007FFA3BFA1000-memory.dmp	upx
behavioral1/memory/3772-141-0x00007FFA3B8D0000-0x00007FFA3BC45000-memory.dmp	upx
behavioral1/memory/3772-139-0x00007FFA3BFB0000-0x00007FFA3BFFA000-memory.dmp	upx
behavioral1/files/0x001900000002ab0b-138.dat	upx
behavioral1/memory/3772-145-0x00007FFA38860000-0x00007FFA38F54000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4796	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001900000002ab21-159.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2072	cmd.exe
4908	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1688	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4820	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4092	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
956	ipconfig.exe
1688	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3132	systeminfo.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "183"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	powershell.exe
1268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1988	WMIC.exe
Token: SeSecurityPrivilege	1988	WMIC.exe
Token: SeTakeOwnershipPrivilege	1988	WMIC.exe
Token: SeLoadDriverPrivilege	1988	WMIC.exe
Token: SeSystemProfilePrivilege	1988	WMIC.exe
Token: SeSystemtimePrivilege	1988	WMIC.exe
Token: SeProfSingleProcessPrivilege	1988	WMIC.exe
Token: SeIncBasePriorityPrivilege	1988	WMIC.exe
Token: SeCreatePagefilePrivilege	1988	WMIC.exe
Token: SeBackupPrivilege	1988	WMIC.exe
Token: SeRestorePrivilege	1988	WMIC.exe
Token: SeShutdownPrivilege	1988	WMIC.exe
Token: SeDebugPrivilege	1988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1988	WMIC.exe
Token: SeRemoteShutdownPrivilege	1988	WMIC.exe
Token: SeUndockPrivilege	1988	WMIC.exe
Token: SeManageVolumePrivilege	1988	WMIC.exe
Token: 33	1988	WMIC.exe
Token: 34	1988	WMIC.exe
Token: 35	1988	WMIC.exe
Token: 36	1988	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4092	WMIC.exe
Token: SeSecurityPrivilege	4092	WMIC.exe
Token: SeTakeOwnershipPrivilege	4092	WMIC.exe
Token: SeLoadDriverPrivilege	4092	WMIC.exe
Token: SeSystemProfilePrivilege	4092	WMIC.exe
Token: SeSystemtimePrivilege	4092	WMIC.exe
Token: SeProfSingleProcessPrivilege	4092	WMIC.exe
Token: SeIncBasePriorityPrivilege	4092	WMIC.exe
Token: SeCreatePagefilePrivilege	4092	WMIC.exe
Token: SeBackupPrivilege	4092	WMIC.exe
Token: SeRestorePrivilege	4092	WMIC.exe
Token: SeShutdownPrivilege	4092	WMIC.exe
Token: SeDebugPrivilege	4092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4092	WMIC.exe
Token: SeRemoteShutdownPrivilege	4092	WMIC.exe
Token: SeUndockPrivilege	4092	WMIC.exe
Token: SeManageVolumePrivilege	4092	WMIC.exe
Token: 33	4092	WMIC.exe
Token: 34	4092	WMIC.exe
Token: 35	4092	WMIC.exe
Token: 36	4092	WMIC.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1988	WMIC.exe
Token: SeSecurityPrivilege	1988	WMIC.exe
Token: SeTakeOwnershipPrivilege	1988	WMIC.exe
Token: SeLoadDriverPrivilege	1988	WMIC.exe
Token: SeSystemProfilePrivilege	1988	WMIC.exe
Token: SeSystemtimePrivilege	1988	WMIC.exe
Token: SeProfSingleProcessPrivilege	1988	WMIC.exe
Token: SeIncBasePriorityPrivilege	1988	WMIC.exe
Token: SeCreatePagefilePrivilege	1988	WMIC.exe
Token: SeBackupPrivilege	1988	WMIC.exe
Token: SeRestorePrivilege	1988	WMIC.exe
Token: SeShutdownPrivilege	1988	WMIC.exe
Token: SeDebugPrivilege	1988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1988	WMIC.exe
Token: SeRemoteShutdownPrivilege	1988	WMIC.exe
Token: SeUndockPrivilege	1988	WMIC.exe
Token: SeManageVolumePrivilege	1988	WMIC.exe
Token: 33	1988	WMIC.exe
Token: 34	1988	WMIC.exe
Token: 35	1988	WMIC.exe
Token: 36	1988	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1652	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3772	2356	snipemania.exe	77
PID 2356 wrote to memory of 3772	2356	snipemania.exe	77
PID 3772 wrote to memory of 4604	3772	snipemania.exe	78
PID 3772 wrote to memory of 4604	3772	snipemania.exe	78
PID 3772 wrote to memory of 3060	3772	snipemania.exe	80
PID 3772 wrote to memory of 3060	3772	snipemania.exe	80
PID 3772 wrote to memory of 2988	3772	snipemania.exe	81
PID 3772 wrote to memory of 2988	3772	snipemania.exe	81
PID 3772 wrote to memory of 1140	3772	snipemania.exe	82
PID 3772 wrote to memory of 1140	3772	snipemania.exe	82
PID 3772 wrote to memory of 4040	3772	snipemania.exe	83
PID 3772 wrote to memory of 4040	3772	snipemania.exe	83
PID 2988 wrote to memory of 1988	2988	cmd.exe	88
PID 2988 wrote to memory of 1988	2988	cmd.exe	88
PID 3060 wrote to memory of 4092	3060	cmd.exe	89
PID 3060 wrote to memory of 4092	3060	cmd.exe	89
PID 4040 wrote to memory of 5036	4040	cmd.exe	90
PID 4040 wrote to memory of 5036	4040	cmd.exe	90
PID 3772 wrote to memory of 3292	3772	snipemania.exe	92
PID 3772 wrote to memory of 3292	3772	snipemania.exe	92
PID 3292 wrote to memory of 1600	3292	cmd.exe	94
PID 3292 wrote to memory of 1600	3292	cmd.exe	94
PID 3772 wrote to memory of 5016	3772	snipemania.exe	95
PID 3772 wrote to memory of 5016	3772	snipemania.exe	95
PID 3772 wrote to memory of 1556	3772	snipemania.exe	96
PID 3772 wrote to memory of 1556	3772	snipemania.exe	96
PID 1556 wrote to memory of 1508	1556	cmd.exe	99
PID 1556 wrote to memory of 1508	1556	cmd.exe	99
PID 5016 wrote to memory of 5008	5016	cmd.exe	100
PID 5016 wrote to memory of 5008	5016	cmd.exe	100
PID 3772 wrote to memory of 2396	3772	snipemania.exe	101
PID 3772 wrote to memory of 2396	3772	snipemania.exe	101
PID 2396 wrote to memory of 3352	2396	cmd.exe	103
PID 2396 wrote to memory of 3352	2396	cmd.exe	103
PID 3772 wrote to memory of 1464	3772	snipemania.exe	104
PID 3772 wrote to memory of 1464	3772	snipemania.exe	104
PID 3772 wrote to memory of 1456	3772	snipemania.exe	105
PID 3772 wrote to memory of 1456	3772	snipemania.exe	105
PID 1456 wrote to memory of 1012	1456	cmd.exe	108
PID 1456 wrote to memory of 1012	1456	cmd.exe	108
PID 1464 wrote to memory of 3568	1464	cmd.exe	109
PID 1464 wrote to memory of 3568	1464	cmd.exe	109
PID 3772 wrote to memory of 3204	3772	snipemania.exe	110
PID 3772 wrote to memory of 3204	3772	snipemania.exe	110
PID 3772 wrote to memory of 3932	3772	snipemania.exe	111
PID 3772 wrote to memory of 3932	3772	snipemania.exe	111
PID 3772 wrote to memory of 1040	3772	snipemania.exe	112
PID 3772 wrote to memory of 1040	3772	snipemania.exe	112
PID 3772 wrote to memory of 1060	3772	snipemania.exe	113
PID 3772 wrote to memory of 1060	3772	snipemania.exe	113
PID 3932 wrote to memory of 3112	3932	cmd.exe	118
PID 3932 wrote to memory of 3112	3932	cmd.exe	118
PID 3204 wrote to memory of 2432	3204	cmd.exe	119
PID 3204 wrote to memory of 2432	3204	cmd.exe	119
PID 3112 wrote to memory of 2348	3112	cmd.exe	120
PID 3112 wrote to memory of 2348	3112	cmd.exe	120
PID 2432 wrote to memory of 2044	2432	cmd.exe	121
PID 2432 wrote to memory of 2044	2432	cmd.exe	121
PID 1040 wrote to memory of 4688	1040	cmd.exe	122
PID 1040 wrote to memory of 4688	1040	cmd.exe	122
PID 1060 wrote to memory of 1268	1060	cmd.exe	123
PID 1060 wrote to memory of 1268	1060	cmd.exe	123
PID 3772 wrote to memory of 4712	3772	snipemania.exe	124
PID 3772 wrote to memory of 4712	3772	snipemania.exe	124

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3352	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Sniper 17.11.24\Roblox Sniper\snipemania.exe
"C:\Users\Admin\AppData\Local\Temp\Sniper 17.11.24\Roblox Sniper\snipemania.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Sniper 17.11.24\Roblox Sniper\snipemania.exe
  "C:\Users\Admin\AppData\Local\Temp\Sniper 17.11.24\Roblox Sniper\snipemania.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:1140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:3568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3204
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4712
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3132
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4820
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:2292
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4924
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:3016
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:3148
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:1856
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2836
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2296
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1756
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:3052
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:1544
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:2980
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:2484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:2260
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3192
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:956
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3824
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4852
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1688
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:4796
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4800
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2072
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1372
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1340

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a32855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe

Filesize
10.8MB

MD5
77ae59ba29b4f49eb0e79f5cee225ddf

SHA1
b6b8f720cb86be6ce9c8f866be783b44f6fbfb26

SHA256
f6e9058833929bb527520291381b258da8cae37db65cdecd95d06971b93daa9a

SHA512
eb08371ba4b060f4d03337d1611d999947137a5a6bedef1bee1548e013bf796c44aa4b1cb06594afc44b787135745ba22b66ad26c604dffd6a9cd523dfd6781f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_asyncio.pyd

Filesize
36KB

MD5
3f9190b92f01a91c6d0b90bd184d6abc

SHA1
abcc78fa001ab6cf75cc4e39941165001f85221e

SHA256
f42f9d41bf350379cae2665752f261c6e1a1eab009c25b78ad4b6163f62ec576

SHA512
6826734ed41026fa1f97522e4c1ddc5be2fb874774158ffeff5038536545d3bde8cc36fec8a8c5c98b7e7651d42e9f52285e1f7622b61c51b67f1f846a0f2fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_bz2.pyd

Filesize
48KB

MD5
1f7fe39a2cd5deb52d5fe73b5374ee84

SHA1
8c1ebfa645a9686225daaf27dbf9b769c09f390f

SHA256
e36d2c8699037bb29343f82038105c57712da0ed5f91a01a97caaf9abbb9610b

SHA512
75048e19133b594abdd1750075b3dc4386745ed9208b38ed72ad93cb41e942177e8435cda883802dff696c0cbdd073a3a33d829cf8c0ccd69bb21111579f3853

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
2443ecaddfe40ee5130539024324e7fc

SHA1
ea74aaf7848de0a078a1510c3430246708631108

SHA256
9a5892ac0cd00c44cd7744d60c9459f302d5984ddb395caea52e4d8fd9bca2da

SHA512
5896af78cf208e1350cf2c31f913aa100098dd1cf4bae77cd2a36ec7695015986ec9913df8d2ebc9992f8f7d48bba102647dc5ee7f776593ae7be36f46bd5c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_ctypes.pyd

Filesize
58KB

MD5
d75c4bb09bb92aea8605876598cca0b7

SHA1
705f696028d137038a0a4a9396a1d80a7df2ba0c

SHA256
943139c952a1ff95e63a3ff3226c4815fd82488d4cf7e6b66c3d30cc9840c66d

SHA512
ca687ae62439d62454c6ebd3edffc6e516ef33dcb00538ddebbf2fca6d884d8ec3356dd69e285e00ca6def38684abb01654cbe9d03e81915c20c700e64201e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_decimal.pyd

Filesize
106KB

MD5
72f1145a4a32aef82e2e6e723dfe83a8

SHA1
075f20493db64e955ea93011bb1cad011b6af1f7

SHA256
6da30bfe1dcd54367817947bb5cdfba7e83156ab97d69df7f373b13a1f1bb1e5

SHA512
f2a6331c4e639e5eaca1ccec8da156b4a7ea7ddfc402b102f4cdf6f6b5138e5b35ccc86b83a037119526e2e26534ac0cbb0e905434d74ca5853aad487cf4cab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_hashlib.pyd

Filesize
35KB

MD5
965e800632867a999ef07c373ef7465d

SHA1
6b6ee62de84bbd3d5868274331d873369735a0f6

SHA256
aa1a32a8b6d2ff445b73c145dafcae2373031f797a7922cec7b0ada83f8f00ed

SHA512
5de95c46567af043891e7b1e65f3b04cbc6899a0107c069b42140218a739efe227ec0b5a48b4d999eba096b7919bcdc0e69e05e89cf35431439945fedcb7b58a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_lzma.pyd

Filesize
85KB

MD5
36ca956087c372d01938d27256d3b02b

SHA1
196b822034ae4ee2279cc13280a19db0a814dc7d

SHA256
7fb9bc77eda3cc5f33e4796856d50f361312273c36af08e7441592f6e460326b

SHA512
3f0b69d651b0cfe98f65efdd8a430c46fdf0d3507b2fc79c09d5efc03f3bc68823435409a7773896f1df6b5fbc9158244dd902468eb6898ae6b67d9a54c9645e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_multiprocessing.pyd

Filesize
26KB

MD5
b9b7817052bd0343bf584d532c1154d9

SHA1
0eb4ee9b3441be384361d173563f4e33e33c3983

SHA256
791ecbd0abb0462a96a8fe23b6ee3373fe239c1a65a8e5c85edf6280c36f09ba

SHA512
a2f253f4f9a4fc71e765e736fd82c595b3ad6236851b526ded64d0dfeedc8afce33ff598531d6377918b080941f798c157f7ec024bf11a10a813e250bf52bc4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_overlapped.pyd

Filesize
32KB

MD5
270a829c3295e3565abfdf44c0de37a2

SHA1
8f59262f3fbfd7c7eec181a0c1cb632d2a6aac77

SHA256
a0fd922a250951574961af2d80137e1f06ec3fa80b72e9fc3ca545601b851475

SHA512
e241689e5a3376bdf38c5e95ad7eaed363936ed029fc331ddf51de95182d43ef7fe5c6857511df03b773d801706660d56471fbf1d11d26044d2fe80d5c8f75a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_queue.pyd

Filesize
25KB

MD5
145984b051cdeac6753e51b8b4bed1b3

SHA1
b2d939281b792cb15ee3c0e84ace4465fe7f04fa

SHA256
47bb32c1d2c61148aaf88b039a9e304754194b86a89b78796a873d99446f8c9e

SHA512
53a2e78abd1e8c21f4f28b95fca4577742a1a302307195b06da0636ba7683fe053a8d82839ce3435d7777c38c9cd27b9571dffb49a2f09d121081c3388182149

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_socket.pyd

Filesize
43KB

MD5
32828d8c0b33d457e536f1af4363effb

SHA1
865d6e5b271de7111f11665f352bddafeb8bf726

SHA256
243017793b85e39cbd90ffa14b97feb9b2c16b4b70bd47121339671e47fecb15

SHA512
6b37a86a86fa6fb4f4abc6407306cc65ae2308c04ffacdb4a232f72494d34524c5bed83467236dcc2133b5cdb3e2e7d762b29c3cdbb765a2610e932221839e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_sqlite3.pyd

Filesize
56KB

MD5
6eddc28265692ba8b5c25a1d5f26257d

SHA1
dadf3fc95b0fc1c76b463185f2f0c45a089ce862

SHA256
b8005a6e845acecd822596552d451d829c81f7cdb1195135b14840999d811b99

SHA512
b8c78c5f3300b8507f1ee323df41c89d4bd2f82837fe1e171cabfe3db082b5ad65a4e390064ea8dd5747d3c2285183fcde18d8356eb59dc5d25441ec0a95bc3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_ssl.pyd

Filesize
62KB

MD5
c41938e204ea69aec5902144a6b57ae8

SHA1
6ae800edab188ea567320caba9c3b616c925f1a7

SHA256
df6cc2984f13bad2632aa3a65dd2895837c63caf9da215be8d7e14ce665ccfb8

SHA512
12db329d88bff6978451dd6ad3df22f2cfb9a365ed23946d9b7ac45c7e74621b1c6631436923a639232f7f292d1f5b15699a57042b4945cfa5765dc35fde27a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\_uuid.pyd

Filesize
24KB

MD5
a16b1acfdaadc7bb4f6ddf17659a8d12

SHA1
482982d623d88627c447f96703e4d166f9e51db4

SHA256
8af17a746533844b0f1b8f15f612e1cf0df76ac8f073388e80cfc60759e94de0

SHA512
03d65f37efc6aba325109b5a982be71380210d41dbf8c068d6a994228888d805adac1264851cc6f378e61c3aff1485cc6c059e83218b239397eda0cec87bd533

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\aiohttp\_helpers.cp311-win_amd64.pyd

Filesize
26KB

MD5
09b11699cdba4bc48cc6885a87af625a

SHA1
4f2882a14aea02b8fbf880485f19c43ba1f853ad

SHA256
f6fe3a897a1d55e7f5de95f81ea6fcbc791329d6eaef6f33eb4227043b87adc1

SHA512
c74c8caffd7b4c04828a0ff13efffe35feeb28917bed80179b1a4a9e8750c2e2156ce1307fb737efd8b4bf6ce2fda09b301bf33ac216045cf7638681db2d3368

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\aiohttp\_http_parser.cp311-win_amd64.pyd

Filesize
78KB

MD5
f1f62b84c0b35781907bb21592bc4505

SHA1
fe87d2ffad8ce88db37bafcc99d81a217a08ab9f

SHA256
d0dda39645e4c7077ffb31b51a20765406c4d93a2df4d1813ed7ee639d9c002a

SHA512
b901b769802c1d5c9dd2cfa2585386fa1c3d824a335262c9306da2aa01924e52d132c20b913940a1cf9d27251c041b5470aa652b4e6a072a7644d328dc270923

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\aiohttp\_http_writer.cp311-win_amd64.pyd

Filesize
24KB

MD5
4d3a451a342357750063c159cd2757cf

SHA1
eb2d48a21b4a71279d3be521e7b6db2f39e1c435

SHA256
8ec1721df7ad36c7f770e7a7a5b0e4a0016d9cefc349148e8c28220d58619fcf

SHA512
4378adc0546a4ed430ee2cbb14fbb62424c7c135335e0dff8a677991105f5a83ddf4b36c694ae6fe473da20b88182361274e27fd71a5b20ce2f01d4e36963ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\aiohttp\_websocket.cp311-win_amd64.pyd

Filesize
19KB

MD5
791d5c587c717986b9f43bcb197b9e18

SHA1
3e460efe0aeab8f776658c3b776fb148650fe5f2

SHA256
5d74710030f51eee0e7b4de7b53ec45b552f01c2016767ea12038d0e23999896

SHA512
785bc62a274e05e315a278b143afc6b597444ba61d420a4a2c2dcd7c46b08ab03aeca42429b6c6e8d548405e1602aeb24312f85878f12ab19cea0985dae28131

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\base_library.zip

Filesize
1.4MB

MD5
2efeab81308c47666dfffc980b9fe559

SHA1
8fbb7bbdb97e888220df45cc5732595961dbe067

SHA256
a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad

SHA512
39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.0MB

MD5
001536e476bf36e77c61e5e60d96ea76

SHA1
79f4768cf796262febd62f7d9d3d510f6c9d816f

SHA256
364c6887349315afe5343bb2613002cd2b860af427a76aeceab591272b6f50a5

SHA512
948141c8eee69e20f3497520fcdd2836aab6d01a16a9639aef0869795ca454b684bec79a77bf1c16da2a339ee4adaf56ac6c839c15b5e4ef912d5d94edb83a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\frozenlist\_frozenlist.cp311-win_amd64.pyd

Filesize
35KB

MD5
15b0df96344baf6a4c72766721943e52

SHA1
a3666e88594d1ec97de23b9242f346c43a34c070

SHA256
abb6f497003738db2407b01dfa0abc61f6bc7fdb2452c52f76ab11f5430d844f

SHA512
4fbf295d0882646b8c4b3284f11331fb12767fd1404d78d3e4d88a434896058c2df05dd1a2d9c8ce696d2d3aad8c7251d00d95c399df2e8c11bb319f87a4385e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\libcrypto-1_1.dll

Filesize
1.1MB

MD5
f82e744b74099c586a568ffeab9ab252

SHA1
b51cd9fca6c7e0a262fc3a0f66b95034b0c03a5f

SHA256
2d2c0a847d276b65a42b82ca92e466f33315d68a08a4ac25ee251b12c549b3e0

SHA512
f8512470f4325d33a1c881776877ec6cf2865430b04ea3eb86b61721a8c3b1daa724b7887411f7bc4842732f0441fc72990c39e1974fb986555c1e4c33cb59e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\libffi-8.dll

Filesize
27KB

MD5
002d812bed903fe40ec41f869b21832f

SHA1
ee066916e6966f05457d490332f5e0d925e11766

SHA256
0d85141dab86cfe0f276dfc5f8503b297505f8246cabf7c8deba0ac31a52c3f7

SHA512
5cea498444aac18b43b45c7fc6f111446d4381e29ccaa5eac04338714c12f7d25b693b1f31bb670b61f242429e9a20b21db1cab6338ad503aee6f35af0032240

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\libssl-1_1.dll

Filesize
203KB

MD5
9688c1b6b7d77fb1721168e4ba55f553

SHA1
611959e623906f6be155bbdb5ea4f2aaeb43c212

SHA256
e3f8264484e99c36c1a99aab96f7753f72da56c284ded7b1c802bc514bc9053b

SHA512
161ab9124bef12493a7ef232f089064e620203f77b1fa18812a8c51a8eaa6ca2436341fafaf24f0ac3840f395ed96a6600cb92b87ccb0ee31bcef7f636e1fba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
eeaded775eabfaaede5ca025f55fd273

SHA1
8eefb3b9d85b4d5ad4033308f8af2a24e8792e02

SHA256
db4d6a74a3301788d32905b2ccc525e9a8e2219f1a36924464871cf211f115a0

SHA512
a6055d5604cc53428d89b308c223634cd94082be0ba4081513974e1826775d6e9fc26180c816d9a38fead89b5e04c5e7cf729c056bfae0ed74d6885c921b70ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\pyexpat.pyd

Filesize
87KB

MD5
0b0a68ed0f1b01feccf9c13572279dcf

SHA1
914e4d43c448731cae6c767afd8d28065bce04ce

SHA256
9bb2d896280025f1eb2d85a78f3fc2a1c48939e1586497f4822e1d21f27b4035

SHA512
36e0f64e08c948ea5af741f0583e7a569fb7c8f80b2bce9734265dbb54e887adbf43a3daf5a2c854bcf73fda21f690819e20a6255b3cfc59d59ccafb3837a46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\python3.DLL

Filesize
65KB

MD5
2ad3039bd03669f99e948f449d9f778b

SHA1
dae8f661990c57adb171667b9206c8d84c50ecad

SHA256
852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61

SHA512
8ffeaa6cd491d7068f9176fd628002c84256802bd47a17742909f561ca1da6a2e7c600e17cd983063e8a93c2bbe9b981bd43e55443d28e32dfb504d7f1e120c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\python311.dll

Filesize
1.6MB

MD5
a237b2d97fbda04e085291a0aa71d68a

SHA1
db59472798fadc68df15d792c28a2746d1acdeff

SHA256
9dad2734c89ef84ab48a0ecab7e65d285d81323198e3aa9dfa388569a7f1b571

SHA512
41f7111713ed9953daa2ecf34213fb2c20a9a22b3140d4517b2fc939f5c2b3d943234502c1c82d5361f841dbcd4f6e1922f61811edea5206bc1549f64c33e867

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\select.pyd

Filesize
25KB

MD5
079763bb25560c08756315b9310d632c

SHA1
6137b251469406a953d0cf10631461e9cdb1230c

SHA256
3d019c8c5d95dd2f7c08f9550ebf14070440234f2d22addf6a85bd8301f79c08

SHA512
8c57fbec6a86ea6e495662d5f4c89f294178be0ba1e5ae5c4ca835afe4e865a00768972afb6a926417e98c2b0781878e35b0b9428dc4c1a68fac5b4e2b4ccca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\sqlite3.dll

Filesize
607KB

MD5
d577e51e7672f520af75acf605e073d3

SHA1
b717545e44c9cc987242480451799d6a009a0f52

SHA256
7d1614f9cde129f455f5f569212c56d4d1d00564db0cdee4249c73b67a314619

SHA512
7e618882f90989c09c6ea547eb1a649453e330f419f78818bd3fbd843d838527de6918317d6fff3796d02ed75bbb86e461cc6935ff47f5ef842af7cb0cc755f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\unicodedata.pyd

Filesize
295KB

MD5
cc35caab6a657fd400260c1811fb530f

SHA1
909a4612d81ba012edebf6df69ab968d2fe6d571

SHA256
c416dc3161f514c6fd2ee1e0756c2d6124f3370ac16520f9a294e00315663dc6

SHA512
9eddfcc4bedb57852025df2a4e198905d2d9d8577a894ab1ed2c05701bf03f80fc31b4acc1e7f24065ee7edde4302b0b82a4e214178319fc19e374aab65ef5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
40KB

MD5
9a8f969ecdf0c15734c1d582d2ae35d8

SHA1
a40691e81982f610a062e49a5ad29cffb5a2f5a8

SHA256
874e52cceae9a3c967bac7b628f4144c32e51fc77f519542fc1bac19045ecde8

SHA512
e0deb59abef7440f30effb1aab6295b5a50c817f685be30b21a3c453e3099b97fd71984e6ca6a6c6e0021abb6e906838566f402b00a11813e67a4e00b119619f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wikr3xm0.u5s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1268-200-0x00000299338C0000-0x00000299338E2000-memory.dmp

Filesize
136KB

Download
memory/3772-115-0x00007FFA401D0000-0x00007FFA401FD000-memory.dmp

Filesize
180KB

Download
memory/3772-81-0x00007FFA41640000-0x00007FFA41659000-memory.dmp

Filesize
100KB

Download
memory/3772-100-0x00007FFA3B8D0000-0x00007FFA3BC45000-memory.dmp

Filesize
3.5MB

Download
memory/3772-99-0x0000027669A50000-0x0000027669DC5000-memory.dmp

Filesize
3.5MB

Download
memory/3772-103-0x00007FFA3FC10000-0x00007FFA3FC25000-memory.dmp

Filesize
84KB

Download
memory/3772-105-0x00007FFA41640000-0x00007FFA41659000-memory.dmp

Filesize
100KB

Download
memory/3772-98-0x00007FFA3C120000-0x00007FFA3C1D8000-memory.dmp

Filesize
736KB

Download
memory/3772-106-0x00007FFA3FBF0000-0x00007FFA3FC02000-memory.dmp

Filesize
72KB

Download
memory/3772-109-0x00007FFA458C0000-0x00007FFA458CD000-memory.dmp

Filesize
52KB

Download
memory/3772-110-0x00007FFA3FBD0000-0x00007FFA3FBE4000-memory.dmp

Filesize
80KB

Download
memory/3772-112-0x00007FFA41580000-0x00007FFA41599000-memory.dmp

Filesize
100KB

Download
memory/3772-113-0x00007FFA3C580000-0x00007FFA3C594000-memory.dmp

Filesize
80KB

Download
memory/3772-97-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp

Filesize
5.9MB

Download
memory/3772-116-0x00007FFA3C000000-0x00007FFA3C11C000-memory.dmp

Filesize
1.1MB

Download
memory/3772-93-0x00007FFA3FC30000-0x00007FFA3FC5E000-memory.dmp

Filesize
184KB

Download
memory/3772-120-0x00007FFA3C320000-0x00007FFA3C342000-memory.dmp

Filesize
136KB

Download
memory/3772-119-0x00007FFA401A0000-0x00007FFA401C3000-memory.dmp

Filesize
140KB

Download
memory/3772-91-0x00007FFA3C350000-0x00007FFA3C4BF000-memory.dmp

Filesize
1.4MB

Download
memory/3772-89-0x00007FFA401A0000-0x00007FFA401C3000-memory.dmp

Filesize
140KB

Download
memory/3772-126-0x00007FFA3C350000-0x00007FFA3C4BF000-memory.dmp

Filesize
1.4MB

Download
memory/3772-129-0x00007FFA3FC30000-0x00007FFA3FC5E000-memory.dmp

Filesize
184KB

Download
memory/3772-128-0x00007FFA3C2E0000-0x00007FFA3C2F9000-memory.dmp

Filesize
100KB

Download
memory/3772-131-0x00007FFA3C120000-0x00007FFA3C1D8000-memory.dmp

Filesize
736KB

Download
memory/3772-87-0x00007FFA401D0000-0x00007FFA401FD000-memory.dmp

Filesize
180KB

Download
memory/3772-127-0x00007FFA3C300000-0x00007FFA3C317000-memory.dmp

Filesize
92KB

Download
memory/3772-85-0x00007FFA41580000-0x00007FFA41599000-memory.dmp

Filesize
100KB

Download
memory/3772-83-0x00007FFA458C0000-0x00007FFA458CD000-memory.dmp

Filesize
52KB

Download
memory/3772-140-0x00007FFA3BF70000-0x00007FFA3BF8E000-memory.dmp

Filesize
120KB

Download
memory/3772-142-0x00007FFA3BF90000-0x00007FFA3BFA1000-memory.dmp

Filesize
68KB

Download
memory/3772-141-0x00007FFA3B8D0000-0x00007FFA3BC45000-memory.dmp

Filesize
3.5MB

Download
memory/3772-139-0x00007FFA3BFB0000-0x00007FFA3BFFA000-memory.dmp

Filesize
296KB

Download
memory/3772-101-0x00007FFA40200000-0x00007FFA40223000-memory.dmp

Filesize
140KB

Download
memory/3772-137-0x0000027669A50000-0x0000027669DC5000-memory.dmp

Filesize
3.5MB

Download
memory/3772-145-0x00007FFA38860000-0x00007FFA38F54000-memory.dmp

Filesize
7.0MB

Download
memory/3772-144-0x00007FFA3FC10000-0x00007FFA3FC25000-memory.dmp

Filesize
84KB

Download
memory/3772-147-0x00007FFA3BF30000-0x00007FFA3BF68000-memory.dmp

Filesize
224KB

Download
memory/3772-58-0x00007FFA40200000-0x00007FFA40223000-memory.dmp

Filesize
140KB

Download
memory/3772-197-0x00007FFA3C4E0000-0x00007FFA3C4ED000-memory.dmp

Filesize
52KB

Download
memory/3772-79-0x00007FFA45900000-0x00007FFA4590F000-memory.dmp

Filesize
60KB

Download
memory/3772-50-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp

Filesize
5.9MB

Download
memory/3772-213-0x00007FFA3C000000-0x00007FFA3C11C000-memory.dmp

Filesize
1.1MB

Download
memory/3772-214-0x00007FFA3C320000-0x00007FFA3C342000-memory.dmp

Filesize
136KB

Download
memory/3772-215-0x00007FFA3C300000-0x00007FFA3C317000-memory.dmp

Filesize
92KB

Download
memory/3772-216-0x00007FFA3C2E0000-0x00007FFA3C2F9000-memory.dmp

Filesize
100KB

Download
memory/3772-218-0x00007FFA3BFB0000-0x00007FFA3BFFA000-memory.dmp

Filesize
296KB

Download
memory/3772-251-0x00007FFA3C4E0000-0x00007FFA3C4ED000-memory.dmp

Filesize
52KB

Download
memory/3772-250-0x00007FFA3BF30000-0x00007FFA3BF68000-memory.dmp

Filesize
224KB

Download
memory/3772-244-0x00007FFA3C300000-0x00007FFA3C317000-memory.dmp

Filesize
92KB

Download
memory/3772-239-0x00007FFA3FBF0000-0x00007FFA3FC02000-memory.dmp

Filesize
72KB

Download
memory/3772-238-0x00007FFA3FC10000-0x00007FFA3FC25000-memory.dmp

Filesize
84KB

Download
memory/3772-234-0x00007FFA3C350000-0x00007FFA3C4BF000-memory.dmp

Filesize
1.4MB

Download
memory/3772-227-0x00007FFA40200000-0x00007FFA40223000-memory.dmp

Filesize
140KB

Download
memory/3772-249-0x00007FFA38860000-0x00007FFA38F54000-memory.dmp

Filesize
7.0MB

Download
memory/3772-226-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp

Filesize
5.9MB

Download
memory/3772-266-0x00007FFA3FC10000-0x00007FFA3FC25000-memory.dmp

Filesize
84KB

Download
memory/3772-273-0x00007FFA3C2E0000-0x00007FFA3C2F9000-memory.dmp

Filesize
100KB

Download
memory/3772-271-0x00007FFA3C320000-0x00007FFA3C342000-memory.dmp

Filesize
136KB

Download
memory/3772-265-0x00007FFA3B8D0000-0x00007FFA3BC45000-memory.dmp

Filesize
3.5MB

Download
memory/3772-264-0x00007FFA3C120000-0x00007FFA3C1D8000-memory.dmp

Filesize
736KB

Download
memory/3772-263-0x00007FFA3FC30000-0x00007FFA3FC5E000-memory.dmp

Filesize
184KB

Download
memory/3772-254-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp

Filesize
5.9MB

Download
memory/3772-280-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp

Filesize
5.9MB

Download
memory/3772-410-0x00007FFA38F60000-0x00007FFA3954A000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads