Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe
Resource
win7-20240903-en
General
-
Target
2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe
-
Size
9.7MB
-
MD5
5a6f38693f748bbc32b3068f72c93075
-
SHA1
8e80b4b3c3b313527a02ce59c9d8a3623986f2a9
-
SHA256
f36f8948667116064a7810b6a1971d5ebf49f225cd0c5a0d7b7def870f93e31f
-
SHA512
074dda5143fac0cbe0fa099dd4a2970ba3a6272a788b9df66387cb1caa7914843cd073df2e9274a4402f2fe5606ac164c8c71f3e35776454355bcde24a93ace5
-
SSDEEP
196608:qR668aaELjR668aaELtR668aaELbR668aaELxpFvqcA:qp8aaqp8aa0p8aaSp8aa4
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Remcos family
-
Xred family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3080 powershell.exe 4420 powershell.exe 1524 powershell.exe 1832 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 4 IoCs
pid Process 1500 ._cache_2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 4836 Synaptics.exe 4556 Synaptics.exe 2860 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 532 set thread context of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 4836 set thread context of 4556 4836 Synaptics.exe 116 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3432 schtasks.exe 932 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1804 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 3080 powershell.exe 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 4420 powershell.exe 3080 powershell.exe 4420 powershell.exe 4836 Synaptics.exe 4836 Synaptics.exe 4836 Synaptics.exe 4836 Synaptics.exe 1832 powershell.exe 1524 powershell.exe 4836 Synaptics.exe 1832 powershell.exe 1524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe Token: SeDebugPrivilege 3080 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 4836 Synaptics.exe Token: SeDebugPrivilege 1524 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1500 ._cache_2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE 1804 EXCEL.EXE -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 532 wrote to memory of 3080 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 95 PID 532 wrote to memory of 3080 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 95 PID 532 wrote to memory of 3080 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 95 PID 532 wrote to memory of 4420 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 97 PID 532 wrote to memory of 4420 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 97 PID 532 wrote to memory of 4420 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 97 PID 532 wrote to memory of 3432 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 99 PID 532 wrote to memory of 3432 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 99 PID 532 wrote to memory of 3432 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 99 PID 532 wrote to memory of 904 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 101 PID 532 wrote to memory of 904 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 101 PID 532 wrote to memory of 904 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 101 PID 532 wrote to memory of 3264 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 102 PID 532 wrote to memory of 3264 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 102 PID 532 wrote to memory of 3264 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 102 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 532 wrote to memory of 4360 532 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 103 PID 4360 wrote to memory of 1500 4360 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 104 PID 4360 wrote to memory of 1500 4360 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 104 PID 4360 wrote to memory of 1500 4360 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 104 PID 4360 wrote to memory of 4836 4360 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 106 PID 4360 wrote to memory of 4836 4360 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 106 PID 4360 wrote to memory of 4836 4360 2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe 106 PID 4836 wrote to memory of 1524 4836 Synaptics.exe 110 PID 4836 wrote to memory of 1524 4836 Synaptics.exe 110 PID 4836 wrote to memory of 1524 4836 Synaptics.exe 110 PID 4836 wrote to memory of 1832 4836 Synaptics.exe 112 PID 4836 wrote to memory of 1832 4836 Synaptics.exe 112 PID 4836 wrote to memory of 1832 4836 Synaptics.exe 112 PID 4836 wrote to memory of 932 4836 Synaptics.exe 114 PID 4836 wrote to memory of 932 4836 Synaptics.exe 114 PID 4836 wrote to memory of 932 4836 Synaptics.exe 114 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4836 wrote to memory of 4556 4836 Synaptics.exe 116 PID 4556 wrote to memory of 2860 4556 Synaptics.exe 117 PID 4556 wrote to memory of 2860 4556 Synaptics.exe 117 PID 4556 wrote to memory of 2860 4556 Synaptics.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF4DF.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"2⤵PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"2⤵PID:3264
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53A9.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:932
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1804
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD55a6f38693f748bbc32b3068f72c93075
SHA18e80b4b3c3b313527a02ce59c9d8a3623986f2a9
SHA256f36f8948667116064a7810b6a1971d5ebf49f225cd0c5a0d7b7def870f93e31f
SHA512074dda5143fac0cbe0fa099dd4a2970ba3a6272a788b9df66387cb1caa7914843cd073df2e9274a4402f2fe5606ac164c8c71f3e35776454355bcde24a93ace5
-
Filesize
144B
MD533280ec0ed6602c55cd14c8708fa7f73
SHA1dc792117d0b82ce5549240f3451f892036b80d41
SHA2562980a2fec034708464f214c0965d2d2ce4da946b29b1e1f5048efc0ba2b6a7ff
SHA512da2b1dc7dfaa9be8565d6aa095e6465ab9425e44b2702ca12fc9018fd65f932cd12c7888dbbd7033b258ae8f301770328b97420d47079e46dee91d460e649619
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD57d3ec112d915fcc6fd4e55d1e08f5a4b
SHA1da5ac2b4f1b1fb1a4848aab6013d9a32950cbe7f
SHA256e287e9816264d1bcd9f550f78914b807882a3df26b7079b82156ef4d6db35e27
SHA5129a4af350ed8365f024a4e6375f9a5ab23a900c006a700ac08812395c4518a259d7e1c6d3b468d187fc83c915f36fc16669c17d1546b80bba0070583fb9ce7b55
-
Filesize
18KB
MD5fb30e681b7696dd936d76d24d4cf7f87
SHA1247a43d5346d6d06fea1a6928b2210746fe4ea99
SHA256677ca1853f673b731cbeb79dfde6c761919e848d246a0884b974aa4312a30925
SHA5127c8ad2a64c2fb64ba32479e60662231ff94ffd6241695fbacaa36888d646eddb5639e1c421903734f659189292c4e0db3f04762cd025f53183bf4657573b527e
-
C:\Users\Admin\AppData\Local\Temp\._cache_2024-12-07_5a6f38693f748bbc32b3068f72c93075_formbook_luca-stealer_magniber.exe
Filesize483KB
MD5f3b57ccad1c0a308635e17aa591e4038
SHA1ca67ad3c74523b844fc23563f7b288f0389fd645
SHA2565ad6b9a917f35be0a1d66c771069c2143ad765737eedd85436acbc0f95a4c0e7
SHA5125ed754a1b254e8a4b03e0445ac0081c94aaf179c2974827ce4ff10b7deb765d819243b2084212d7c91be9ddc07bf94f55e35f85564781b4124b61647a2f0977a
-
Filesize
21KB
MD5e83984f71d6500d9003328b2685c17fa
SHA114fe6ae62bb4f782a79e2f8beab18233d4772a80
SHA256c14321b7bf5de4aab28f2f06fff52d7c0238923119db74d706a34d37e1cf986d
SHA512e2e80b37aed633298fd492a1ed14fa3ec81fc77310a3b5fb31b273fb6eb9bc93b4a76b75302672411bd09a0f4b42f112ba8ffc5de36d6b0b49755cb8609d64b9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1KB
MD5b99aeb3ae199ad2161c75052ba65da6a
SHA1262c7bc9060bcc716c8f85cda1e200b1089fcadc
SHA256cf92eee51141ae2c7e3038e552423ddc60ba6551c2d688012f39cb1bf379f298
SHA51246b05f796e19e5187a09ce9f281f3dd70628c655cef4754ce44a0b767a9e107bf442f959687396849b80da438acc1a07a53a83902101e20cad2a69e1965da878