Overview

overview

10

Static

static

3

2024-12-15...er.exe

windows7-x64

10

2024-12-15...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    123s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 20:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe

  • Size

    4.6MB

  • MD5

    e0bfdf2dc967cb0614ae05f4de146e1b

  • SHA1

    c32a58bc3bfd426df9000796f91799b4fd7a62de

  • SHA256

    9ae268c84c2dc7ce1fd9c7069cf5ae1de8b3dd681116c28c8d143fe97d482b3a

  • SHA512

    a5286e4ccd2b41c884d54f68eb36982e740b68d666167a56ff7671fd71560b97015c3f4f50cda4af5a26c602b62fe03e05099458f4ca20a3040e6b1b04cedb97

  • SSDEEP

    98304:7ws2ANBKXOaeOgmhwWIO0H7+ZUX8ZqvOd/cV/20V5hkgk/J:dYXbeO7gH7d2YVm

Score
10/10
gh0stratpurplefoxsalitybackdoordiscoveryevasionpersistenceratrootkittrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Detect PurpleFox Rootkit 5 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 6 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • Modifies firewall policy service 3 TTPs 3 IoCs
    evasion
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 6 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1232
          • C:\Users\Admin\AppData\Local\Temp\2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe
            "C:\Users\Admin\AppData\Local\Temp\2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Loads dropped DLL
            • Windows security modification
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2512
            • C:\Users\Admin\AppData\Local\Temp\R.exe
              C:\Users\Admin\AppData\Local\Temp\\R.exe
              3⤵
              • Server Software Component: Terminal Services DLL
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              PID:2564
            • C:\Users\Admin\AppData\Local\Temp\N.exe
              C:\Users\Admin\AppData\Local\Temp\\N.exe
              3⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:2160
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 2 127.0.0.1
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2852
            • C:\Users\Admin\AppData\Local\Temp\HD_2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe
              C:\Users\Admin\AppData\Local\Temp\HD_2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2940
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1328
                • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/
                  5⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:884
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:884 CREDAT:275457 /prefetch:2
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:2268
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:632
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
            1⤵
              PID:264
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
              1⤵
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Windows\SysWOW64\Remote Data.exe
                "C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259439365.txt",MainThread
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2836
            • C:\Windows\SysWOW64\TXPlatfor.exe
              C:\Windows\SysWOW64\TXPlatfor.exe -auto
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2612
              • C:\Windows\SysWOW64\TXPlatfor.exe
                C:\Windows\SysWOW64\TXPlatfor.exe -acsi
                2⤵
                • Drops file in Drivers directory
                • Sets service image path in registry
                • Executes dropped EXE
                • Suspicious behavior: LoadsDriver
                • Suspicious use of AdjustPrivilegeToken
                PID:2476

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Replication Through Removable Media

            1
            T1091

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Server Software Component

            1
            T1505

            Terminal Services DLL

            1
            T1505.005

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            4
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Disable or Modify Tools

            3
            T1562.001

            Modify Registry

            7
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Replication Through Removable Media

            1
            T1091

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
              Filesize

              914B

              MD5

              e4a68ac854ac5242460afd72481b2a44

              SHA1

              df3c24f9bfd666761b268073fe06d1cc8d4f82a4

              SHA256

              cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

              SHA512

              5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
              Filesize

              1KB

              MD5

              a266bb7dcc38a562631361bbf61dd11b

              SHA1

              3b1efd3a66ea28b16697394703a72ca340a05bd5

              SHA256

              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

              SHA512

              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
              Filesize

              252B

              MD5

              d653d15dbeb6be3474bf6684fd8978fe

              SHA1

              5fd6a1a477cd3598d2dc8bc245908ae10d606ba8

              SHA256

              3f21d4cbca0af66d2268cc9aaa95f902c681d590b4d93308c16fa70b27434187

              SHA512

              57e9df651f3971b1b49e9810125fffd7445fab8d13e5b2eee8cd0f655a78c04edc6be66e2d0c2a7b4e1ebcbf906eada56e82911e206a50c73bd87e69ed6607b9

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              218b0e2e6016c4dfcc648102b6554bb1

              SHA1

              c981cfb3f52bf72fd402fb21e2424ac4f30bade9

              SHA256

              e09c6b4c48a8fd9892270e84d5a992e7d9ddc1ac043e6100cb815fd9a4411369

              SHA512

              5ac4fde9e296f9c16321f1259e3b4f27953197e99c71cb8a94ee1069c9800fa3eb25d7573217d1451a469099a5a6af12ec7bff20cbeda50e2da1ee542095b5a4

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              62305f7470f8961259c8515819b6daea

              SHA1

              4cfce104ad3d075c152b9ea8bb99dbf0b8b5b2aa

              SHA256

              57e9524bcec9048debcfe4b5cf6b02ed160d45b221e8148ccaed18bab08b07e8

              SHA512

              e1703226b88f09192fad7b89cd2306053dcd2dba9898c4340ee48cba62b83e8022c3b13c014a5ba4fcb975b16bc86f9ffd136386776d3d3f615a8e1b05fc0723

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              b63c295698abcc321fcc5a1d7a38b965

              SHA1

              22db7685ed9748482f29b41335188d6f297e74dc

              SHA256

              8d2db2409359546e0be735d560e3ef299d64baed5a1036afcc2b51fe20ba3ce8

              SHA512

              1af61a1df4a7800b43b6f9a6973f2e836bc9b70042f91952f878af632b9f7ee3d1685a762cb5d0dd8ac994869c4d1dadf12a34e89743ae8ee9bd2712d17c6de4

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              428a74f770ef2acaf763190e61b9b65a

              SHA1

              f30fd5a66df534fbf4713f50f11847dad4a6bec8

              SHA256

              ea53dc5ef7b86767b405abebc78f8ee4e4b6cc10f263b4279777c48d183fe223

              SHA512

              e81308e47338722f842636b1635ae224a14462dbea4f38503c226c69dae795d9ba59c54d65bdee8a297ecc35e5b2e01416b3516bcf75966de656e66ad6cfea89

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              bc75aff904d280b20c7653dfd6123df7

              SHA1

              345d9a0e415932cf7bb6dae97b0d9808217fc4b0

              SHA256

              34ab378a5efbefe260399c831ff853f870912d22295efc1eaeff2401f1ef93a3

              SHA512

              16bcfaf162f9c2aa9c0b9cc67ef47680e2bfd7af358195596268c9d2e7885df8f19b4706f533a0e6716a95cb1bbcc3d505475e4e00a7fcbdb8fbc6f316324368

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              a7c34ff4aadb4f37b8b5ce7a7d654c97

              SHA1

              a31f9f41d2508dbc132c7639531be5073d03672b

              SHA256

              4676e77616a2703a79c1230882c8f5a0b2a5110f0ba98bd9f7bf9668782066b0

              SHA512

              c3427c752134bc6087fdf50dda34be02585e80afcf4c23f963e60ca5f5f052e3e88ab55aae6b2a22615f22c0c5cb2f9ad2223083dfcbd2e8bcd1faa016bc1195

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              4cb4d87de6ff1926ef4799f8031becfc

              SHA1

              8669bf6d15e07006b8a05c3a1ae7908b230f399a

              SHA256

              8dbd69c0ef65e3f9a37d612039df0b81ca45d741062153fdd0f9d3ecff8d785e

              SHA512

              542d7d4618c0be35f703edb588e196219bed5eb851a7aae6514b75c94575a3ca6af100d5545db9397146ffef2a5fba0e75decd5cd05f7d7b3781e6c30a5ec32c

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              b8d731b2af286fead6c270e98725e3f1

              SHA1

              702c41ebb9cf01293b49a6708884bdde6747ef12

              SHA256

              589e20cda871072d1d54795a16070d1080973316ac968064375ea77e5b8c5917

              SHA512

              d557a8c5ebdee2f1b42194664c26f8f3f1d4fbe4c7032ea85039aad7da42924b93ea0a7e67d578f2403243bfd84c55a258f85d7855550539739d0b97fbb3d299

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              4cf708cbe243fe38df08fb511e8c827a

              SHA1

              774acfa2cfa04d906db4b162604b5ecde83ba1c1

              SHA256

              c79d1ce33720ddfe3b96e0f25273f85c4a295c37cb1d10d164167821847f6b7c

              SHA512

              b9523897f611e8cc6a1d94f8bf058d111f9cdccc649a250b0ad49d6e1dfee812dc0fd13b09dfdbb72fd832d984bf9b8a391e2c69ac3864ceac9345202e4d2cf6

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              625c23ce76b456d2bdb4bc2309bdfcb0

              SHA1

              d283b1044f3069e89e1a36d725b6f2d1167b8982

              SHA256

              146f005a171bab3450cf0c098978a3f4b85d6263fa7472df896b910db4abd2d3

              SHA512

              ca1b9f7d535b5f9cc4e75a1bf2e6fee8eba3917d95501f454048402321f1508d149ec8240ea251f8fd74120b943f206e105de04d3b8ec7f756e7c2948d1405f0

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              c676da053a70fa43ad45124102270a27

              SHA1

              838ddd0bc2f136e1905011d1c3ef8b7e0aeaecd9

              SHA256

              e80c6bfa2ab59a02e480fc3e8ac3141c7e5ae4bb4e05c951c252084ae45d2333

              SHA512

              2520c4e406592aa7da44bf2bd5caeb6ad33fad27d4d4f4c00037e8bfbf87cf23ff4a71eaed165e442b60ab879f3bae934a8f6a73b677e24c07fd7a382906af4d

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              e70f86f45b0316439734faf435cb956e

              SHA1

              554a096190b573e6b69dfd6718551e50a1911cbf

              SHA256

              7b5ea772556e2bed6741fa59ac51bef35781865a3884407d14effafbd85a78b6

              SHA512

              99f04f694b743d2d1ad9677a6a77dafda6fd57edc23896d2a56399c88df2dd453e144f515d001ecb98f4d54e8def94ddbedafe55a57c6839cdccfb12fb6fa8a2

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              762a87a47b7d2f0e78d842a27b411dc8

              SHA1

              f2182c58662cb883158ac363d68dc4200e83ed1c

              SHA256

              fe816bb7cd2d73b3e93ffbe6cb5b84b719b03dcb51ec39e3c3725a4155c432c9

              SHA512

              f56a5aee82b7ce7f2841c5ff476568edf5572d2b8a5a42655a89e162977813ddaaa14d9ecf65e396d1b2e9115a188b759b5c74677b81ad1bddf26533c2eff287

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              68718b95a7dd687ebfed25b53d5427b5

              SHA1

              c07f4c288161aae1b18432d3d03ddc95030aa912

              SHA256

              ac1b7aa5a67383e658ee7650d2e8e2cfcf7869942d962797e567e38f584afd3a

              SHA512

              ee56650ee6f48ff8f2bff97941ca6e2977bb31153ae5cc015394f29efc0db6b2a5a9cdac7f572bc1a5925a5532264aa7616b902dc89e833b552cb6f7eca126da

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              6636e61e321b9e3e3ce4ae0634e0fc86

              SHA1

              be04dcee16198c5b17a2aed5f83b4e53974a0223

              SHA256

              3401d0a1491a84a0b2ea0a47a0f40661d2f22973d081b331792456df8279d44e

              SHA512

              650614bcbeca1074d849c9845450ccb5c5f3e65c66fd76343687da54380b52a6bc1907b6c51818834b4fbaf92070f2f724c21100e69c30680dc9573a4e995c65

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              15c99944911c0967fbf1be0135079476

              SHA1

              af97cc378dd005f87b46eb8dbd6ba73d8ff1606e

              SHA256

              032e8e30711be954a4292b8df11df69573532451fed2327035acea7e32c1f7b0

              SHA512

              f31c4f8d63b50c1656f6ea1e2d38ebf9e140fcaf5d26b252690d324c514e62494d00bee0b8be27231213fb3a69187b22eee06c1e0ae47fba75c1e817af942068

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              43de5df533056a9383ad925a98d7e84d

              SHA1

              b4c19d6e17024b5751e2a3d8111e5891a3b7da4d

              SHA256

              a5f399df77cbdf7aed440ab20556882dfd3cb11502e6172b75c49b9cb4b426df

              SHA512

              9063cff0931d267d0a71dffded1c776624f95b91d34b3ce6ee90b7c225744ad77d5eaa16407171853976a97f9f0b58ec2219a5363e651138687851b0443712c6

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
              Filesize

              242B

              MD5

              96137895da767c5566820fd997006ad9

              SHA1

              a1c4bd440206f4b272bcfe97dd0b9f977041b509

              SHA256

              3b53d9aba46d5ba92b86b1fb24526e4f4eb6d7f4e52f4383ac70fc4c4907ba09

              SHA512

              e50f48780d9387f8d89504f6fd3ca185ce3928f5c0f3a8a8bd8a4fb5508c8fa6845a52b8755370ad5760882d17707ee77825b04a6c96c48a0ccbd77ad933ce3b

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\e1ur8h2\imagestore.dat
              Filesize

              1KB

              MD5

              a73a61005f5473beb3609c6cf4b34c68

              SHA1

              7e744e9217db89d1af211cfa2caf7961fff68222

              SHA256

              415171c62c06c5f0c988b937ff5ab65390d2ea9376e645214928def07f4ea8b8

              SHA512

              c5cf154395ea03e965601ac5398217fd2e585185140ff01c2be4521a3c339b358d9eb89e1ea27866f8507fb184f207da4c310bd228c751e0b75cca35b02dc4fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S8GI6B9B\favicon[1].ico
              Filesize

              1KB

              MD5

              9666d7d69681361c8f1ee6e1352b37a1

              SHA1

              026d01b3e9a1c8752be75f348484713f64099551

              SHA256

              2a40e46debd9a2139f8d6bfd02b2fb15039373d67965a352c9a2c9cbe45257b0

              SHA512

              ca6ce9f0c7cec6a409d0a5ac05df757e90fd8812c6df12fbb09144d00bca10ab3a091120f0b10de584d966e5eafba14ca8823103c594b868dce0858c9ab6d9f8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\0F7713BF_Rar\2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe
              Filesize

              4.5MB

              MD5

              b84ec058fc86a6e3c1c56844c7989989

              SHA1

              e66bdfcf515b537679a55872b4e7ad79a3e87496

              SHA256

              d6e2a33e5247c3ad636653e4c5a29d3d9f206c8294b9c50b849385b0fe01415a

              SHA512

              56d21d2b3d4ecfc2c78a256c3879f8354645d32d49d39e3a2658c89ada74eaf087c9b42d1d0e2b88c9f363a6b33b65c1374d253214af3cbfc2859c064ced5ac9

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\CabE9B4.tmp
              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\HD_2024-12-15_e0bfdf2dc967cb0614ae05f4de146e1b_hijackloader_icedid_luca-stealer.exe
              Filesize

              2.2MB

              MD5

              cf7135f501fbb7462c332227db639577

              SHA1

              2ccd0071b87c07108bc810b2af84c6c740fa7408

              SHA256

              d8d6b518d9f6c9b88ead9744809eea3c64d7c1013d86d59397504a63eecf22d8

              SHA512

              33a7b744416120970da83b25d50c2def2a3e4ff3327a7dbbc4314810bd39f25d902056fa4d121d4c8e56e1a7896e9eecc4109ccc113cd3c1b6265413c3d8e321

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\TarEA45.tmp
              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

              Download Submit

            • C:\Windows\SysWOW64\Remote Data.exe
              Filesize

              43KB

              MD5

              51138beea3e2c21ec44d0932c71762a8

              SHA1

              8939cf35447b22dd2c6e6f443446acc1bf986d58

              SHA256

              5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

              SHA512

              794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

              Download Submit

            • C:\Windows\SysWOW64\TXPlatfor.exe
              Filesize

              377KB

              MD5

              4a36a48e58829c22381572b2040b6fe0

              SHA1

              f09d30e44ff7e3f20a5de307720f3ad148c6143b

              SHA256

              3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

              SHA512

              5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

              Download Submit

            • F:\fngeyy.pif
              Filesize

              100KB

              MD5

              9ca45d4d8a9c847a4a6f8f071b764fc5

              SHA1

              4841e6a0ceb617a17f8d716e24635723d7c4462a

              SHA256

              48a03b1b431118eb8bba9567758d193e2a7d04b66c41f28d9e478b95ed894883

              SHA512

              3923610d6f4d0e4ada541cade8d0272fc4cc01107fac00eab0334cb0e0d181f56c6a424d168dbf2d3a4f366e5c265028a69239afd3feb6186bc40c72901488b2

              Download Submit

            • \Users\Admin\AppData\Local\Temp\R.exe
              Filesize

              941KB

              MD5

              8dc3adf1c490211971c1e2325f1424d2

              SHA1

              4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

              SHA256

              bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

              SHA512

              ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

              Download Submit

            • \Windows\SysWOW64\259439365.txt
              Filesize

              899KB

              MD5

              e4f31870a015e22520016d7eef1762c7

              SHA1

              e788b02e1d28ea80118da64f673e6ef1af7a4414

              SHA256

              1aca136a59ebebc2aa617956b31012cf801f82373682fa7fb10721d90d231a98

              SHA512

              ed2f8bb8576db315d5c66cc4449b8eb28a98a34d66a63b500c55b8d14487b19468745b9d4cf95a674e2162a7e92ecaa6e7ec0179dc256bf3f543e4763c98d56d

              Download Submit

            • memory/1112-20-0x00000000001E0000-0x00000000001E2000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2476-83-0x0000000010000000-0x00000000101B6000-memory.dmp

              Filesize

              1.7MB

              Download

            • memory/2476-92-0x0000000010000000-0x00000000101B6000-memory.dmp

              Filesize

              1.7MB

              Download

            • memory/2476-96-0x0000000010000000-0x00000000101B6000-memory.dmp

              Filesize

              1.7MB

              Download

            • memory/2512-11-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-91-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-107-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-109-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-114-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-116-0x0000000000390000-0x0000000000392000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2512-105-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-98-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-50-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-6-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-10-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-9-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-93-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-4-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-42-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-43-0x0000000000390000-0x0000000000392000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2512-44-0x0000000000390000-0x0000000000392000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2512-41-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-8-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-0-0x0000000000400000-0x000000000068C000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2512-3-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-934-0x0000000000400000-0x000000000068C000-memory.dmp

              Filesize

              2.5MB

              Download

            • memory/2512-29-0x0000000000390000-0x0000000000392000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2512-30-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2512-32-0x00000000003F0000-0x00000000003F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2512-106-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-7-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2512-5-0x0000000002080000-0x000000000310E000-memory.dmp

              Filesize

              16.6MB

              Download

            • memory/2564-38-0x0000000000280000-0x0000000000281000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2564-40-0x0000000000270000-0x0000000000272000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2564-39-0x0000000000270000-0x0000000000272000-memory.dmp

              Filesize

              8KB

              Download

            • memory/2644-62-0x0000000010000000-0x00000000101B6000-memory.dmp

              Filesize

              1.7MB

              Download

            • memory/2644-61-0x0000000010000000-0x00000000101B6000-memory.dmp

              Filesize

              1.7MB

              Download

            • memory/2644-59-0x0000000010000000-0x00000000101B6000-memory.dmp

              Filesize

              1.7MB

              Download