Overview
overview
10Static
static
10Nitro Snip...up.exe
windows7-x64
7Nitro Snip...up.exe
windows10-2004-x64
7Nitro Snip...dex.js
windows7-x64
3Nitro Snip...dex.js
windows10-2004-x64
3Nitro Snip...ent.js
windows7-x64
3Nitro Snip...ent.js
windows10-2004-x64
3Nitro Snip...nts.js
windows7-x64
3Nitro Snip...nts.js
windows10-2004-x64
3Nitro Snip...ard.js
windows7-x64
3Nitro Snip...ard.js
windows10-2004-x64
3Nitro Snip...ger.js
windows7-x64
3Nitro Snip...ger.js
windows10-2004-x64
3Nitro Snip...til.js
windows7-x64
3Nitro Snip...til.js
windows10-2004-x64
3Nitro Snip...ook.js
windows7-x64
3Nitro Snip...ook.js
windows10-2004-x64
3Nitro Snip...lts.js
windows7-x64
3Nitro Snip...lts.js
windows10-2004-x64
3Nitro Snip...oth.js
windows7-x64
3Nitro Snip...oth.js
windows10-2004-x64
3Nitro Snip...dex.js
windows7-x64
3Nitro Snip...dex.js
windows10-2004-x64
3Nitro Snip...ain.js
windows7-x64
3Nitro Snip...ain.js
windows10-2004-x64
3Nitro Snip...way.js
windows7-x64
3Nitro Snip...way.js
windows10-2004-x64
3Nitro Snip...ite.js
windows7-x64
3Nitro Snip...ite.js
windows10-2004-x64
3Nitro Snip...tro.js
windows7-x64
3Nitro Snip...tro.js
windows10-2004-x64
3Nitro Snip...dex.js
windows7-x64
3Nitro Snip...dex.js
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 16:54
Behavioral task
behavioral1
Sample
Nitro Sniper/Setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Nitro Sniper/Setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Nitro Sniper/src/index.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Nitro Sniper/src/index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Nitro Sniper/src/lib/Client.js
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Nitro Sniper/src/lib/Client.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Nitro Sniper/src/lib/Constants.js
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Nitro Sniper/src/lib/Constants.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Nitro Sniper/src/lib/Dashboard.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Nitro Sniper/src/lib/Dashboard.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Nitro Sniper/src/lib/Logger.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Nitro Sniper/src/lib/Logger.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Nitro Sniper/src/lib/Util.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Nitro Sniper/src/lib/Util.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Nitro Sniper/src/lib/Webhook.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Nitro Sniper/src/lib/Webhook.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Nitro Sniper/src/modes/alts.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Nitro Sniper/src/modes/alts.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Nitro Sniper/src/modes/both.js
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Nitro Sniper/src/modes/both.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Nitro Sniper/src/modes/index.js
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Nitro Sniper/src/modes/index.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Nitro Sniper/src/modes/main.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Nitro Sniper/src/modes/main.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Nitro Sniper/src/modules/Giveaway.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Nitro Sniper/src/modules/Giveaway.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Nitro Sniper/src/modules/Invite.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Nitro Sniper/src/modules/Invite.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Nitro Sniper/src/modules/Nitro.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Nitro Sniper/src/modules/Nitro.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Nitro Sniper/src/modules/index.js
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
Nitro Sniper/src/modules/index.js
Resource
win10v2004-20241007-en
General
-
Target
Nitro Sniper/Setup.exe
-
Size
13.9MB
-
MD5
ed5431fa054c82af3c8cceabf0cbd071
-
SHA1
89034408ecf3c0ee53cb59ac1abf9144af381b36
-
SHA256
9e26bac988acfb11c127496bac38db4aaceda542c4c9c33ba23417a340d7788c
-
SHA512
19eff4a9dd446e1b4e45eafa151068ae1e6749abfbafcdb1a64d7718685a0ccdcff28c98491af536cc47da3d07953e082d92b24f86dd8d188127bee4d77d56e2
-
SSDEEP
393216:MqPuYXJBx/m3pgDOEkSgsv9ot+Kc0WBD:9PuYXJBxKlAeru
Malware Config
Signatures
-
Loads dropped DLL 56 IoCs
pid Process 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 15 discord.com 16 discord.com 17 raw.githubusercontent.com 18 raw.githubusercontent.com 34 discord.com -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 api.ipify.org 24 ip-api.com 28 api.ipify.org 30 api.ipify.org 10 api.ipify.org 11 api.ipify.org -
resource yara_rule behavioral2/files/0x0007000000023c8b-89.dat upx behavioral2/memory/4812-93-0x00007FFE01590000-0x00007FFE019FE000-memory.dmp upx behavioral2/files/0x0007000000023c69-105.dat upx behavioral2/memory/4812-104-0x00007FFE199E0000-0x00007FFE199EF000-memory.dmp upx behavioral2/memory/4812-107-0x00007FFE16DE0000-0x00007FFE16DF9000-memory.dmp upx behavioral2/files/0x0007000000023c6e-108.dat upx behavioral2/memory/4812-109-0x00007FFE110B0000-0x00007FFE110DD000-memory.dmp upx behavioral2/files/0x0007000000023c82-102.dat upx behavioral2/memory/4812-101-0x00007FFE14E50000-0x00007FFE14E74000-memory.dmp upx behavioral2/files/0x0007000000023c6a-99.dat upx behavioral2/files/0x0007000000023c72-110.dat upx behavioral2/memory/4812-112-0x00007FFE14EC0000-0x00007FFE14ED9000-memory.dmp upx behavioral2/files/0x0007000000023c8f-113.dat upx behavioral2/memory/4812-118-0x00007FFE146B0000-0x00007FFE146BD000-memory.dmp upx behavioral2/files/0x0007000000023c92-117.dat upx behavioral2/memory/4812-121-0x00007FFE10D90000-0x00007FFE10DBC000-memory.dmp upx behavioral2/files/0x0007000000023c8e-122.dat upx behavioral2/memory/4812-123-0x00007FFE10AA0000-0x00007FFE10ACF000-memory.dmp upx behavioral2/files/0x0007000000023c8d-124.dat upx behavioral2/memory/4812-126-0x00007FFE10850000-0x00007FFE10911000-memory.dmp upx behavioral2/files/0x0007000000023c75-127.dat upx behavioral2/files/0x0007000000023c88-129.dat upx behavioral2/memory/4812-132-0x00007FFE01590000-0x00007FFE019FE000-memory.dmp upx behavioral2/files/0x0007000000023c74-133.dat upx behavioral2/memory/4812-138-0x00007FFE10A30000-0x00007FFE10A5E000-memory.dmp upx behavioral2/memory/4812-137-0x00007FFE10A60000-0x00007FFE10A7C000-memory.dmp upx behavioral2/memory/4812-136-0x00007FFE14E50000-0x00007FFE14E74000-memory.dmp upx behavioral2/files/0x0007000000023c83-139.dat upx behavioral2/memory/4812-135-0x00007FFE117B0000-0x00007FFE117BA000-memory.dmp upx behavioral2/files/0x0007000000023c81-142.dat upx behavioral2/memory/4812-141-0x00007FFE106D0000-0x00007FFE10788000-memory.dmp upx behavioral2/memory/4812-145-0x00007FFE01210000-0x00007FFE01585000-memory.dmp upx behavioral2/files/0x0007000000023c6d-147.dat upx behavioral2/files/0x0007000000023c71-151.dat upx behavioral2/memory/4812-161-0x00007FFE0B8C0000-0x00007FFE0B8E5000-memory.dmp upx behavioral2/memory/4812-163-0x00007FFE10850000-0x00007FFE10911000-memory.dmp upx behavioral2/memory/4812-164-0x00007FFE00F00000-0x00007FFE01018000-memory.dmp upx behavioral2/files/0x0007000000023c90-168.dat upx behavioral2/memory/4812-171-0x00007FFE10A30000-0x00007FFE10A5E000-memory.dmp upx behavioral2/memory/4812-170-0x00007FFE00D80000-0x00007FFE00EF1000-memory.dmp upx behavioral2/memory/4812-169-0x00007FFE0C470000-0x00007FFE0C48F000-memory.dmp upx behavioral2/files/0x0007000000023c73-166.dat upx behavioral2/memory/4812-160-0x00007FFE10AA0000-0x00007FFE10ACF000-memory.dmp upx behavioral2/files/0x0007000000023c91-159.dat upx behavioral2/files/0x0007000000023c7e-158.dat upx behavioral2/memory/4812-157-0x00007FFE10080000-0x00007FFE1008B000-memory.dmp upx behavioral2/memory/4812-156-0x00007FFE10D90000-0x00007FFE10DBC000-memory.dmp upx behavioral2/files/0x0007000000023c7d-154.dat upx behavioral2/memory/4812-153-0x00007FFE105F0000-0x00007FFE105FD000-memory.dmp upx behavioral2/memory/4812-150-0x00007FFE0CA50000-0x00007FFE0CA64000-memory.dmp upx behavioral2/memory/4812-149-0x00007FFE14EC0000-0x00007FFE14ED9000-memory.dmp upx behavioral2/files/0x0008000000023bca-173.dat upx behavioral2/files/0x0009000000023bbf-177.dat upx behavioral2/files/0x0008000000023bfb-180.dat upx behavioral2/memory/4812-193-0x00007FFE07DF0000-0x00007FFE07DFB000-memory.dmp upx behavioral2/memory/4812-194-0x00007FFE07DE0000-0x00007FFE07DEC000-memory.dmp upx behavioral2/memory/4812-195-0x00007FFE07DD0000-0x00007FFE07DDD000-memory.dmp upx behavioral2/memory/4812-197-0x00007FFE07DC0000-0x00007FFE07DCE000-memory.dmp upx behavioral2/memory/4812-199-0x00007FFE0C470000-0x00007FFE0C48F000-memory.dmp upx behavioral2/memory/4812-204-0x00007FFE07830000-0x00007FFE0783C000-memory.dmp upx behavioral2/memory/4812-207-0x00007FFE026B0000-0x00007FFE026C2000-memory.dmp upx behavioral2/memory/4812-208-0x00007FFE026A0000-0x00007FFE026AC000-memory.dmp upx behavioral2/memory/4812-209-0x00007FFE024E0000-0x00007FFE024F5000-memory.dmp upx behavioral2/memory/4812-212-0x00007FFE024A0000-0x00007FFE024BB000-memory.dmp upx -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 724 cmd.exe 860 netsh.exe 1404 cmd.exe 2004 netsh.exe 784 cmd.exe 1784 netsh.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 3224 reg.exe 2556 reg.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe 4812 Setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4812 Setup.exe Token: SeIncreaseQuotaPrivilege 4232 WMIC.exe Token: SeSecurityPrivilege 4232 WMIC.exe Token: SeTakeOwnershipPrivilege 4232 WMIC.exe Token: SeLoadDriverPrivilege 4232 WMIC.exe Token: SeSystemProfilePrivilege 4232 WMIC.exe Token: SeSystemtimePrivilege 4232 WMIC.exe Token: SeProfSingleProcessPrivilege 4232 WMIC.exe Token: SeIncBasePriorityPrivilege 4232 WMIC.exe Token: SeCreatePagefilePrivilege 4232 WMIC.exe Token: SeBackupPrivilege 4232 WMIC.exe Token: SeRestorePrivilege 4232 WMIC.exe Token: SeShutdownPrivilege 4232 WMIC.exe Token: SeDebugPrivilege 4232 WMIC.exe Token: SeSystemEnvironmentPrivilege 4232 WMIC.exe Token: SeRemoteShutdownPrivilege 4232 WMIC.exe Token: SeUndockPrivilege 4232 WMIC.exe Token: SeManageVolumePrivilege 4232 WMIC.exe Token: 33 4232 WMIC.exe Token: 34 4232 WMIC.exe Token: 35 4232 WMIC.exe Token: 36 4232 WMIC.exe Token: SeIncreaseQuotaPrivilege 4232 WMIC.exe Token: SeSecurityPrivilege 4232 WMIC.exe Token: SeTakeOwnershipPrivilege 4232 WMIC.exe Token: SeLoadDriverPrivilege 4232 WMIC.exe Token: SeSystemProfilePrivilege 4232 WMIC.exe Token: SeSystemtimePrivilege 4232 WMIC.exe Token: SeProfSingleProcessPrivilege 4232 WMIC.exe Token: SeIncBasePriorityPrivilege 4232 WMIC.exe Token: SeCreatePagefilePrivilege 4232 WMIC.exe Token: SeBackupPrivilege 4232 WMIC.exe Token: SeRestorePrivilege 4232 WMIC.exe Token: SeShutdownPrivilege 4232 WMIC.exe Token: SeDebugPrivilege 4232 WMIC.exe Token: SeSystemEnvironmentPrivilege 4232 WMIC.exe Token: SeRemoteShutdownPrivilege 4232 WMIC.exe Token: SeUndockPrivilege 4232 WMIC.exe Token: SeManageVolumePrivilege 4232 WMIC.exe Token: 33 4232 WMIC.exe Token: 34 4232 WMIC.exe Token: 35 4232 WMIC.exe Token: 36 4232 WMIC.exe Token: SeIncreaseQuotaPrivilege 4028 WMIC.exe Token: SeSecurityPrivilege 4028 WMIC.exe Token: SeTakeOwnershipPrivilege 4028 WMIC.exe Token: SeLoadDriverPrivilege 4028 WMIC.exe Token: SeSystemProfilePrivilege 4028 WMIC.exe Token: SeSystemtimePrivilege 4028 WMIC.exe Token: SeProfSingleProcessPrivilege 4028 WMIC.exe Token: SeIncBasePriorityPrivilege 4028 WMIC.exe Token: SeCreatePagefilePrivilege 4028 WMIC.exe Token: SeBackupPrivilege 4028 WMIC.exe Token: SeRestorePrivilege 4028 WMIC.exe Token: SeShutdownPrivilege 4028 WMIC.exe Token: SeDebugPrivilege 4028 WMIC.exe Token: SeSystemEnvironmentPrivilege 4028 WMIC.exe Token: SeRemoteShutdownPrivilege 4028 WMIC.exe Token: SeUndockPrivilege 4028 WMIC.exe Token: SeManageVolumePrivilege 4028 WMIC.exe Token: 33 4028 WMIC.exe Token: 34 4028 WMIC.exe Token: 35 4028 WMIC.exe Token: 36 4028 WMIC.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3524 wrote to memory of 4812 3524 Setup.exe 83 PID 3524 wrote to memory of 4812 3524 Setup.exe 83 PID 4812 wrote to memory of 2988 4812 Setup.exe 84 PID 4812 wrote to memory of 2988 4812 Setup.exe 84 PID 4812 wrote to memory of 4612 4812 Setup.exe 86 PID 4812 wrote to memory of 4612 4812 Setup.exe 86 PID 4612 wrote to memory of 4232 4612 cmd.exe 88 PID 4612 wrote to memory of 4232 4612 cmd.exe 88 PID 4812 wrote to memory of 4980 4812 Setup.exe 90 PID 4812 wrote to memory of 4980 4812 Setup.exe 90 PID 4980 wrote to memory of 3224 4980 cmd.exe 92 PID 4980 wrote to memory of 3224 4980 cmd.exe 92 PID 4812 wrote to memory of 2396 4812 Setup.exe 93 PID 4812 wrote to memory of 2396 4812 Setup.exe 93 PID 2396 wrote to memory of 2556 2396 cmd.exe 96 PID 2396 wrote to memory of 2556 2396 cmd.exe 96 PID 4812 wrote to memory of 3600 4812 Setup.exe 97 PID 4812 wrote to memory of 3600 4812 Setup.exe 97 PID 3600 wrote to memory of 4028 3600 cmd.exe 99 PID 3600 wrote to memory of 4028 3600 cmd.exe 99 PID 4812 wrote to memory of 3520 4812 Setup.exe 100 PID 4812 wrote to memory of 3520 4812 Setup.exe 100 PID 3520 wrote to memory of 3200 3520 cmd.exe 102 PID 3520 wrote to memory of 3200 3520 cmd.exe 102 PID 4812 wrote to memory of 3496 4812 Setup.exe 103 PID 4812 wrote to memory of 3496 4812 Setup.exe 103 PID 3496 wrote to memory of 4732 3496 cmd.exe 105 PID 3496 wrote to memory of 4732 3496 cmd.exe 105 PID 4812 wrote to memory of 784 4812 Setup.exe 108 PID 4812 wrote to memory of 784 4812 Setup.exe 108 PID 784 wrote to memory of 1784 784 cmd.exe 110 PID 784 wrote to memory of 1784 784 cmd.exe 110 PID 4812 wrote to memory of 724 4812 Setup.exe 111 PID 4812 wrote to memory of 724 4812 Setup.exe 111 PID 724 wrote to memory of 860 724 cmd.exe 113 PID 724 wrote to memory of 860 724 cmd.exe 113 PID 4812 wrote to memory of 1404 4812 Setup.exe 117 PID 4812 wrote to memory of 1404 4812 Setup.exe 117 PID 1404 wrote to memory of 2004 1404 cmd.exe 119 PID 1404 wrote to memory of 2004 1404 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nitro Sniper\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Nitro Sniper\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\Nitro Sniper\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Nitro Sniper\Setup.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:2988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"3⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\system32\reg.exereg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f4⤵
- Modifies registry key
PID:3224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"3⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f4⤵
- Adds Run key to start application
- Modifies registry key
PID:2556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵PID:3200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵PID:4732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2004
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5f310cf1ff562ae14449e0167a3e1fe46
SHA185c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA5121196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
258B
MD5587135a977e9c44697c8d597266cd34f
SHA1653c16d2ac3a57ff9cae7a53f481de0be1af54ec
SHA25649bbebd81f67a599451d3fc2e7dc22ac4e0d6e559977e7be25998b3c4ccb3573
SHA5129a23cffb7ba696c14afc6e3c98654eb2675afe3d3a6653346faeace924b9e49a64156603f4220cf87757bb1b390a0d0651b78a530c33c501d325c79075b2b8f1
-
Filesize
10KB
MD5fe44f698198190de574dc193a0e1b967
SHA15bad88c7cc50e61487ec47734877b31f201c5668
SHA25632fa416a29802eb0017a2c7360bf942edb132d4671168de26bd4c3e94d8de919
SHA512c841885dd7696f337635ef759e3f61ee7f4286b622a9fb8b695988d93219089e997b944321ca49ca3bd19d41440ee7c8e1d735bd3558052f67f762bf4d1f5fc3
-
Filesize
10KB
MD5ff64fd41b794e0ef76a9eeae1835863c
SHA1bf14e9d12b8187ca4cc9528d7331f126c3f5ca1e
SHA2565d2d1a5f79b44f36ac87d9c6d886404d9be35d1667c4b2eb8aab59fb77bf8bac
SHA51203673f94525b63644a7da45c652267077753f29888fb8966da5b2b560578f961fdc67696b69a49d9577a8033ffcc7b4a6b98c051b4f53380227c392761562734
-
Filesize
11KB
MD5d67f83d1482d9600ac012868fb49d16e
SHA155c34243cdd930d76155edf2d723faa60a3a6865
SHA256aa463cd4d0b4bbd4159650d66c11a699b23775bf92455fb58a2206b932a65fec
SHA51294e9599723bf697eaeeb0401ef80a75e46208c1984df63a315a3cde1a7c97db070353acb0712cec887c04cad9755a2e4e357a10b2d40f23f0b44ee277d4f4bdb
-
Filesize
9KB
MD5f94726f6b584647142ea6d5818b0349d
SHA14aa9931c0ff214bf520c5e82d8e73ceeb08af27c
SHA256b98297fd093e8af7fca2628c23a9916e767540c3c6fa8894394b5b97ffec3174
SHA5122b40a9b39f5d09eb8d7ddad849c8a08ab2e73574ee0d5db132fe8c8c3772e60298e0545516c9c26ee0b257ebda59cfe1f56ef6c4357ef5be9017c4db4770d238
-
Filesize
10KB
MD5eea83b9021675c8ca837dfe78b5a3a58
SHA13660833ff743781e451342bb623fa59229ae614d
SHA25645a4e35231e504b0d50a5fd5968ab6960cb27d197f86689477701d79d8b95b3b
SHA512fcdccea603737364dbdbbcd5763fd85aeb0c175e6790128c93360af43e2587d0fd173bee4843c681f43fb63d57fcaef1a58be683625c905416e0c58af5bf1d6c
-
Filesize
11KB
MD5821670341b5465047733cc460856a2f5
SHA1e0a1bbc859a1f502ba086ddd8bced82ab6843399
SHA25684780c05c9ad7b1e554211cd31bbcb02cbe587e4f08bd2d0b9561d104c4d125c
SHA5125f617695ea9a5312dbbd13e379e124a96692cc228b0bc366b93cdcdaf3e23375602d9e81cf5a4286a5cedeaae635f11120c2c2390876bf3fd7398c59044be82f
-
Filesize
9KB
MD59c34d1ec0b1c10fe8f53b9caa572856a
SHA1141cdb91ec3c8135a4ac1fe879d82a9e078ab3cb
SHA2564ab62b514bae327476add45f5804895578e9f1658d8cf40ac5e7c4fb227469fa
SHA5126447889ffe049579f3e09d5828393f7dc5268b2061895ed424f3c83b8c1929d6fecc6f8c9823c483f451c31458736d27d83eb3979a5c91703dad913957717d09
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
47KB
MD5758fff1d194a7ac7a1e3d98bcf143a44
SHA1de1c61a8e1fb90666340f8b0a34e4d8bfc56da07
SHA256f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708
SHA512468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc
-
Filesize
56KB
MD56ca9a99c75a0b7b6a22681aa8e5ad77b
SHA1dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8
SHA256d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8
SHA512b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe
-
Filesize
33KB
MD50d723bc34592d5bb2b32cf259858d80e
SHA1eacfabd037ba5890885656f2485c2d7226a19d17
SHA256f2b927aaa856d23f628b01380d5a19bfe9233db39c9078c0e0585d376948c13f
SHA5123e79455554d527d380adca39ac10dbf3914ca4980d8ee009b7daf30aeb4e9359d9d890403da9cc2b69327c695c57374c390fa780a8fd6148bbea3136138ead33
-
Filesize
84KB
MD5abceeceaeff3798b5b0de412af610f58
SHA1c3c94c120b5bed8bccf8104d933e96ac6e42ca90
SHA256216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e
SHA5123e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955
-
Filesize
24KB
MD50d267bb65918b55839a9400b0fb11aa2
SHA154e66a14bea8ae551ab6f8f48d81560b2add1afc
SHA25613ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c
SHA512c2375f46a98e44f54e2dd0a5cc5f016098500090bb78de520dc5e05aef8e6f11405d8f6964850a03060caed3628d0a6303091cba1f28a0aa9b3b814217d71e56
-
Filesize
41KB
MD5afd296823375e106c4b1ac8b39927f8b
SHA1b05d811e5a5921d5b5cc90b9e4763fd63783587b
SHA256e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007
SHA51295e98a24be9e603b2870b787349e2aa7734014ac088c691063e4078e11a04898c9c547d6998224b1b171fc4802039c3078a28c7e81d59f6497f2f9230d8c9369
-
Filesize
48KB
MD57b45afc909647c373749ef946c67d7cf
SHA181f813c1d8c4b6497c01615dcb6aa40b92a7bd20
SHA256a5f39bfd2b43799922e303a3490164c882f6e630777a3a0998e89235dc513b5e
SHA512fe67e58f30a2c95d7d42a102ed818f4d57baa524c5c2d781c933de201028c75084c3e836ff4237e066f3c7dd6a5492933c3da3fee76eb2c50a6915996ef6d7fb
-
Filesize
60KB
MD51e643c629f993a63045b0ff70d6cf7c6
SHA19af2d22226e57dc16c199cad002e3beb6a0a0058
SHA2564a50b4b77bf9e5d6f62c7850589b80b4caa775c81856b0d84cb1a73d397eb38a
SHA5129d8cd6e9c03880cc015e87059db28ff588881679f8e3f5a26a90f13e2c34a5bd03fb7329d9a4e33c4a01209c85a36fc999e77d9ece42cebdb738c2f1fd6775af
-
Filesize
21KB
MD581dfa68ca3cb20ced73316dbc78423f6
SHA18841cf22938aa6ee373ff770716bb9c6d9bc3e26
SHA256d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190
SHA512e24288ae627488251682cd47c1884f2dc5f4cd834d7959b9881e5739c42d91fd0a30e75f0de77f5b5a0d63d9baebcafa56851e7e40812df367fd433421c0ccdb
-
Filesize
1.0MB
MD5a6804a7c926a00a0aa0633d667ebd100
SHA1b085a5afa20dc56a2941c9b342fde73dbe5c9a9e
SHA2568c3c451ad584b4473a03c8836627402a820247fc183a285511e5c9c171333d96
SHA5123143aa8dd837b9fd0ac6da3bb7dfe367bc0653f167c2503fa5e3521f2b2ab47c6638fec7cde7bcc8377d0682f32d6e1b68194dc657b4072328f14f649fca79d7
-
Filesize
9KB
MD55828e30a287b76eceb7ac9f96717e050
SHA16c330fa970272d6e7ccc785a6058593713ba37a4
SHA25696fe884cc40b36f1fa5999157c11a4ec87c1f1c324d63dddc097d47a7c625e4e
SHA512056951ce28bb8c63232094bee0fa8936af711a0e493a83c5e4e30a740b8c9d16707af5f60c5e689e822d164c2880c8bc8f55bc1b3e45533b598c4b4647e71086
-
Filesize
38KB
MD5631425c091dcf770f0a7e42094f04836
SHA108ff1b44fd4785d70b0dcf922db73ad9e885fc6f
SHA25682a4df188a276b1b96f93b693228a12e3cb7c52de7a95d03e9a73e9a05bb6038
SHA512578cc3d59d522b49a116502b721ed14c0eeefab9cac1bc8b21e6d948f800c34ff76ca829a1d9057ca8ffb61f02e7f9c1c9394d1d3ad432656e6f68a4b76f7526
-
Filesize
1.1MB
MD5da5fe6e5cfc41381025994f261df7148
SHA113998e241464952d2d34eb6e8ecfcd2eb1f19a64
SHA256de045c36ae437a5b40fc90a8a7cc037facd5b7e307cfcf9a9087c5f1a6a2cf18
SHA512a0d7ebf83204065236439d495eb3c97be093c41daac2e6cfbbb1aa8ffeac049402a3dea7139b1770d2e1a45e08623a56a94d64c8f0c5be74c5bae039a2bc6ca9
-
Filesize
23KB
MD5b5150b41ca910f212a1dd236832eb472
SHA1a17809732c562524b185953ffe60dfa91ba3ce7d
SHA2561a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
SHA5129e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6
-
Filesize
203KB
MD548d792202922fffe8ea12798f03d94de
SHA1f8818be47becb8ccf2907399f62019c3be0efeb5
SHA2568221a76831a103b2b2ae01c3702d0bba4f82f2afd4390a3727056e60b28650cc
SHA51269f3a8b556dd517ae89084623f499ef89bd0f97031e3006677ceed330ed13fcc56bf3cde5c9ed0fc6c440487d13899ffda775e6a967966294cadfd70069b2833
-
Filesize
34KB
MD504d71bdd54b4c79cfaf21c1aa0a80132
SHA112bec0411eee3dbed5146696ca17857a4d49cf0d
SHA256ea7faaa075c0ca0747be4fef7d19bda21b05f6d176d1cbad2611f481f49efe23
SHA512c7712b271681327fc1a20c8ae3d06fed940c0ac37fe24c60e2424f9e9e152227998e0c229e7409c0d0a7538c9aa12699665fbdf0ed50d42c6577cd4fb3efd6d6
-
Filesize
63KB
MD5c17b7a4b853827f538576f4c3521c653
SHA16115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA5128e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
Filesize
195KB
MD5c1dda655900c76a359534ce503035e05
SHA12ee4ada253f10c1a8facb105698cafff2b53b5e8
SHA25626258ad7f04fcb9a1e2ab9ba0b04a586031e5d81c3d2c1e1d40418978253c4cd
SHA512b55b6469a59752601a9d1996c2ae5245ca6b919468c057d8fc0253e3b314db376a597de2879d1e72a60c3662dfefbcb08d286b38022b041b937d39082855d223
-
Filesize
61KB
MD52dcfb72036a89f11709f1317ff413883
SHA1818406cca32c15520d6423bbb97cdfa8d8a7d786
SHA256ac8b3341e756bc59358e36f390980ca46ec2a631dd8bf8739b4288484b131a4e
SHA5125fe7c45f09245db2572d771ec0bb7c83cab5b4b2dea15378549b7029cc6a4c7beebb40f763346f9a4343a6eacfb6cf0ade2ef36838cce4db100b5d4d843ca74e
-
Filesize
24KB
MD572009cde5945de0673a11efb521c8ccd
SHA1bddb47ac13c6302a871a53ba303001837939f837
SHA2565aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca
SHA512d00a42700c9201f23a44fd9407fea7ea9df1014c976133f33ff711150727bf160941373d53f3a973f7dd6ca7b5502e178c2b88ea1815ca8bce1a239ed5d8256d
-
Filesize
608KB
MD5b70d218798c0fec39de1199c796ebce8
SHA173b9f8389706790a0fec3c7662c997d0a238a4a0
SHA2564830e8d4ae005a73834371fe7bb5b91ca8a4c4c3a4b9a838939f18920f10faff
SHA5122ede15cc8a229bfc599980ce7180a7a3c37c0264415470801cf098ef4dac7bcf857821f647614490c1b0865882619a24e3ac0848b5aea1796fad054c0dd6f718
-
Filesize
287KB
MD5ca3baebf8725c7d785710f1dfbb2736d
SHA18f9aec2732a252888f3873967d8cc0139ff7f4e5
SHA256f2d03a39556491d1ace63447b067b38055f32f5f1523c01249ba18052c599b4c
SHA5125c2397e4dcb361a154cd3887c229bcf7ef980acbb4b851a16294d5df6245b2615cc4b42f6a95cf1d3c49b735c2f7025447247d887ccf4cd964f19f14e4533470
-
Filesize
48KB
MD523b6e4591cf72f3dea00bbe7e1570bf6
SHA1d1b3459afdbcc94e13415ac112abda3693ba75a2
SHA256388458feb3634bfced86140073ce3f027f1ae4a2ec73aa7f4b18d5475513f9da
SHA512e40f42cf2b6fb5261cd9b653e03011375157a5ce7ff99b6db7ecc1eab9bc356b2e989ed43ba7c1ec904e58549da3cd5d153405d6d76d4a9485f18e02442ac4c8