695141d7a2ad5ab74c3b10a5a70d5d9d279876cfa58e0a19bbfd0ca9b61fc005

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2025, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
695141d7a2ad5ab74c3b10a5a70d5d9d279876cfa58e0a19bbfd0ca9b61fc005.msi
Size 17.2MB
Sample250116-mv5cdaxpfl
SHA256 695141d7a2ad5ab74c3b10a5a70d5d9d279876cfa58e0a19bbfd0ca9b61fc005
MD5 616007447ba71fa737a5c37fe3dccd26
SHA1 16f32a49e99222125bf5ab0e9051d60fb731e9dd
SHA512 3e2cda058c3b0b8976dc94416a8949d86fd949e04ee14463189d07bca759808268f8eea7e0cc5bf1bb2cc2fc091aae13f220c1d3560f211dddeea2c0f21eb8bb
SSDEEP 393216:E1Mlxgd2KyqEOj4P8Mi4aToiWlfUOCZlFfpliJw2H961Jsv6tWKFdu9CJ4ZdXo:ESe2vwElfb+NXiJD9tq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MakeBeaconSX.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 4604	4872	iScrPaint.exe	98

Executes dropped EXE 12 IoCs

pid	Process
1952	ISBEW64.exe
1976	ISBEW64.exe
5064	ISBEW64.exe
1956	ISBEW64.exe
1576	ISBEW64.exe
2880	ISBEW64.exe
1116	ISBEW64.exe
1872	ISBEW64.exe
2432	ISBEW64.exe
3880	ISBEW64.exe
2792	iScrPaint.exe
4872	iScrPaint.exe

Loads dropped DLL 8 IoCs

pid	Process
3820	MsiExec.exe
3820	MsiExec.exe
3820	MsiExec.exe
3820	MsiExec.exe
3820	MsiExec.exe
2792	iScrPaint.exe
4872	iScrPaint.exe
1932	MakeBeaconSX.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2676	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iScrPaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iScrPaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2792	iScrPaint.exe
4872	iScrPaint.exe
4872	iScrPaint.exe
4604	cmd.exe
4604	cmd.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
4756	msedge.exe
4756	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
3116	identity_helper.exe
3116	identity_helper.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe
1932	MakeBeaconSX.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4872	iScrPaint.exe
4604	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2676	msiexec.exe
Token: SeSecurityPrivilege	3588	msiexec.exe
Token: SeCreateTokenPrivilege	2676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2676	msiexec.exe
Token: SeLockMemoryPrivilege	2676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2676	msiexec.exe
Token: SeMachineAccountPrivilege	2676	msiexec.exe
Token: SeTcbPrivilege	2676	msiexec.exe
Token: SeSecurityPrivilege	2676	msiexec.exe
Token: SeTakeOwnershipPrivilege	2676	msiexec.exe
Token: SeLoadDriverPrivilege	2676	msiexec.exe
Token: SeSystemProfilePrivilege	2676	msiexec.exe
Token: SeSystemtimePrivilege	2676	msiexec.exe
Token: SeProfSingleProcessPrivilege	2676	msiexec.exe
Token: SeIncBasePriorityPrivilege	2676	msiexec.exe
Token: SeCreatePagefilePrivilege	2676	msiexec.exe
Token: SeCreatePermanentPrivilege	2676	msiexec.exe
Token: SeBackupPrivilege	2676	msiexec.exe
Token: SeRestorePrivilege	2676	msiexec.exe
Token: SeShutdownPrivilege	2676	msiexec.exe
Token: SeDebugPrivilege	2676	msiexec.exe
Token: SeAuditPrivilege	2676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2676	msiexec.exe
Token: SeChangeNotifyPrivilege	2676	msiexec.exe
Token: SeRemoteShutdownPrivilege	2676	msiexec.exe
Token: SeUndockPrivilege	2676	msiexec.exe
Token: SeSyncAgentPrivilege	2676	msiexec.exe
Token: SeEnableDelegationPrivilege	2676	msiexec.exe
Token: SeManageVolumePrivilege	2676	msiexec.exe
Token: SeImpersonatePrivilege	2676	msiexec.exe
Token: SeCreateGlobalPrivilege	2676	msiexec.exe
Token: SeCreateTokenPrivilege	2676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2676	msiexec.exe
Token: SeLockMemoryPrivilege	2676	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2676	msiexec.exe
Token: SeMachineAccountPrivilege	2676	msiexec.exe
Token: SeTcbPrivilege	2676	msiexec.exe
Token: SeSecurityPrivilege	2676	msiexec.exe
Token: SeTakeOwnershipPrivilege	2676	msiexec.exe
Token: SeLoadDriverPrivilege	2676	msiexec.exe
Token: SeSystemProfilePrivilege	2676	msiexec.exe
Token: SeSystemtimePrivilege	2676	msiexec.exe
Token: SeProfSingleProcessPrivilege	2676	msiexec.exe
Token: SeIncBasePriorityPrivilege	2676	msiexec.exe
Token: SeCreatePagefilePrivilege	2676	msiexec.exe
Token: SeCreatePermanentPrivilege	2676	msiexec.exe
Token: SeBackupPrivilege	2676	msiexec.exe
Token: SeRestorePrivilege	2676	msiexec.exe
Token: SeShutdownPrivilege	2676	msiexec.exe
Token: SeDebugPrivilege	2676	msiexec.exe
Token: SeAuditPrivilege	2676	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2676	msiexec.exe
Token: SeChangeNotifyPrivilege	2676	msiexec.exe
Token: SeRemoteShutdownPrivilege	2676	msiexec.exe
Token: SeUndockPrivilege	2676	msiexec.exe
Token: SeSyncAgentPrivilege	2676	msiexec.exe
Token: SeEnableDelegationPrivilege	2676	msiexec.exe
Token: SeManageVolumePrivilege	2676	msiexec.exe
Token: SeImpersonatePrivilege	2676	msiexec.exe
Token: SeCreateGlobalPrivilege	2676	msiexec.exe
Token: SeCreateTokenPrivilege	2676	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2676	msiexec.exe
Token: SeLockMemoryPrivilege	2676	msiexec.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2676	msiexec.exe
2676	msiexec.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe
872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3820	3588	msiexec.exe	85
PID 3588 wrote to memory of 3820	3588	msiexec.exe	85
PID 3588 wrote to memory of 3820	3588	msiexec.exe	85
PID 3820 wrote to memory of 1952	3820	MsiExec.exe	86
PID 3820 wrote to memory of 1952	3820	MsiExec.exe	86
PID 3820 wrote to memory of 1976	3820	MsiExec.exe	87
PID 3820 wrote to memory of 1976	3820	MsiExec.exe	87
PID 3820 wrote to memory of 5064	3820	MsiExec.exe	88
PID 3820 wrote to memory of 5064	3820	MsiExec.exe	88
PID 3820 wrote to memory of 1956	3820	MsiExec.exe	89
PID 3820 wrote to memory of 1956	3820	MsiExec.exe	89
PID 3820 wrote to memory of 1576	3820	MsiExec.exe	90
PID 3820 wrote to memory of 1576	3820	MsiExec.exe	90
PID 3820 wrote to memory of 2880	3820	MsiExec.exe	91
PID 3820 wrote to memory of 2880	3820	MsiExec.exe	91
PID 3820 wrote to memory of 1116	3820	MsiExec.exe	92
PID 3820 wrote to memory of 1116	3820	MsiExec.exe	92
PID 3820 wrote to memory of 1872	3820	MsiExec.exe	93
PID 3820 wrote to memory of 1872	3820	MsiExec.exe	93
PID 3820 wrote to memory of 2432	3820	MsiExec.exe	94
PID 3820 wrote to memory of 2432	3820	MsiExec.exe	94
PID 3820 wrote to memory of 3880	3820	MsiExec.exe	95
PID 3820 wrote to memory of 3880	3820	MsiExec.exe	95
PID 3820 wrote to memory of 2792	3820	MsiExec.exe	96
PID 3820 wrote to memory of 2792	3820	MsiExec.exe	96
PID 3820 wrote to memory of 2792	3820	MsiExec.exe	96
PID 2792 wrote to memory of 4872	2792	iScrPaint.exe	97
PID 2792 wrote to memory of 4872	2792	iScrPaint.exe	97
PID 2792 wrote to memory of 4872	2792	iScrPaint.exe	97
PID 4872 wrote to memory of 4604	4872	iScrPaint.exe	98
PID 4872 wrote to memory of 4604	4872	iScrPaint.exe	98
PID 4872 wrote to memory of 4604	4872	iScrPaint.exe	98
PID 4872 wrote to memory of 4604	4872	iScrPaint.exe	98
PID 4604 wrote to memory of 1932	4604	cmd.exe	118
PID 4604 wrote to memory of 1932	4604	cmd.exe	118
PID 4604 wrote to memory of 1932	4604	cmd.exe	118
PID 4604 wrote to memory of 1932	4604	cmd.exe	118
PID 1932 wrote to memory of 872	1932	MakeBeaconSX.exe	121
PID 1932 wrote to memory of 872	1932	MakeBeaconSX.exe	121
PID 872 wrote to memory of 4108	872	msedge.exe	122
PID 872 wrote to memory of 4108	872	msedge.exe	122
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123
PID 872 wrote to memory of 2600	872	msedge.exe	123

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MakeBeaconSX.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\695141d7a2ad5ab74c3b10a5a70d5d9d279876cfa58e0a19bbfd0ca9b61fc005.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2676

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 625E35397D210EF250E9079B36F2B65D C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5C73A4AF-5DE2-4866-9A7D-7F18E1EBEFC8}
    3⤵
    - Executes dropped EXE
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{869D4829-1CF7-4209-B62C-F97689220439}
    3⤵
    - Executes dropped EXE
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9BB8E8C4-CBAD-4C0F-9B59-BD196A4ED1C5}
    3⤵
    - Executes dropped EXE
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B3EB09A4-8254-48BD-9B62-AC6820B008E3}
    3⤵
    - Executes dropped EXE
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A858A4A3-F7B0-4C4D-88FC-047CDBC5A1D5}
    3⤵
    - Executes dropped EXE
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4DF8165A-C557-4D21-86BD-5AB666E569ED}
    3⤵
    - Executes dropped EXE
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{318A47AF-955B-418F-9348-10BBC2130ED2}
    3⤵
    - Executes dropped EXE
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5727BFB5-3267-4AD8-AEE1-FEBCAF5E6997}
    3⤵
    - Executes dropped EXE
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E47F058-CB8D-46D4-AEEB-3BB85B8B658A}
    3⤵
    - Executes dropped EXE
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{891058E5-1081-46B6-97BB-0C639179B823}
    3⤵
    - Executes dropped EXE
    PID:3880
- - C:\Users\Admin\AppData\Local\Temp\{47ACB18C-A669-43BA-BFAA-C50DA7CA92AF}\iScrPaint.exe
    C:\Users\Admin\AppData\Local\Temp\{47ACB18C-A669-43BA-BFAA-C50DA7CA92AF}\iScrPaint.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Roaming\makeSecurepc\iScrPaint.exe
      C:\Users\Admin\AppData\Roaming\makeSecurepc\iScrPaint.exe
      4⤵
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\MakeBeaconSX.exe
        
        C:\Users\Admin\AppData\Local\Temp\MakeBeaconSX.exe
        6⤵
        Accesses Microsoft Outlook profiles
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        
        PID:1932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbe01146f8,0x7ffbe0114708,0x7ffbe0114718
        8⤵
        
        PID:4108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
        8⤵
        
        PID:2600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
        8⤵
        
        PID:4396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        8⤵
        
        PID:3536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        8⤵
        
        PID:1336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
        8⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        8⤵
        
        PID:536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
        8⤵
        
        PID:3368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
        8⤵
        
        PID:1616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
        8⤵
        
        PID:1252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6045582409365436066,8641444321838426143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
        8⤵
        
        PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9a13c1ab32cddf30661cdefc5c393d8da6d504146323036749366932c621ed4f
MD5 2f6a1dac10f21cb92bf797a5de826fa7
SHA1 1a10df2ddca6d58da961be0897685ec4785427cf
SHA512 65a0a6528298917ff8c4b0db4c208cdde2b3b136357773c7d0b2c11968a911fa0eb960cfa5bc77a0e8672d802ec6ce486ece40fb49a643136d17bbc781faa026
SSDEEP 96:nxAkvV1CJwpvWMoiVmdeHqZyz+UWQyV+VDCziEwb:nxAktkJGWMXtz+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fbfc3ebe924f38f50d93469f6b0b5b3ec0178e8b2ae16f3473ddef58af2032d8
MD5 646b31ce8831e81a82a1658106402f87
SHA1 0b688e163e14122499657ab527a18b1f14f0dbd3
SHA512 1e0768bd8a27f723dc9b0628db6f5dadda7fbf8cd72566dc7a9a5d529191ba04a6c3ecae0f496c17e653f63e87f8f21dbef8d33cb2346ad6aefbca806e36fc9b
SSDEEP 96:nxAknV1CJwpvWMoiVmdeHqZyz+UWQyV+VD7AiEwb:nxAkVkJGWMXtz+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d939232827b6d82b5e50d09a064643ce896e9e2eb31da25e551030ac43df1588
MD5 f7bce33839e2dfef034a9a4262e507ca
SHA1 7bb82cde14df9f1c5ada59124cbe057b75c864e0
SHA512 cf4c5d4eec5861c83625a5f6e709a53c1a673fb37cb39db9732ad659b8043c744b4716a86c2960093b79b37c8d5f0e0c6cea951af05d9d682233a5fed9f9890c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTWWBe2RUOemSrAi8wU8epi:A9iIxuERzA83h09RZxYTWkepMiPU80u
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6D7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6D7F.tmp
Size 171KB
SHA256 b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f
MD5 a0e940a3d3c1523416675125e3b0c07e
SHA1 2e29eeba6da9a4023bc8071158feee3b0277fd1b
SHA512 736ea06824388372aeef1938c6b11e66f4595e0b0589d7b4a87ff4abbabe52e82dff64d916293eab47aa869cf372ced2c66755dd8a8471b2ab0d3a37ba91d0b2
SSDEEP 3072:opnAfE+giQ322hTQxecDHudFJhIA+iM7kD5zZPE5oytDMu:oRUQth08oa7JsOJ3owu
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI70CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI70CC.tmp
Size 2.5MB
SHA256 1bef7ce7ff05e8eadb67501ffe30c6a4ac5944efafa8a52aace9339de6f28959
MD5 3ecb55466b2a6fc4c6df6024b2bf6e6e
SHA1 24659b186a8424d8ccc37781aa7e19af516f638f
SHA512 96b52b58668c5a62cd20539459c76f88db890c95e909cbbd12814dc44b913ab055bf5ac3a56662e87e3ec0b35037613c97bdfcb6851c6c55ce7b20a209426db1
SSDEEP 49152:faOS6j4wt3618wn6DNEYJEImTRCjEtNWOOBHM9jmOl2r3Nb7dV:1S6j4wt36yFD3oXDfwdXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MakeBeaconSX.exe

Path C:\Users\Admin\AppData\Local\Temp\MakeBeaconSX.exe
Size 2.3MB
SHA256 b22bf1210b5fd173a210ebfa9092390aa0513c41e1914cbe161eb547f049ef91
MD5 967f4470627f823f4d7981e511c9824f
SHA1 416501b096df80ddc49f4144c3832cf2cadb9cb2
SHA512 8883ead428c9d4b415046de9f8398aa1f65ae81fe7945a840c822620e18f6f9930cce2e10acff3b5da8b9c817ade3dabc1de576cbd255087267f77341900a41c
SSDEEP 49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5cc9815

Path C:\Users\Admin\AppData\Local\Temp\f5cc9815
Size 5.6MB
SHA256 fbf313eede30d46cf13c43dd7e4c890bcfd33c055c32f1ed36d2fa676605973b
MD5 cabb5a8cd8224a58cbaf6b72b1e29277
SHA1 57a57df5d20d9b4dfd0c2a2b523524ead2792f2a
SHA512 1ec819b5dda3e14255a06cef29597df4ad2d49826b48ffdb3204818a46dadc7ff9d24543d4a9bc26799eafa4f9ba7d9a715c07230aae9d90a33330ea23c332b9
SSDEEP 98304:8rMxKOMVpRT4P6pZZcxbuka8KgK5Jgclu1gq4ecFA:8TuscikzPgiBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebUI.dll

Path C:\Users\Admin\AppData\Local\Temp\{47ACB18C-A669-43BA-BFAA-C50DA7CA92AF}\WebUI.dll
Size 7.6MB
SHA256 77678ebee6ab20212f8f1b62e0815d542a8f7e6deb525230b88dcef56f761c3d
MD5 ffe72459e3ad3a3055157ab22a3bd999
SHA1 9c9019374f4de980d4f962c4a52c673999c7d2a0
SHA512 8385a385d2232ec9cef674bab3d8253ba7bbc4dc0feca29199c59a43d2aa6136eb2fd14b7f7847beb61eb75a16c962be2aeba398ccb4a28e11a470c4630744c5
SSDEEP 196608:R39zxBBmYeZ1/U8Blc/OwDlcXus9n0SJsv6tWKFdu9CZ:3zx6YeZ1/TBlc/OwDlitJsv6tWKFdu9C
MD5 SHA1 SHA512 SSDEEP

Submit Download

brad.mp4

Path C:\Users\Admin\AppData\Local\Temp\{47ACB18C-A669-43BA-BFAA-C50DA7CA92AF}\brad.mp4
Size 4.5MB
SHA256 675b49ae8dd195c987367856a11766dd13f68387363da60d375f5ed0d2d0b187
MD5 bf13a8b985263667b382be62e4e252db
SHA1 8200c5bec4d49c77792cde6b7974b61909957350
SHA512 f5305f423f4cf1c686845711bf60ab8244b4be3bd0ebabee5bbcbeb3b38e983a04d9d8a8d20510ee747519c78165517ce901829bb7a7409b0b0ab9fcc3e3a32b
SSDEEP 98304:IiFc2mPsZatBGOofDgjUHGp6oDaAOZLdIVEc6TXgswXMWqJ7aM7WfR+3:7FXyAiUH8D2ZdsEQXMWqJ79Kfa
MD5 SHA1 SHA512 SSDEEP

Submit Download

iScrPaint.exe

Path C:\Users\Admin\AppData\Local\Temp\{47ACB18C-A669-43BA-BFAA-C50DA7CA92AF}\iScrPaint.exe
Size 1.8MB
SHA256 46afbf1cbd2e1b5e108c133d4079faddc7347231b0c48566fd967a3070745e7f
MD5 098ac4621ee0e855e0710710736c2955
SHA1 ce7b88657c3449d5d05591314aaa43bd3e32bdaa
SHA512 3042785b81bd18b641f0a2b5d8aec8ef86f9bf1269421fb96d1db35a913e744eaff16d9da7a02c8001435d59befb9f26bc0bbfa6e794811abf4282ed68b185fe
SSDEEP 49152:GpjwrP6yVgBd39sUUzFti4aTotmIT3SxLmNKbx:GpjwrP6yKTOUmi4aTo1NK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

kwacha.wma

Path C:\Users\Admin\AppData\Local\Temp\{47ACB18C-A669-43BA-BFAA-C50DA7CA92AF}\kwacha.wma
Size 64KB
SHA256 a72801d1524101449f94cea7868d142e7577bca382772e699661e3595401b3e1
MD5 d43d3a6f783f3eac24f397197d0140ce
SHA1 fc2eabcf653053264765dff03de79c615e24f411
SHA512 896c1849ad814c0f289e5cbc2a7f9c8d6d55859645121764b17d0c008ae91175eeac5da01eabbeb87ac80b6e600593d1290f2de2179a6b733e4731f051def8bc
SSDEEP 1536:ImWPH8oldWelxMrd3s/LEqfxShY0FJydwBIUzUs:TIH1PWyg3QESsY0+duIUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISBEW64.exe

Path C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISBEW64.exe
Size 178KB
SHA256 561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f
MD5 40f3a092744e46f3531a40b917cca81e
SHA1 c73f62a44cb3a75933cecf1be73a48d0d623039b
SHA512 1589b27db29051c772e5ba56953d9f798efbf74d75e0524fa8569df092d28960972779811a7916198d0707d35b1093d3e0dd7669a8179c412cfa7df7120733b2
SSDEEP 3072:cIFNKUw8ALJ+C2T0FSmmiYQT4XF2E+JYHdeZ2bgA/qLTM6:wUn0mT8Sc/T4V1b9xg8N6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISRT.dll

Path C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\ISRT.dll
Size 426KB
SHA256 58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e
MD5 8af02bf8e358e11caec4f2e7884b43cc
SHA1 16badc6c610eeb08de121ab268093dd36b56bf27
SHA512 d0228a8cc93ff6647c2f4ba645fa224dc9d114e2adb5b5d01670b6dafc2258b5b1be11629868748e77b346e291974325e8e8e1192042d7c04a35fc727ad4e3fd
SSDEEP 6144:Ob9ySl0fcsmxCLCN7zRpT6bHJibmR6KSHg2Vb5eeRWTo22tcZ3u/Gszt2A2//Hr5:OlsmH7z/sDR6Dv9vWsIuusw/4+q90
MD5 SHA1 SHA512 SSDEEP

Submit Download

_isres_0x0409.dll

Path C:\Users\Admin\AppData\Local\Temp\{8759DBEA-EA41-4D0A-948C-809C63EA5BF5}\_isres_0x0409.dll
Size 1.8MB
SHA256 bd32468ee7e8885323f22eabbff9763a0f6ffef3cc151e0bd0481df5888f4152
MD5 7de024bc275f9cdeaf66a865e6fd8e58
SHA1 5086e4a26f9b80699ea8d9f2a33cead28a1819c0
SHA512 191c57e22ea13d13806dd390c4039029d40c7532918618d185d8a627aabc3969c7af2e532e3c933bde8f652b4723d951bf712e9ba0cc0d172dde693012f5ef1a
SSDEEP 12288:ys4d9dfaOdWEINpJCPtjvntnSb8COevQonCLPub+74v8:chrWlNDCPtjvntnSb8COevQonCfo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1932-107-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-179-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-162-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-94-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-95-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-97-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-102-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/1932-104-0x00007FF6EB660000-0x00007FF6EB9A3000-memory.dmp

Download

memory/2792-54-0x0000000073040000-0x00000000731BB000-memory.dmp

Download

memory/2792-55-0x00007FFBFF5D0000-0x00007FFBFF7C5000-memory.dmp

Download

memory/2792-64-0x0000000000400000-0x000000000061B000-memory.dmp

Download

memory/3820-37-0x0000000002DC0000-0x0000000002F87000-memory.dmp

Download

memory/3820-32-0x0000000010000000-0x0000000010114000-memory.dmp

Download

memory/4604-87-0x0000000074DE0000-0x0000000074F5B000-memory.dmp

Download

memory/4604-84-0x00007FFBFF5D0000-0x00007FFBFF7C5000-memory.dmp

Download

memory/4872-79-0x00007FFBFF5D0000-0x00007FFBFF7C5000-memory.dmp

Download

memory/4872-78-0x0000000074DE0000-0x0000000074F5B000-memory.dmp

Download

memory/4872-82-0x0000000000400000-0x000000000061B000-memory.dmp

Download

memory/4872-80-0x0000000074DE0000-0x0000000074F5B000-memory.dmp

Download